Company: CRNX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-029050
Chunk: 189

Company: Crinetics Pharmaceuticals, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 189
---
 with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States; in July 2020, the Court of Justice of the European Union, or CJEU, invalidated the EU-US Privacy Shield Framework, or Privacy Shield, under which personal data could be transferred from the EEA to US entities who had self-certified under the Privacy Shield scheme and imposed further restrictions on the use of standard contractual clauses, or SCCs. In March 2022, the US and EU announced a new regulatory regime intended to replace the invalidated regulations with the Trans-Atlantic Data Privacy Framework, or EU-U.S. DPF. In July 2023, the European Commission adopted an adequacy decision in relation to the EU-U.S. DPF, allowing the EU-U.S. DPF to be utilized as a means of legitimizing EU-U.S. personal data transfers for participating entities. The EU-U.S. DPF may be subject to legal challenges from privacy advocacy groups or others, and the European Commission’s adequacy decision regarding the EU-U.S. DPF provides that the EU-U.S. DPF will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/ or start taking enforcement action, we could suffer additional costs, complaints and/ or regulatory investigations or fines, and/ or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Additionally, since January 1, 2021, we have been subject to the GDPR and also the UK GDPR which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. On June 28, 2021, the European Commission adopted an adequacy decision for the UK, allowing for the relatively free exchange of personal information between the EU and the UK (as the UK correspondingly