Company: DVAX
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001628280-25-049536
Chunk: 171

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-11-05
Form: 10-Q
Item: Part II, Item 1A
Chunk 171
---
 is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S. If we are unable to implement a legal mechanism to ensure that our transfers of personal data from the EEA or the U.K. are lawful, we could face adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties and injunctions against processing or transferring personal data, and could be required to increase our data processing capabilities in the EEA, the U.K. or elsewhere at significant expense. Restrictions on our ability to transfer personal data from the EEA, the U.K. or elsewhere could impact our clinical trial activities in the EEA or the U.K. and limit our ability to collaborate with CROs and other third parties.

We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair or misrepresentative of our practices, we may face adverse consequences, which may include but are not limited to, governmental enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class-related claims) and mass arbitration demands, additional reporting requirements and/or oversight, bans on processing personal data, orders to destroy or not use personal data, civil and criminal liability and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business or financial condition, including but not limited to interruptions or stoppages in business operations (including our clinical trials), inability to process personal data or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry, or revision or restructuring of our operations.

56

In addition, privacy advocates and industry groups have proposed, and may propose, standards with which we