In many activities, including the conduct of clinical trials, we are subject to laws and regulations governing data privacy and the protection of health-related and other personal information. The regulatory framework for collecting, using, safeguarding, sharing, transfering and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. The withdrawal of the United Kingdom from the European Union and the subsequent separation of the data protection regimes of these territories means we are required to comply with separate data protection laws in the European Union and the United Kingdom, which may lead to additional compliance costs and could increase our overall risk. Similar laws and regulations govern our processing of personal data, including the collection, access, use, analysis, modification, storage, transfer, security breach notification, destruction and disposal of personal data. For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the European Union, including personal health data, is subject to the General Data Protection Regulation, or GDPR, which took effect across all Member States of the European Economic Area, or EEA, on May 25, 2018, and as still in effect in the United Kingdom as the UK GDPR. On June 28, 2021, the EU Commission adopted decisions on the UK's adequacy under the EU GDRP, and the UK continues to operate under this adequacy decision. The GDPR imposed a broad data protection framework that expanded the scope of EU and UK data protection law, including to non-EU and non-UK entities meeting the jurisdictional requirements that process, or control the processing of, personal data relating to individuals located in the EU or UK, including clinical trial data. The GDPR sets out a number of requirements for controllers and/or processors, as applicable, that must be complied with when handling the personal data of EU or UK based data subjects, including: providing expanded disclosures about how their personal data will be used; higher standards for organizations to demonstrate that they have obtained valid consent or have another legal basis in place to justify their data processing activities; the obligation to appoint data protection officers in certain circumstances; new rights for individuals to be "forgotten" and rights to data portability, as well as enhanced current rights (e.g., access requests); the principal of accountability and demonstrating compliance through policies, procedures, training and audit; and a new mandatory data breach regime. In particular, medical or health data, genetic data and biometric data are all classified as "special category" data under the GDPR and afford greater protection and require additional compliance obligations. Further, the UK and EU member states have a broad right to impose additional conditions-including restrictions-on these data categories. This is because the GDPR allows EU member states to derogate from the requirements of the GDPR mainly in regard to specific processing situations (including special category data and processing for scientific or statistical purposes). We must comply with laws and regulations associated with the international transfer of personal data based on the location in which the personal data originates and the location in which it is processed and/or controlled. Although there are legal mechanisms to facilitate the transfer of personal data from the UK, EEA, and Switzerland to the United States, the decision of the Court of Justice of the EU (CJEU) that invalidated the safe harbor framework has increased uncertainty around compliance with EU privacy law requirements. As a result of the decision, it was no longer possible to rely on safe harbor certification as a legal basis for the transfer of personal data from the European Union to entities in the United States. However, on July 10, 2023, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the EU to the United States – the EU-U.S. Data Privacy Framework, which provides EU individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data. That being said, we have not yet self-certified under the Data Privacy Framework. The GDPR only permits exports of personal data outside of the EU to "non-adequate" countries where there is a suitable data transfer mechanism in place to safeguard personal data (e.g., the EU Commission approved Standard Contractual Clauses or certification under the newly-adopted Data Privacy Framework). On July 16, 2020, the Court of Justice of the EU, or the CJEU, issued a landmark opinion in the case Maximilian Schrems vs. Facebook (Case C-311/18) (Schrems II). This decision calls into question certain data transfer mechanisms as between the EU member states and the U.S. The CJEU is the highest court in Europe and the Schrems II decision heightened the burden to assess U.S. national security laws on their business, and future actions of EU data protection authorities are difficult to predict at this time. While the newly-adopted Data Privacy Framework was meant to address the concerns raised by the CJEU in Schrems II, it will likely be subject to future legal challenges. Consequently, there is some risk of any data transfers from the EU being halted. If we have to rely on third parties to carry out services for us, including processing personal data on our behalf, we are required under GDPR to enter into contractual arrangements to flow down or help ensure that these third parties only process such data according to our instructions and have sufficient security measures in place. Any security breach or non-compliance with our contractual terms or breach of applicable law by such third parties could result in enforcement actions, litigation, fines and penalties or adverse publicity and could cause customers to lose trust in us, which would have an adverse impact on our reputation and business. Any contractual arrangements requiring the processing of personal data from the EU to us in the U.S. will require greater scrutiny and assessments as required under Schrems II and may have an adverse impact on cross-border transfers of personal data or increase costs of compliance. The GDPR provides an enforcement authority to impose large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Some customers or other service providers may respond to these evolving laws and regulations by asking us to make certain privacy or data-related contractual commitments that we are unable or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships.
