AbCellera Biologics (ABCL) Risk Analysis

We rely heavily on trade secrets and confidentiality agreements to protect our unpatented know-how, technology and other proprietary information, including parts of our discovery and development capabilities, and to maintain our competitive position. However, trade secrets and know-how can be difficult to protect. In addition to pursuing patents on our technology, we take steps to protect our intellectual property and proprietary technology by entering into agreements, including confidentiality agreements, non-disclosure agreements and intellectual property assignment agreements, with our employees, consultants, academic institutions, corporate partners and, when needed, our advisers. However, we cannot be certain that such agreements have been entered into with all relevant parties, and we cannot be certain that our trade secrets and other confidential proprietary information will not be disclosed or that competitors will not otherwise gain access to our trade secrets or independently develop substantially equivalent information and techniques. For example, any of these parties may breach the agreements and disclose our proprietary information, including our trade secrets, and we may not be able to obtain adequate remedies for such breaches. Such agreements may not be enforceable or may not provide meaningful protection for our trade secrets or other proprietary information in the event of unauthorized use or disclosure or other breaches of the agreements, and we may not be able to prevent such unauthorized disclosure, which could adversely impact our ability to establish or maintain a competitive advantage in the market. If we are required to assert our rights against such party, it could result in significant cost and distraction. Monitoring unauthorized disclosure and detection of unauthorized disclosure is difficult, and we do not know whether the steps we have taken to prevent such disclosure are, or will be, adequate. If we were to enforce a claim that a third-party had illegally obtained and was using our trade secrets, it would be expensive and time-consuming, and the outcome would be unpredictable. In addition, some courts both within and outside the United States and Canada may be less willing, or unwilling, to protect trade secrets. We also seek to preserve the integrity and confidentiality of our confidential proprietary information by maintaining physical security of our premises and physical and electronic security of our information technology systems, but it is possible that these security measures could be breached. If any of our confidential proprietary information were to be lawfully obtained or independently developed by a competitor or other third-party, absent patent protection, we would have no right to prevent such competitor from using that technology or information to compete with us, which could harm our competitive position. If any of our trade secrets were to be disclosed to or independently discovered by a competitor or other third-party, it could harm our business, financial condition, results of operations and prospects.

In the ordinary course of our business, we collect and store petabytes of sensitive data, including legally protected health information, personally identifiable information, intellectual property and proprietary business information owned or controlled by ourselves or our strategic partners. We manage and maintain our applications and data by utilizing a combination of on-site systems, managed data center systems and cloud-based data center systems. These applications and data encompass a wide variety of business-critical information, including research and development information, commercial information and business and financial information. We face four primary risks relative to protecting this critical information: loss of access risk, inappropriate disclosure risk, inappropriate modification risk and the risk of being unable to adequately monitor our controls over the first three risks. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure and that of any third-party provider we may utilize, may be vulnerable to attacks by hackers or viruses or breached due to employee error, malfeasance or other disruptions. Any such breach or interruption could compromise our networks and the information stored there could be accessed by unauthorized parties, publicly disclosed, lost or stolen. Any such access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, such as the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and regulatory penalties. Although we have implemented security measures and a formal enterprise security program to prevent unauthorized access to sensitive data, there is no guarantee that we can protect our systems from breach. Unauthorized access, loss or dissemination could also disrupt our operations (including our ability to conduct our analyses, pay providers, conduct research and development activities, collect, process and prepare company financial information, provide information about any future products, and manage the administrative aspects of our business) and damage our reputation, any of which could adversely affect our business. HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and its implementing regulations, impose certain requirements relating to the privacy, security, transmission and breach reporting of individually identifiable health information upon entities subject to the law, such as health plans, healthcare clearinghouses and healthcare providers and their respective business associates that perform services for them that involve individually identifiable health information. Mandatory penalties for HIPAA