Our business is increasingly dependent on critical, complex, and interdependent information technology (IT) systems, including Internet-based systems, some of which are managed or hosted by third parties, to support business processes as well as internal and external communications. The size and complexity of our IT systems make our IT systems and data vulnerable to risks and damages from a variety of sources, including malicious human acts, breaches of security, cyber-attacks, catastrophe or natural disaster, telecommunications or network failures, loss of power or other natural or man-made events. In addition, despite network security and back-up measures, we and our vendors frequently defend against and respond to data security attacks and incidents, and our servers and our vendors' servers are potentially susceptible to physical or electronic break-ins, computer viruses, software vulnerabilities, ransomware attacks and similar disruptive problems. If our business continuity and disaster recovery plans and procedures or those of our vendors, including our CROs and contract manufacturers, were disrupted, inadequate or unsuccessful in the event of a problem, we could experience an interruption of all or a portion of our operations, which could result in significant harm to our business, financial results and reputation. In addition, having a portion of our employees work remotely can strain our IT infrastructure, which may affect our ability to operate effectively, may make us more susceptible to communications disruptions, and expose us to greater cybersecurity risks.
We are continuously evaluating and, where appropriate, enhancing our IT systems to address our planned growth, including to support our planned manufacturing operations. In particular, we are currently in the process of implementing a new enterprise resource planning system. There are inherent costs and risks associated with implementing the enhancements to our IT systems, including potential delays in access to, or errors in, critical business and financial information, substantial capital expenditures, additional administrative time and operating expenses, retention of sufficiently skilled personnel to implement and operate the enhanced systems, demands on management time, and costs of delays or difficulties in transitioning to the enhanced systems, any of which could harm our business and results of operations. In addition, the implementation of enhancements to our IT systems may not result in productivity improvements at a level that outweighs the costs of implementation, or at all.
In addition, our systems and the systems of our third-party providers and collaborators are potentially vulnerable to data security breaches which may expose sensitive data to unauthorized persons or to the public. Such data security breaches could lead to the loss of confidential information, trade secrets or other intellectual property, could lead to the public exposure of personal information of our employees, clinical trial patients, customers, business partners, and others, could lead to potential identity theft, or could lead to reputational harm. Data security breaches could also result in loss of clinical trial data or damage to the integrity of that data. Malicious cyber attacks are growing in frequency and sophistication, including the use of artificial intelligence, and can be made by groups and individuals with a wide range of motives, including nation states, organized criminal groups, "hacktivists" and others acting with malicious intent. In addition, the increased use of social media by our employees and contractors could result in inadvertent disclosure of sensitive data or personal information, including but not limited to, confidential information, trade secrets and other intellectual property.
Any such disruption or security breach, as well as any action by us or our employees or contractors that might be inconsistent with the rapidly evolving data privacy and security laws and regulations applicable within the United States and elsewhere where we conduct business, could result in enforcement actions by U.S. states, the U.S. Federal government or foreign governments, liability or sanctions under data privacy laws, including healthcare laws such as HIPAA, that protect certain types of sensitive information, regulatory penalties, other legal proceedings such as but not limited to private litigation, the incurrence of significant remediation costs, disruptions to our development programs, business operations and collaborations, diversion of management efforts and damage to our reputation, which could harm our business and operations. Because of the rapidly moving nature of technology and the increasing sophistication of cybersecurity threats, our measures to prevent, respond to and minimize such risks may be unsuccessful.
Disruptions or data security breaches within other healthcare companies could also affect our business, results of operations and financial condition. If systems used by healthcare providers, third-party payors and companies in our distribution network such as PBMs, pharmacies and wholesalers are disrupted by a data security breach, the ability to process claims and fulfill prescriptions could be impacted, which could result in adverse effects on our net product revenues.
Further, many countries and jurisdictions in which we work globally have enacted and/or are proposing privacy and data protection laws and regulations which govern the collection and use of personal information and these may impose large fines and penalties for noncompliance. For example in the European Union, under the General Data Protection Regulation, potential fines for noncompliance are up to €20 million or 4% of the annual global revenue, whichever is greater. Further, some jurisdictions provide for private rights of action if data breaches result in the loss or theft of personal data. These laws and regulations may also require, as applicable, that:
- we ensure individuals to whom personal information relates are informed about how their personal information is collected and processed;- keep personal information confidential and secure;- transfer personal information in a compliant manner;- respond to requests from individuals about their personal information; and - inform authorities and individuals as may be applicable about any data breaches.
These obligations may increase our costs of doing business and the varying requirements among all countries and jurisdictions in which we work can complicate our compliance efforts.