We are subject to US data protection laws and regulations (i.e., laws and regulations that address privacy and data security) at both the federal and state levels. The legislative and regulatory landscape for data protection continues to evolve, and in recent years there has been an increasing focus on privacy and data security issues. Numerous federal and state laws, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws, govern the collection, use, and disclosure of health-related and other personal information. In addition, we may obtain health information from third parties (e.g., healthcare providers who prescribe our products) that are subject to privacy and security requirements under Health Insurance Portability and Accountability Act of 1996, or HIPAA. Although we are not directly subject to HIPAA-other than potentially with respect to providing certain employee benefits-we could be subject to criminal penalties if we knowingly obtain or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. Finally, a data breach affecting sensitive personal information, including health information, could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business. EU Member States, Switzerland and other countries have also adopted data protection laws and regulations, which impose significant compliance obligations. For example, the collection and use of personal health data in the EU is governed by the provisions of the EU Data Protection Directive, or the Directive. The Directive and the national implementing legislation of the EU Member States impose strict obligations and restrictions on the ability to collect, analyze and transfer personal data, including health data from clinical trials and adverse event reporting. In particular, these obligations and restrictions concern the consent of the individuals to whom the personal data relates, the information provided to the individuals, notification of data processing obligations to the competent national data protection authorities and the security and confidentiality of the personal data. Data protection authorities from the different E.U. Member States may interpret the Directive and national laws differently and impose additional requirements, which add to the complexity of processing personal data in the EU. Guidance on implementation and compliance practices are often updated or otherwise revised. For example, the EU Data Protection Directive prohibits the transfer of personal data to countries outside of the European Economic Area, or EEA, that are not considered by the European Commission to provide an adequate level of data protection. These countries include the United States. The judgment by the Court of Justice of the EU in the Schrems case (Case C-362/14 Maximillian Schrems v. Data Protection Commissioner) determined the US-EU Safe Harbor Framework, which was relied upon by many US entities as a basis for transfer of personal data from the EU to the US, to be invalid. US entities, therefore, had only the possibility to rely on the alternate procedures for such data transfer provided in the EU Data Protection Directive. On February 29, 2016, however, the European Commission announced an agreement with the US Department of Commerce, or DOC, to replace the invalidated Safe Harbor framework with a new EU-US “Privacy Shield”. On July 12, 2016, the European Commission adopted a decision on the adequacy of the protection provided by the Privacy Shield. The Privacy Shield is intended to address the requirements set out by the Court of Justice of the EU in its Schrems judgment by imposing more stringent obligations on companies, providing stronger monitoring and enforcement by the DOC and the Federal Trade Commission, and making commitments on the part of public authorities regarding access to information. US companies have been able to certify to the DOC their compliance with the privacy principles of the Privacy Shield since August 1, 2016, and rely on the Privacy Shield certification to transfer of personal data from the EU to the US. On September 16, 2016, the Irish privacy advocacy group Digital Rights Ireland brought an action for annulment of the European Commission decision on the adequacy of the Privacy Shield before the Court of Justice of the E.U. (Case T-670/16). Case T-670/16 is still pending. If the Court of Justice of the EU invalidates the Privacy Shield, it will no longer be possible to rely on the Privacy Shield certification to transfer personal data from the EU to entities in the US. Adherence to the Privacy Shield is not, however, mandatory. US-based companies are permitted to rely either on their adherence to the EU-US Privacy Shield or on the other authorized means and procedures to transfer personal data provided by the EU Data Protection Directive. In addition, the EU Data Protection Regulation, intended to replace the EU Data Protection Directive entered into force on May 24, 2016 and applied from May 25, 2018. The EU Data Protection Regulation introduced new data protection requirements in the E.U. and substantial fines for breaches of the data protection rules. The EU Data Protection Regulation increased our responsibility and liability in relation to personal data that we process, and we may be required to put in place additional mechanisms to ensure compliance with those data protection rules. Our failure to comply with these laws, or changes in the way in which these laws are implemented, could lead to government enforcement actions and significant penalties against us, and adversely impact our business.