Company: TXG
Filing Date: 2025-05-09
Form Type: 10-Q
Source: 0001770787-25-000032
Chunk: 128

Company: 10x Genomics, Inc.
Filing Date: 2025-05-09
Form: 10-Q
Item: Part I, Item 8
Chunk 128
---
 could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Since the beginning of 2021, we have also been subject to the UK data protection regime, which imposes separate but similar obligations to those under the GDPR and comparable penalties, including fines of up to £17.5 million or 4% of a noncompliant company’s global annual revenue for the preceding financial year, whichever is greater. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a data transfer mechanism from the UK to U.S. entities self-certified under the DPF. Other foreign jurisdictions, such as China and Russia, are increasingly implementing or developing their own privacy regimes with complex and onerous compliance obligations and robust regulatory enforcement powers. As we continue to expand into other foreign countries and jurisdictions, we may be subject to additional laws and regulations that may affect how we conduct business.

In the United States, the California Consumer Privacy Act of 2018 (the ”CCPA”), as amended by the California Privacy Rights Act (collectively,(the "CCPA"), requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use and disclosure of their personal information, (ii) receive and respond to requests from California residents to access, delete and correct their personal information, or to opt out of certain disclosures of their  personal information, and (iii) enter into specific contractual provisions with services providers that process California resident personal information on the business’s behalf.  Additional compliance investment and potential business process changes may also be required. Similar laws have passed in other states and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging.

60

Furthermore, the Federal Trade Commission (“FTC”) has authority to initiate enforcement actions against entities that mislead customers about compliance with the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information