Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 30

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 30
---
 face penalties if we fail to adopt comprehensive compliance measures, including documenting the steps we have taken to comply.

EU and UK Data Protection Regime

The processing of personal data, including patients’ personal health data, in the European Economic Area, or EEA, and the UK is governed by the General Data Protection Regulation, or the GDPR. The GDPR applies to any company established in the EEA and to companies established outside the EEA that process personal data in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. The GDPR enhances data protection obligations for data controllers of personal data, including inter alia stringent requirements relating to lawful and legitimate basis and purposes for the processing of personal data, the consent of data subjects, expanded disclosures about how personal data is used, requirements to conduct privacy impact assessments for “high risk” processing, limitations on retention of personal data, appointment of data protection officers, conclusion of data processing agreements, mandatory data breach notification and “privacy by design” requirements, and creates direct obligations on service providers acting as data processors. 

The GDPR also imposes strict rules on the transfer of personal data outside of the EEA to countries that do not ensure an adequate level of protection. Previously, one such data transfer mechanism was the EU-US Privacy Shield, but the Privacy Shield was invalidated for international transfers of personal data in July 2020 by the Court of Justice of the European Union, or CJEU. Following the CJEU’s decision and an executive order issued by President Biden on October 7, 2022, The European Commission announced in July 2023 that it had adopted a new adequacy decision with respect to the United States under a new regulatory structure known as the EU-US Data Privacy Framework. Separately, the CJEU upheld the validity of standard contractual clauses, or SCCs, as a legal mechanism to transfer personal data, but companies relying on SCCs are subject to additional guidance from regulators in the EEA and need to evaluate and implement supplementary measures that provide privacy protections additional to those provided under SCCs. 

Failure to comply with the requirements of the GDPR and the related national data protection laws of the EEA Member States may result in fines up to €20 million or 4% of a company’s global annual revenues for the preceding financial year, whichever is higher. Moreover, the GDPR grants data subjects the right to claim material and non-material damages resulting 

14

from infringement of the GDPR. In June 2021, the