violations can be significant, and criminal and monetary penalties, as well as injunctive relief, may be imposed for HIPAA violations. Although drug manufacturers are not directly subject to HIPAA, prosecutors are increasingly using HIPAA-related theories of liability against drug manufacturers and their agents and we also could be subject to criminal penalties if we knowingly obtain individually identifiable health information from a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. Furthermore, in the event of a breach as defined by HIPAA, HIPAA regulations impose specific reporting requirements to regulators, individuals impacted by the breach and the media. Issuing such notifications can be costly, time and resource intensive, and can generate significant negative publicity. Breaches of HIPAA may also constitute contractual violations that could lead to contractual damages or terminations. In addition, U.S. states have enacted and are considering enacting laws relating to the protection of patient health and other data, which may be more rigorous than, or impose additional requirements beyond those required by, HIPAA. For example, the California Consumer Privacy Act ("CCPA"), which became effective on January 1, 2020, gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations as well as a limited private right of action for data breaches, which may increase the volume of data breach litigation. While limited CCPA exemptions may apply to portions of our business, the recency of the CCPA's implementing regulations and the California Attorney General's enforcement activity means our obligations under the CCPA could evolve in the future, which may increase our compliance costs and potential liability. Further, a California ballot initiative, the California Privacy Rights Act, or CPRA, was passed by California voters on November 3, 2020. The CPRA, which became effective on January 1, 2023, creates additional obligations with respect to processing and storing personal information. Additionally, some observers have noted that the CCPA, as modified by the CPRA could mark the beginning of a trend toward more stringent privacy legislation in the U.S., which could increase our potential liability and adversely affect our business. Already, in the United States, we have witnessed significant developments at the state level. For example, Virginia, Utah, Colorado, and Connecticut have all enacted comprehensive consumer privacy laws. While these state laws incorporate many similar concepts of the CCPA and CPRA, there are also several key differences in the scope, application, and enforcement of the law that will change the operational practices of regulated businesses. The new laws will, among other things, impact how regulated businesses collect and process personal sensitive data, conduct data protection assessments, transfer personal data to affiliates, and respond to consumer rights requests. A number of other states have proposed new privacy laws, some of which are similar to the above discussed recently passed laws. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. We may also become subject to laws and regulations in non-U.S. countries covering data privacy and the protection of health-related and other personal information. In particular, the European Economic Area ("EEA") has adopted data protection laws and regulations that impose significant compliance obligations. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure, processing and security of personal information that identifies or may be used to identify an individual, such as names, contact information, and sensitive personal data such as health data. These laws and regulations are subject to frequent revisions and differing interpretations, and have generally become more stringent over time. The collection, use, storage, disclosure, transfer, or other processing of personal data regarding individuals in the EEA including personal health data, is subject to the EU General Data Protection Regulation ("EU GDPR") and similarly, processing of personal data regarding individuals in the UK is subject to the UK General Data Protection Regulation and the UK Data Protection Act 2018 ("UK GDPR" and together with the EU GDPR "GDPR"). The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the EEA/UK, including the United States, and permits data protection authorities to impose large penalties for violations of the GDPR, including potential fines of up to €20 million (£17.5 million under UK GDPR) or 4% of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In addition, the GDPR includes restrictions on cross-border data transfers of personal data to countries outside the EEA/UK that are not considered by the European Commission and UK government as providing "adequate" protection to personal data ("third countries"), including the United States. The GDPR may increase our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we may be required to put in place additional mechanisms to ensure compliance with the GDPR, including as implemented by individual countries. Compliance with the GDPR is rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. To enable the transfer of personal data outside of the EEA or the UK, adequate safeguards (for example, the European Commission approved Standard Contractual Clauses ("SCCs")) must be implemented in compliance with European and UK data protection laws. In addition, transfers made pursuant to the SCCs (and other similar appropriate transfer safeguards) need to be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular regarding applicable surveillance laws and relevant rights of individuals with respect to the transferred personal data, to ensure an "essentially