We maintain an array of sensitive information, including confidential business and personal information in connection with our operations, and are subject to laws and regulations governing the privacy and security of such information. The global data protection landscape is rapidly evolving, and we may be affected by or subject to new, amended or existing laws and regulations in the future, including as our operations continue to expand and we operate in foreign jurisdictions. These laws and regulations may be subject to differing interpretations, which adds to the complexity of collecting, using, disclosing and processing personal data. Guidance on implementation and compliance practices are often updated or otherwise revised.
In the United States, there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure and protection of personal information, including federal and state health information privacy laws, state laws addressing sensitive data, such as biometric information, federal and state security breach notification laws and federal and state consumer protection laws. Each of these laws is subject to varying interpretations and constantly evolving. While the United States lacks a nationwide privacy law of general applicability, certain state laws govern the privacy and security of personal information, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. For example, the California Consumer Privacy Act ("CCPA"), which took effect on January 1, 2020, gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. Further, the California Privacy Rights Act ("CPRA"), which took effect on January 1, 2023 and with enforcement beginning July 1, 2023, amended and expanded the CCPA, giving California residents additional control over their personal information and imposing further obligations on businesses processing the personal information of California residents. The CPRA includes the creation of a privacy-specific enforcement agency, the first of its kind in any U.S. state, which will be responsible for enforcing the new law. Additional states, including, but not limited to, Colorado, Virginia, Connecticut, Indiana, Iowa, Tennessee, Texas and Utah, have also adopted state-specific privacy regimes similar to California's law and to legal regimes in place outside the United States. The state-specific regimes in Virginia, Colorado, Utah and Connecticut took effect in 2023, and other states' laws take effect over the course of 2024 and 2025. In addition to state laws, the Federal Trade Commission ("FTC") takes the view that failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act (the FTCA), 15 U.S.C § 45(a). The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards.
Outside the United States, numerous countries have adopted generally applicable data privacy regimes at the national level. For example, the European Parliament and the Council of the European Union adopted a comprehensive general data privacy regulation ("GDPR") in 2016 to replace the then-current European Union Data Protection Directive and related country-specific legislation. The GDPR took effect in May 2018 and governs the collection and use of personal data in the European Union. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification and the use of third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the European Union, enhances enforcement authority and imposes large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the infringer, whichever is greater. The withdrawal of the United Kingdom from the European Union further complicated European data protection compliance obligations, as we must also comply with data privacy and security laws in effect in the UK that are substantially similar to the GDPR, but may diverge over time.
In Canada, the Personal Information Protection and Electronics Documents Act (Canada) ("PIPEDA"), the Personal Information Protection Act (Alberta), the Personal Information Protection Act (British Columbia), and the Act respecting the protection of personal information in the private sector (Quebec) govern the collection, use, and disclosure of personal information by private sector organizations. The Office of the Privacy Commissioner of Canada has stated that it considers the personal information of cannabis users is to be considered sensitive. Canadian privacy jurisprudence regarding the obligations that private sector organizations have to individual data subjects is constantly evolving. Privacy laws in Canada are also changing at the legislative level. On September 22, 2022, the Quebec government adopted Bill 64, an Act to modernize legislative provisions as regards the protection of personal information, which enacts significant changes to the requirements in Quebec relating to the collection, use, and disclosure of personal information, including, without limitation, by providing individuals with more significant rights and control over their personal information that are in many ways similar to the rights provided to data subjects under the GDPR. Many entities that are doing business in Quebec must and will need to implement significant changes to the ways in which they collect, use, and disclose the personal information of data subjects in Quebec. Certain amendments under Bill 64 came into force on September 22, 2023, and further amendments are scheduled to come into force on September 22, 2024. On June 17, 2021, the Province of Ontario commenced a public consultation on modernizing Ontario's legislative framework focusing on strengthening privacy laws in Ontario. The scope and nature of any new privacy legislation to be introduced in the Province of Ontario remains to be determined and it is possible that such legislation will introduce new restrictions and obligations on private sector organizations. On the federal level, on June 16, 2022, the Canadian Federal Government introduced Bill C-27. If adopted, Bill C-27, would replace PIPEDA with consumer privacy-specific legislation. Additionally, Bill C-27, would introduce the Artificial Intelligence Data Act. Bill C-27 is in the legislative process, currently at consideration in the House of Commons. The penalties and enforcement measures available to Canadian regulators for non-compliance that are contemplated under Bill C-11, Bill C-27, and Bill 64 are more significant than those that are available under current privacy and data protection legislation in Canada.
In addition, with respect to consumer health information, there are a number of federal, state and provincial laws protecting the confidentiality of certain patient health information, including patient records, and restricting the use and disclosure of that protected information. For example, the privacy rules under PIPEDA and other applicable privacy laws protect medical records and other personal health information by limiting their use and disclosure of health information to the minimum level reasonably necessary to accomplish the intended purpose and apply to our operations globally. In Canada, we may also be required to retain certain customer personal information for prescribed periods of time pursuant to the Cannabis Act.
In the United States, the Health Insurance Portability and Accountability Act ("HIPAA") imposes privacy and security requirements and breach reporting obligations with respect to individually identifiable health information upon "covered entities" (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, received, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity. HIPAA mandates the reporting of certain breaches of health information to the HHS, affected individuals and if the breach is large enough, the media. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured protected health information, a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. In addition, provisions of the Americans with Disabilities Act require confidential treatment of employee medical records.
If we were found to be in violation of the privacy or security rules under PIPEDA, HIPAA, or other applicable laws protecting the confidentiality of health information in jurisdictions we operate in, we could be subject to sanctions and civil or criminal penalties, which could increase our liabilities, harm our reputation and have a material adverse effect on our business, financial condition, results of operations and growth prospects.
Additional jurisdictions in which we operate or which we may enter also have data privacy and security laws and regulations that govern the collection, use, disclosure, transfer, storage, disposal, and protection of sensitive personal information. Data privacy and security are rapidly developing areas of law, as well, and imposition of new requirements is common. The interpretation and enforcement of such laws and regulations are uncertain and subject to change, and may require substantial costs to monitor and implement compliance. Failure to comply with data protection laws and regulations could result in government enforcement actions (which could include substantial civil and/or criminal penalties), litigation, business disruption, and/or adverse publicity and could negatively affect our business, financial condition, results of operations and growth prospects.