In the ordinary course of our business, we collect and store sensitive data, including legally protected patient health information, credit card information and personally identifiable information. We collect this kind of information on our customers for purposes of servicing potential warranty claims and for post-marketing safety vigilance. Data protection and privacy-related laws and regulations are evolving and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.
There are a number of state, federal and international laws protecting the privacy and security of health information and personal data. For example, HIPAA imposes limitations on the use and disclosure of an individual's protected health information by certain health care providers, health care clearinghouses, and health insurance plans, collectively referred to as covered entities, and their business associates, persons or entities that perform a function or provide specified services on behalf of a Covered Entity that involve the creation, use, maintenance or transmission of protected health information. HIPAA also imposes breach notification obligations for breaches of protected health information, including notification requirements to federal regulators and in some cases, notification to relevant media outlets. Most states also have breach notification requirements to affected individuals and in some cases to state regulators in the event of a breach of personal information, which is a broader class of information than the protected health information protected by HIPAA.
In addition, even when HIPAA does not apply, according to the FTC, failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the FTCA, 15 U.S.C § 45(a). The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Health information is considered sensitive data that merits stronger safeguards.
At the state level, several U.S. states have proposed and passed consumer privacy laws. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, ("CCPA") includes certain transparency and other requirements to protect personal data and grants California consumers with certain rights regarding their personal data. In addition, California consumers have the right to bring a private right of action in connection with data security incidents involving certain elements of personal data. Additionally, other jurisdictions, such as Virginia, Colorado, Utah, and Connecticut, have enacted similar legislation and/or regulations. Health-specific consumer privacy laws were also passed in multiple states, including Washington and Nevada. These laws and regulations are constantly evolving and may impose limitations on our business activities.
Moreover, as a result of the broad scale release and availability of Artificial Intelligence (AI) technologies such as generative AI, there is a global trend towards more regulation (e.g., the EU AI Act and AI laws passed in U.S. states) to ensure the ethical use, privacy, and security of AI and the data that it processes. Compliance with such laws will likely be an increasing and substantial cost in the future.
Many foreign countries and governmental bodies, including the EU, UK, Canada, Australia and other relevant jurisdictions, have laws and regulations concerning the collection and use of personal or sensitive data obtained from their residents or by businesses operating within their jurisdiction. For example, the EU/UK GDPR imposes stringent data protection requirements. It regulates the processing of personal data and places certain obligations on the processing of such personal data including ensuring the lawfulness of processing personal data (including obtaining valid consent of the individuals to whom the personal data relates, where applicable), the processing details disclosed to the individuals, the adequacy, relevance and necessity of the personal data collected, the retention of personal data collected, the sharing of personal data with third parties, the transfer of personal data out of the European Economic Area/UK to third countries including the US, contracting requirements (such as with clinical trial sites and vendors), the use of personal data in accordance with individual rights, the security of personal data and security breach/incident notifications. Non-compliance with the EU/UK GDPR can trigger steep fines for the most serious breaches of up to €20 million or 4% of total worldwide annual revenues, whichever is higher. Given the breadth and depth of changes in data protection obligations, meeting the EU/UK GDPR's requirements requires time, resources and a review of the technology and systems currently in use against the EU/UK GDPR's requirements.
We may be at risk of enforcement actions taken by certain EU data protection authorities, the UK Information Commissioner's Office, or ICO, or the Swiss Federal Data Protection and Information Commissioner, or FDPIC, while we continue to build our business practices to ensure that all transfers of personal data to us from the European Economic Area, United Kingdom and Switzerland, are conducted in compliance with all applicable regulatory obligations, the guidance of data protection authorities and evolving best practices. We may find it necessary to establish systems to maintain personal data originating from the EU in the European Economic Area, which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business.
Our failure to comply with applicable laws and regulations, or to protect such data, could result in enforcement actions against us, including fines, imprisonment of company officials and public censure, claims for damages by end-customers and other affected individuals, damage to our reputation and loss of goodwill, any of which could harm on our operations, financial performance, and business. Evolving and changing definitions of personal data and personal information, within the European Union, the United States, and elsewhere, may limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data. Moreover, if the relevant laws and regulations change, or are interpreted and applied in a manner that is inconsistent with our data practices or the operation of our products, we may need to expend resources in order to change our business operations, data practices, or the manner in which our products operate. Even the perception of privacy concerns, whether or not valid, may harm our reputation and inhibit adoption of our products.
There is the risk that the limits we obtained for our cyber liability insurance may not cover the total loss experienced in the event of a data security incident, including the financial loss, legal costs, and business and reputational harm, particularly if there is an interruption to our systems. Additionally, there is the risk of a data privacy or security incident by an employee, which may expose us to liability. If personal information of our customers or employees is misappropriated, our reputation with our customers and employees may be injured resulting in loss of business and/or morale, and we may incur costs to remediate possible injury to our customers and employees or be required to pay fines or take other action with respect to judicial or regulatory actions arising out of such incidents.