equivalent" level of protection to that guaranteed in the EEA in the jurisdiction where the data importer is based ("Transfer Impact Assessment"). On June 4, 2021, the EC issued new forms of standard contractual clauses for data transfers from controllers or processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established outside the EU/EEA. The new standard contractual clauses replace the standard contractual clauses that were adopted previously under the EU Data Protection Directive. The UK is not subject to the EC's new standard contractual clauses but has published its own transfer mechanism, the International Data Transfer Agreement and International Data Transfer Addendum ("IDTA"), which enable transfers from the UK, and has also implemented a similar Transfer Impact Assessment requirement. We will be required to implement these new safeguards and carry out Transfer Impact Assessments when conducting restricted data transfers under the GDPR and doing so will require significant effort and cost, and may result in us needing to make strategic considerations around where EEA or UK personal data is stored and transferred, and which service providers we can utilize for the processing of EEA/UK personal data. On July 10, 2023, the European Commission adopted an adequacy decision for the new EU-US Data Privacy Framework ("DPF"), the new transatlantic framework designed to support transfers of personal data from the EU to companies in the US that self-certify compliance with the DPF's privacy requirements, without having to implement additional safeguards. The DPF replaces the Privacy Shield, which was invalidated by the European Court of Justice in July 2020. As with the previous two transatlantic frameworks, it remains to be seen whether the DPF will withstand review by the European courts. Although the UK is regarded as a third country under the EU GDPR, the European Commission has issued a decision recognizing the UK as providing adequate protection under the EU GDPR ("Adequacy Decision") and, therefore, transfers of personal data originating in the EEA to the UK remain unrestricted. The UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing. The UK Government has also now introduced a Data Protection and Digital Information Bill ("UK Bill") into the UK legislative process. The aim of the UK Bill is to reform the UK's data protection regime following Brexit. If passed, the final version of the UK Bill may have the effect of further altering the similarities between the UK and EEA data protection regime and threaten the UK Adequacy Decision from the EU Commission. This may lead to additional compliance costs and could increase our overall risk. The respective provisions and enforcement of the EU GDPR and UK GDPR may further diverge in the future and create additional regulatory challenges and uncertainties. The interpretation and application of consumer, health-related and data protection laws in the United States, the EEA, and elsewhere are often uncertain, contradictory and in flux. Any failure or perceived failure to comply with federal, state or foreign laws or regulations, contractual or other legal obligations related to data privacy or data protection may result in claims, warnings, communications, requests or investigations from individuals, supervisory authorities or other legal or regulatory authorities in relation to our processing of personal data. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices. If so, this could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. In addition, these privacy regulations vary between states, may differ from country to country, and may vary based on whether testing is performed in the United States or in the local country. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business. Furthermore, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on other third parties for the manufacture of our product candidates and to conduct clinical trials, and similar events relating to their computer systems could also have a material adverse effect on our business.

We use open source software in connection with our technology and computational engine of our platform, Celium. Companies that incorporate open source software into their technologies and services have, from time to time, faced claims challenging their use of open source software and compliance with open source license terms. As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software or claiming noncompliance with open source licensing terms. Some open source software licenses require users who distribute software containing open source software to publicly disclose all or part of the source code to the licensee's software that incorporates, links or uses such open source software, and make available to third parties for no cost, any derivative works of the open source code created by the licensee, which could include the licensee's own valuable proprietary code. While we monitor our use of open source software and try to ensure that none is used in a manner that would require us to disclose our proprietary source code or that would otherwise breach the terms of an open source agreement, such use could inadvertently occur, or could be claimed to have occurred, in part because open source license terms are often ambiguous. There is little legal precedent in this area and any actual or claimed requirement to disclose our proprietary source code or pay damages for breach of contract could harm our business and could help third parties, including our competitors, develop technologies that are similar to or better than ours. Any of the foregoing could harm our business, financial condition, results of operations and prospects.