Company: LGNZZ
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000886163-25-000012
Chunk: 68

Company: LIGAND PHARMACEUTICALS INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 68
---
 If we fail to comply with applicable laws and regulations we could be subject to penalties or sanctions, including criminal penalties if we knowingly obtain or disclose individually identifiable health information from a covered entity in a manner that is not authorized or permitted by the Health Insurance Portability and Accountability Act, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, and regulations implemented thereunder (collectively, “HIPAA”) or applicable state laws.

Certain states have also adopted comparable privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018 (“CCPA”) went into effect on January 1, 2020. The CCPA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal information. The CCPA provides for civil penalties for violations, 

31

as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with data breach litigation. Further, the California Privacy Rights Act (“CPRA”) generally went into effect on January 1, 2023, and significantly amends the CCPA. It imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Additional compliance investment and potential business process changes may be required. Similar laws have passed in other states and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

We are also or may become subject to rapidly evolving data protection laws, rules and regulations in foreign jurisdictions. For example, the European Union General Data Protection Regulation (“GDPR”) governs certain collection and other processing activities involving personal data about individuals in the European Economic Area (“EEA”). Companies that must comply with