The privacy and security of personally identifiable information stored, maintained, received or transmitted, including electronically, is subject to significant regulation in the United States and abroad. While we strive to comply with all applicable privacy and security laws and regulations, legal standards for privacy continue to evolve and any failure or perceived failure to comply may result in proceedings or actions against us by government entities or others, or could cause reputational harm, which could have a material adverse effect on our business.
Numerous foreign, federal and state laws and regulations govern collection, dissemination, use and confidentiality of personally identifiable health information, including state privacy and confidentiality laws (including state laws requiring disclosure of breaches); federal and state consumer protection and employment laws; HIPAA; and European and other international data protection laws. These laws and regulations are increasing in complexity and number, may change frequently and sometimes conflict.
HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH), establishes a set of U.S. national privacy and security standards for the protection of individually identifiable health information, including protected health information, or PHI, by health plans, certain healthcare clearinghouses and healthcare providers that submit certain covered transactions electronically, or covered entities, and their "business associates," which are persons or entities that perform certain services for, or on behalf of, a covered entity that involve creating, receiving, maintaining or transmitting PHI. While we are not currently a covered entity or business associate under HIPAA, we may receive identifiable information from these entities. Failure to receive this information properly could subject us to HIPAA's criminal penalties, which may include fines up to $50,000 per violation and/or imprisonment. In addition, responding to government investigations regarding alleged violations of these and other laws and regulations, even if ultimately concluded with no findings of violations or no penalties imposed, can consume company resources and impact our business and, if public, harm our reputation.
In the United States, various federal and state regulators, including governmental agencies like the Federal Trade Commission, have promulgated, or are considering promulgating, regulations concerning personal information and data securityIn addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. California's patient privacy laws, for example, provide for penalties of up to $250,000 and permit injured parties to sue for damages. In addition, The California Consumer Privacy Act ("CCPA") went into effect January 1, 2020, and is one of the most restrictive state privacy laws, protecting a wide variety of personal information and granting significant rights to California residents with respect to their personal information. Regulations under CCPA have been modified several times, and continue to be modified. Additionally, a new privacy law, the California Privacy Rights Act, ("CPRA") was approved by California voters in the election of November 3, 2020 and went into effect in January of 2023. The CPRA modified the CCPA significantly, and may result in further uncertainty, additional costs and expenses stemming from efforts to comply with this law, and increases the potential for harm and liability for failure to comply. Among other things, the CPRA established a new regulatory authority, the California Privacy Protection Agency, which is enacting new regulations and has expanded enforcement authority. Other states have implemented similar laws protecting identifiable health and personal information, and most such laws differ from each other in significant ways and may not be preempted by HIPAA, thus complicating compliance efforts. In addition, various states, such as California, Colorado, Connecticut, New Jersey, Delaware, Utah, Virginia, Oregon, Indiana, Iowa, Tennessee, Montana, Florida and Texas , have implemented similar privacy laws and regulations.
The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our clients and potentially exposing us to additional expense, adverse publicity and liability. Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify.
The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues which may affect our business. Failure to comply with current and future laws and regulations could result in government enforcement actions (including the imposition of significant penalties), criminal and civil liability for us and our officers and directors, private litigation and/or adverse publicity that negatively affects our business.