Company: ARWR
Filing Date: 2025-11-25
Form Type: 10-K
Source: 0000879407-25-000029
Chunk: 122

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-11-25
Form: 10-K
Item: Item 1A
Chunk 122
---
 state and federal data privacy and security laws, including data breach notification laws, data privacy laws (including biometric privacy laws and wiretapping laws), consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and the Health Insurance Portability and Accountability Act (“HIPPA”), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”), and the regulations promulgated thereunder. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”), applies to personal data of consumers, including business representatives and employees, who are California residents, and requires businesses to provide specific disclosures in their privacy notices and affords certain rights to California residents with respect to their personal data. However, the CCPA does not apply to protected health information that is subject to HIPAA/HITECH. The CCPA provides for civil penalties of up to $7,500 per intentional violation and $2,500 per unintentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. In addition, state health information privacy laws, such as California’s Confidentiality of Medical Information Act, Washington’s My Health My Data Act and the Nevada Consumer Health Data Privacy Law, govern the privacy and security of health-related information, specifically, may apply even when HIPAA/HITECH does not and impose additional requirements.

Outside the United States there are additional laws, regulations, and industry standards governing data privacy and security. For example, in the EEA, the General Data Protection Regulation (“GDPR”) and, in the UK, the GDPR as incorporated into UK law pursuant to the European Union (Withdrawal) Act 2018 (the “UK GDPR”) impose strict requirements for processing personal data, including health-related data which is subject to specific requirements. Under the GDPR and UK GDPR, companies may face fines of up to 20 million Euros or 4% of annual global revenue, whichever is greater, , as well as claims from individuals who suffered damages as a result of an infringement. In addition, the GDPR and UK GDPR impose specific restrictions on the transfer of personal data to countries outside of the EEA and UK that are not considered to provide an adequate level of data protection. Although there are currently various mechanisms that may be used to ensure appropriate safeguards to the personal data, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to further requirements,