The global data protection landscape is rapidly evolving, and we may be or become subject to or affected by numerous federal, state and foreign laws and regulations, as well as regulatory guidance, governing the collection, use, disclosure, transfer, security and processing of personal data, such as information that we collect about participants and healthcare providers in connection with clinical trials. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, which may create uncertainty in our business, affect our or our service providers' ability to operate in certain jurisdictions or to collect, store, transfer use and share personal data, result in liability or impose additional compliance or other costs on us. Any failure or perceived failure by us to comply with federal, state, or foreign laws or self-regulatory standards could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others. California passed the California Data Privacy Protection Act of 2018, or the CCPA, which went into effect in January 2020, and was recently amended by the California Privacy Rights Act, which became effective on January 1, 2023, provides new data privacy rights for consumers and new operational requirements for companies, which may increase our compliance costs and potential liability. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. While there is currently an exception for protected health information that is subject to HIPAA and clinical trial regulations, as currently written, the CCPA may impact certain of our business activities. The CCPA may lead to similar laws in other U.S. states or at a national level, which could increase our potential liability and adversely affect our business.
Additionally, a California ballot initiative, the California Privacy Rights Act, or the CPRA, was passed in November 2020 and became effective January 1, 2023. The CPRA imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding consumers' rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.
Certain other state laws impose similar privacy obligations and we also expect that more states may enact legislation similar to the CCPA, which provides consumers with new privacy rights and increases the privacy and security obligations of entities handling certain personal information of such consumers. The CCPA has prompted a number of proposals for new federal and state-level privacy legislation. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.
In addition, on March 2, 2021, Virginia enacted the Consumer Data Protection Act, or the CDPA, which became effective on January 1, 2023. The CDPA regulates how businesses (which the CDPA refers to as "controllers") collect and share personal information. While the CDPA incorporates many similar concepts of the CCPA and CPRA, there are also several key differences in the scope, application, and enforcement of the law that will change the operational practices of controllers. The law impacts how controllers collect and process personal sensitive data, conduct data protection assessments, transfer personal data to affiliates, and respond to consumer rights requests.
Also, on July 8, 2021, Colorado's governor signed the Colorado Privacy Act, or the CPA, into law. The CPA will become effective on July 1, 2023. The CPA is rather similar to Virginia's CPDA but also contains additional requirements. The new measure applies to companies conducting business in Colorado or who produce or deliver commercial products or services intentionally targeted to its residents of the state that either: (1) control or process the personal data of at least 100,000 consumers during a calendar year; or (2) derive revenue or receive a discount on the price of goods or services from the sale of personal data and process or control the personal data of at least 25,000 consumers.
With the CPA, Colorado became the third state to enact a comprehensive privacy law but it is quite possible that other states will follow suit. The existence of comprehensive privacy laws in different states in the country will make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.
In addition to our operations in the United States, which may be subject to healthcare and other laws relating to the privacy and security of health information and other personal information, we have operations in Europe and are subject to European data privacy laws, regulations and guidelines. The collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the EEA, including personal health data, is subject to the EU GDPR and similar processing of personal data regarding individuals in the U.K. is subject to the U.K. GDPR and the U.K. Data Protection Act 2018.The GDPR is wide-ranging and imposes a broad range of strict requirements on companies subject to the GDPR, including requirements relating to having legal bases for processing personal information relating to identifiable individuals and transferring such information outside the EEA, including to the United States, providing details to those individuals regarding the processing of their personal health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, keeping personal information secure, having data processing agreements with third parties who process personal information, responding to individuals' requests to exercise their rights in respect of their personal information, reporting security breaches involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers, conducting data protection impact assessments, and record-keeping. The GDPR increases substantially the penalties to which we could be subject in the event of any non-compliance, including fines of up to €20 million (£17.5 million) or up to 4% of our total worldwide annual turnover, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In addition, the GDPR includes restrictions on cross-border data transfers.
