Company: RCUS
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001724521-25-000040
Chunk: 119

Company: Arcus Biosciences, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 119
---
 comply with such obligations may not be successful. For example, clinical trial subjects about whom we or our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information. We publish privacy policies, notices and other statements regarding data privacy and security. If these policies, notices or statements are found to be deficient, lacking in transparency, deceptive, unfair, or 

52

misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model. 

Our failure (or that of the third parties upon whom we rely) to comply with U.S. and foreign data protection laws and regulations could result in government enforcement actions (which could include civil or criminal penalties), private litigation, and/or adverse publicity and could negatively affect our operating results and business. Claims that we or the third parties upon whom we rely have violated individuals’ privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis; if viable, these claims carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations (including, as relevant, clinical trials); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations. 

Our business operations expose us