There are numerous state, federal, and foreign laws, regulations, decisions, and directives regarding data privacy and security and the collection, storage, transmission, use, disclosure, and other processing of different types of information about individuals and other data (including customer data), the scope of which is continually evolving and subject to differing interpretations. We may be subject to significant consequences, including penalties and fines, for any failure to comply with such laws, regulations, and directives.
For example, the GDPR, which is in effect across the EEA, imposes several stringent requirements for controllers and processors of data relating to an identifiable living individual or "personal data" including, for example, imposing strict standards when obtaining consent from individuals to process their personal data, requiring robust disclosures to individuals, providing individual data rights, imposing short timelines for data breach notifications, limiting retention periods and secondary use of information, imposing certain requirements pertaining to health data as well as pseudonymized (i.e., key-coded) data, regulating cross-border transfers of personal data out of the EEA, as well as additional obligations when we contract third-party processors in connection with the processing of personal data. The GDPR also includes a principle of accountability and the obligation to demonstrate compliance with the foregoing obligations through policies, procedures, training, and audits. The GDPR provides that EEA member states may make their own further laws and regulations limiting the processing of genetic, biometric, or health data, which could limit our ability to use and share personal data or could cause our costs to increase and harm our business and financial condition. Failure to comply with the requirements of the GDPR and the applicable national data protection laws of the EEA member states may result in significant fines, regulatory investigations, reputational damage, orders to cease/change our data processing activities, enforcement notices, assessment notices (for a compulsory audit), and/or civil claims (including class actions). Compliance with data protection obligations imposed by GDPR and EEA member state laws may be onerous and adversely affect our business, financial condition, or results of operations.
Further, since 2021, we have been subject to the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the obligations, monetary fines, and enforcement regime under the GDPR; however, the relationship between the UK and the EU in relation to certain aspects of data protection law remains unclear, and it is unclear how UK data protection laws and regulations will develop in the medium to longer term and how data transfers to and from the UK will be regulated in the long term. These changes may lead to additional costs and increase our overall risk exposure. We are also subject to evolving EEA and UK privacy laws on cookies, tracking technologies, and e-marketing, which continue to evolve and which regulators actively enforce.
In the United States, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, and regulations implemented thereunder, imposes privacy, security, and breach notification obligations on certain healthcare providers, health plans, and healthcare clearinghouses, known as covered entities, as well as their business associates that perform certain services that involve creating, receiving, maintaining, or transmitting individually identifiable health information for or on behalf of such covered entities and their covered subcontractors. Entities that are found to be in violation of HIPAA, as the result of a breach of unsecured personal information, a complaint about privacy practices, or an audit by the U.S. Department of Health and Human Services ("HHS"), may be subject to significant civil, criminal, and administrative fines and penalties and/or additional reporting and oversight obligations if they are required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance.
Even when HIPAA does not apply, according to the Federal Trade Commission (the "FTC"), violating consumers' privacy rights or failing to take appropriate steps to keep consumers' personal information secure may constitute unfair and/or deceptive acts or practices in violation of Section 5(a) of the FTC Act. The FTC has authority to initiate enforcement actions against entities that make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information, or engage in other unfair practices that harm customers or that may violate Section 5(a) of the FTC Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Additionally, federal and state consumer protection laws are increasingly being applied by the FTC and states' attorneys general to regulate the collection, use, storage, and disclosure of personal or personally identifiable information, through websites or otherwise, and to regulate the presentation of website content.
Further, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA") gives California residents expanded rights to access, correct, and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA imposes compliance burdens on many organizations doing business in California that collect personal information about California residents. The CCPA's definition of personal information is very broad and specifically includes biometric information (though information subject to HIPAA is expressly exempted). The CCPA allows for significant fines by the state attorney general, as well as a private right of action from individuals in relation to certain security breaches. The enactment of the CCPA has prompted a wave of similar legislative developments in other U.S. states, such as Virginia, Colorado, Connecticut, and Utah, and at the federal level, reflecting a trend toward more stringent privacy legislation in the U.S. These developments are increasing our compliance burden and our risk, including risks of regulatory fines, litigation, and associated reputational harm.