Further, national laws of member states of the EU are in the process of being adapted to the requirements under the GDPR, thereby implementing national laws which may partially deviate from the GDPR and impose different obligations from country to country, so that we do not expect to operate in a uniform legal landscape in the EEA. Also, as it relates to processing and transfer of genetic data, the GDPR specifically allows national laws to impose additional and more specific requirements or restrictions, and European laws have historically differed quite substantially in this field, leading to additional uncertainty. In addition, further to the U.K.'s exit from the EU on January 31, 2020, the GDPR ceased to apply in the U.K. at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the U.K.'s European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020 but subject to certain U.K. specific amendments) into U.K. law, referred to as the U.K. GDPR. The U.K. GDPR and the U.K. Data Protection Act 2018 set out the U.K.'s data protection regime, which is independent from but aligned to the EU's data protection regime. The U.K. Government has announced plans to reform its data protection legal framework in the Data Reform Bill, but those have been put on hold. Non-compliance with the U.K.
GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher. Although the U.K. is regarded as a third country under the EU's GDPR, the EC has now issued a decision recognizing the U.K. as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EU to the U.K. remain unrestricted. Like the EU GDPR, the U.K. GDPR restricts personal data transfers outside the U.K. to countries not regarded by the U.K. as providing adequate protection. To enable the transfer of personal data outside of the EEA or the U.K., adequate safeguards must be implemented in compliance with European and U.K. data protection laws. On June 4, 2021, the EC issued new forms of standard contractual clauses for data transfers from controllers or processors in the EEA (or otherwise subject to the EU GDPR) to controllers or processors established outside the EEA (and not subject to the EU GDPR). The new standard contractual clauses replace the standard contractual clauses that were adopted previously under the EU Data Protection Directive. The U.K. is not subject to the EC's new standard contractual clauses but has published its own version of standard clauses, referred to as "International Data Transfer Agreement" which entered into force on March 21, 2022 and enables transfers originating from the U.K. Transfers made pursuant to these new mechanisms need to be assessed on a case-by-case basis to ensure the law in the recipient country provides "essentially equivalent" protections to safeguard the transferred personal data as the EEA, and businesses are required to adopt supplementary measures if such standard is not met. We will be required to implement these new safeguards when conducting restricted data transfers under the EU and U.K. GDPR and doing so will require significant effort and cost.
In addition to the GDPR, the European Union is also in the process of replacing the e-Privacy Directive (2002/58/EC) with a new set of rules taking the form of a regulation, which will be directly implemented in the laws of each European member state, without the need for further enactment. Originally planned to be adopted and implemented at the same time as the GDPR, the ePrivacy Regulation is still going through the European legislative process. Draft regulations were rejected by the Permanent Representatives Committee of the Council of EU on November 22, 2019; it is not clear when new regulations will be adopted. Preparing for and complying with the GDPR and the ePrivacy Regulation (if and when it becomes effective) has required and will continue to require us to incur substantial operational costs and may require us to change our business practices. Despite our efforts to bring practices into compliance with the GDPR and before the effective date of the ePrivacy Regulation, we may not be successful either due to internal or external factors such as resource allocation limitations. Non-compliance could result in proceedings against us by governmental entities, customers, data subjects, consumer associations or others.
We are conducting clinical trials in the EEA, and the GDPR increases our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we are required to have in place additional mechanisms and safeguards to ensure compliance with the GDPR, including as implemented by individual countries. Compliance with the GDPR is a rigorous and time-intensive process that increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. We expect that we will continue to face uncertainty as to whether our efforts to comply with any obligations under European privacy laws will be sufficient. If we are investigated by a European data protection authority, we may face fines and other penalties. Any such investigation or charges by European data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new clients or biotechnology and biopharmaceutical partners. We may also experience hesitancy, reluctance, or refusal by European or multi-national vendors or biotechnology and biopharmaceutical partners to continue to use our products due to the potential risk exposure as a result of the current (and, in particular, future) data protection obligations imposed on them by certain data protection authorities in interpretation of current law, including the GDPR. Such vendors or biotechnology and biopharmaceutical partners may also view any alternative approaches to compliance as being too costly, too burdensome, too legally uncertain, or otherwise objectionable and therefore decide not to do business with us. Any of the forgoing could materially harm our business, prospects, financial condition and results of operations.