We are, and may increasingly become, subject to various laws, rules, regulations, treaties, decisions and standards, as well as contractual obligations, relating to data privacy and security in the jurisdictions in which we operate. The regulatory environment related to data privacy and security is increasingly rigorous, with new and constantly changing requirements applicable to our business, and enforcement practices are likely to remain uncertain for the foreseeable future. These laws, rules, regulations, treaties, decisions and standards may be interpreted and applied differently over time and from jurisdiction to jurisdiction and in a manner that is inconsistent with our data practices and that could have a material adverse effect on our results of operations, financial condition and cash flows. New laws, amendments to or reinterpretations of existing laws, rules, regulations, treaties, decisions, standards and other obligations may require us to incur additional costs and restrict our business operations, and may require us to change how we use, collect, store, transfer or otherwise process certain types of personal information and to implement new processes to comply with those laws.
In the U.S., there are numerous federal and state laws and regulations related to the privacy and security of personal information. Regulations promulgated pursuant to the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) establish privacy and security standards that limit the use and disclosure of protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and to ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. Numerous states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and other processing of state residents' personal information, such as the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA), which provides new and enhanced data privacy rights to California residents, such as affording California residents the right to access and delete their information and to opt out of certain sharing and sales of personal information. In addition, laws in all 50 states require businesses to provide notice to individuals whose personal information has been disclosed as a result of a data breach.
Internationally, laws, regulations and standards in many jurisdictions apply broadly to the collection, use, retention, security, disclosure, transfer and other processing of personal information. For example, the EU General Data Protection Regulation (GDPR), which became effective in May 2018, greatly increased the European Commission's jurisdictional reach of its laws and adds a broad array of requirements for handling personal data. EU Member States are tasked under the GDPR to enact, and to have enacted, certain implementing legislation that adds to and/or further interprets the GDPR requirements and potentially extends our obligations and potential liability for failing to meet such obligations. The GDPR, together with national legislation, regulations and guidelines of the EU Member States and Switzerland (via its Federal Data Protection Act) governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer and otherwise process personal data. In particular, the GDPR includes obligations and restrictions concerning the consent and rights of individuals to whom the personal data relates (and the obligations of sponsors of clinical trials acting as data controllers), the transfer of personal data out of the European Economic Area (EEA), the notification of security breaches and the security and confidentiality of personal data. The GDPR authorizes fines for certain violations of up to 4% of global annual revenue or EUR 20 million, whichever is greater. The GDPR also applies to our key business partners, CROs and service providers, whether or not they are located in Europe, with which we share personal data subject to the GDPR. Additionally, following Brexit, we also are subject to the UK General Data Protection Regulation (UK GDPR) (i.e. a version of the GDPR as implemented into UK law), exposing us to two parallel regimes with potentially divergent interpretations and enforcement actions for certain violations. While the European Commission issued an adequacy decision intended to remain in effect until June 2025 in respect of the UK's data protection framework, enabling data transfers from EU Member States to the UK to continue without requiring organizations to put in place contractual or other measures in order to lawfully transfer personal data between the territories, the relationship between the UK and the EU in relation to certain aspects of data privacy and security law remains unclear. For example, such decision may be revoked in the future by the European Commission if the UK data protection regime is reformed in ways that deviate substantially from the GDPR. Although we do not have material operations in the UK, we cannot rule out potential disruptions in relation to the clinical regulatory framework applicable to our clinical studies in the UK, and to data privacy and security rules with respect to personal data sharing with vendors and clinical investigators in the UK, and we cannot predict future implications. Similarly, while on July 10, 2023 the European Commission adopted an adequacy decision concluding that the U.S. ensures an adequate level of protection for personal data transferred from the EEA to the U.S. under the EU-U.S. Data Privacy Framework (followed on October 12, 2023 with the adoption of an adequacy decision in the UK for the UK-U.S. Data Bridge), such decision does not foreclose, and is likely to face, future legal challenges and ongoing legal uncertainty. In addition, additional costs may need to be incurred in order to implement necessary safeguards to comply with the GDPR and the UK GDPR and potential new rules and restrictions on the flow of data across borders could increase the cost and complexity of conducting business in some markets. If our policies and practices or those of our key business partners, CROs or service providers are, or are perceived to be, insufficient, or if our users have concerns regarding our transfers of data, we could be subject to enforcement actions or investigations by individual EU or UK data protection authorities or lawsuits by private parties. While we have taken steps to mitigate the impact of such complexities and uncertainties on us by implementing supplementary measures in accordance with the applicable regulations, the efficacy and longevity of these mechanisms remains uncertain due to the fast-moving regulatory environment.
All of these evolving compliance and operational requirements impose significant costs, which are likely to increase over time. In addition, such requirements may require us to modify our data processing practices and policies, distract management or divert resources from other initiatives and projects. If we are unable to properly protect the privacy and security of personal information, including protected health information, we could be found to have breached our contracts. In addition, any failure or perceived failure by us to comply with any applicable federal, state or similar foreign laws and regulations relating to data privacy and security could result in damage to our reputation and our relationship with our customers, as well as proceedings or litigation by governmental agencies, customers, partners, collaborators and/or study subjects, including class action privacy litigation in certain jurisdictions, which would subject us to significant fines, sanctions, awards, penalties or judgments, all of which could have a material adverse effect on our business, results of operations, financial condition and prospects.