Company: LCTX
Filing Date: 2025-03-10
Form Type: 10-K
Source: 0000950170-25-036309
Chunk: 41

Company: Lineage Cell Therapeutics, Inc.
Filing Date: 2025-03-10
Form: 10-K
Item: Item 1
Chunk 41
---
 certain state and foreign laws also govern the privacy and security of health information in 

25

some circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts.

Privacy and Data Security Laws

In the ordinary course of our business, we may collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, processing) personal data and other sensitive information, including data we collect about trial participants in connection with clinical trials. Accordingly, we are, or may become, subject to numerous data privacy and security requirements related to data privacy, security, and protection under federal, state, local, and foreign laws, regulations, guidance, and industry standards, many of which place restrictions on the Company's ability to transfer, access and use personal data across its business. Compliance with such requirements increases the cost and complexity of doing business and non-compliance may result in, among other penalties and sanctions, substantial monetary fines. The landscape of data privacy laws is evolving, with increasingly stringent regulatory frameworks related to personal data processing, which increase compliance obligations and exposure for noncompliance. In some jurisdictions violations may subject us to fines. For example, under the EU’s General Data Protection Regulation 2016/679 (“EU GDPR”), government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of a company’s annual global revenue, whichever is greater. Further, some laws allow individuals to initiate litigation related to processing of their personal data.

The laws to which we may be subject include privacy-specific laws at a state level such as the California Consumer Privacy Act of 2018 (“CCPA”). Other countries in which we operate also have general privacy obligations, including Israel’s Protection of Privacy Law 5741-1981, the EU GDPR, and the UK’s similar privacy law (“UK GDPR”). These non-US laws apply to processing of personal data of residents, and may apply to some of our activities. Some of our uses of personal information may be subject to specific privacy laws, such as the Telephone Consumer Protection Act or the CAN-SPAM Act. Obligations under these privacy laws may include data minimization, notification, consent, contractual provisions with third parties, restrictions on transfers from one country to another (such as restrictions under EU GDPR and UK GDPR of transfers of personal data to the US unless certain provisions have been met