In addition, recent legal developments in Europe have created complexity and compliance uncertainty regarding certain transfers of personal data from the EEA or UK to third countries, including the United States. Case law from the Court of Justice of the European Union (the "CJEU") states that the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism and potential alternative to the Privacy Shield) alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On October 7, 2022, President Biden signed an Executive Order on ‘Enhancing Safeguards for United States Intelligence Activities,' which introduced new redress mechanisms and binding safeguards to address the concerns raised by the CJEU in relation to data transfers from the EEA to the United States and which formed the basis of the new EU-US Data Privacy Framework ("DPF"), as released on December 13, 2022. The European Commission adopted its Adequacy Decision in relation to the DPF on July 10, 2023, rendering the DPF effective as an EU GDPR transfer mechanism to U.S. entities self-certified under the DPF. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a UK GDPR data transfer mechanism to U.S. entities self-certified under the UK Extension to the DPF. However, we expect the existing legal complexity and uncertainty regarding international persona data transfers to continue. In particular, we expect the DPF Adequacy Decision to be challenged.
We rely on a mixture of mechanisms to transfer personal data from our EU business to the U.S. and are evaluating whether additional mechanisms will be required to establish adequate safeguards for personal data. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used and/or start taking enforcement action, we could suffer additional costs, complaints, and/or regulatory investigations or fines. As the regulatory guidance and enforcement landscape in relation to data transfers continues to develop, we could suffer additional costs, complaints, and/or regulatory investigations or fines, and we may have to stop using certain tools and vendors. Moreover, if we are unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services. These operational changes could adversely affect our business, financial condition, or results of operations.
In China, we are also subject to various aspects of the country's data compliance regime, which can include the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law ("PIPL"). In addition, the relevant government authorities of China promulgated several regulations or released a number of draft regulations for public comment that are designed to provide further implemental guidance in accordance with these laws. We cannot predict what impact the new laws and regulations or the increased costs of compliance, if any, will have on our operations in China, in particular the Data Security Law or PIPL, due to their recent enactment and the limited guidance available. It is also generally unclear how the laws will be interpreted and enforced in practice by the relevant government authorities, as these laws are drafted broadly and, thus, leave great discretion to the relevant government authorities to exercise.
In Israel, The Protection of Privacy Law, 5741-1981 (the "Israeli Privacy Law") regulates the protection of privacy and personal data, along with several other specific regulations enacted thereunder and, in particular, the Privacy Protection Regulations (Data Security), 5777-2017 (together with Israeli Protection of Privacy Law, the "Israeli Privacy Law and Regulations"). Under the Israeli Privacy Law and Regulations, organizations are subject to various privacy and data protection requirements, including mandatory registration of databases with the Israeli Registrar of Databases (if certain conditions are met), executing data processing agreements with data recipients, safeguarding the collection and processing of personal data, safeguarding the transfer of personal data (which is specifically subject to the requirements of the Privacy Protection Regulations), personal data breach notification obligations, and other requirements. The Privacy Protection Authority (the "PPA") is responsible for enforcement of the Israeli Privacy Law and Regulations and periodically publishes opinions and guidelines on privacy matters. In terms of enforcement, failure to comply with the Israeli Privacy Law and Regulations can result in PPA investigations, administrative fines or sanctions, and civil or criminal actions (civil proceedings may include statutory damages without the need to prove actual damages).
Furthermore, any failure, or perceived failure, by us to comply with or make effective modifications to our policies or to comply with any federal, state, or international privacy, data-retention, or data-protection-related laws, regulations, orders, or industry self-regulatory principles could result in proceedings or actions against us by governmental entities or others, a loss of customer confidence, damage to our brand and reputation, and a loss of customers, any of which could have an adverse effect on our business. In addition, various federal, state, and foreign legislative or regulatory bodies may enact new or additional laws and regulations concerning privacy, data-retention, and data-protection issues, including laws or regulations mandating disclosure to domestic or international law enforcement bodies, which could adversely impact our business or our reputation with customers. For example, some countries have adopted laws mandating that some personal information regarding customers in their country be maintained solely in their country. Having to maintain local data centers and redesign product, service, and business operations to limit personal information processing to within individual countries could increase our operating costs significantly.