We and our service providers maintain and will maintain a large quantity of sensitive information, including confidential business and patient health information, in connection with our preclinical studies and clinical trials, and are subject to laws and regulations governing the privacy and security of such information. The global data protection landscape is rapidly evolving, and we and our service providers may be affected by or subject to new, amended, or existing laws and regulations in the future, including as our operations continue to expand or if we operate in foreign jurisdictions. These laws and regulations may be subject to differing interpretations, which adds to the complexity of processing personal data. Guidance on implementation and compliance practices is often updated or otherwise revised. This may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer, use, share, and otherwise process personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability, or impose additional costs on us. The cost of compliance with these laws, regulations, and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state, or foreign laws or regulation, our internal policies and procedures, or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties, and damage to our reputation, any of which could have a material adverse effect on our business, financial condition, results of operations, and prospects.
As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. In the United States, numerous federal and state laws and regulations, including health information privacy laws, data breach notification laws, and consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), govern the collection, use, storage, transfer, disclosure, protection, and other processing of health-related and other personal information could apply to our operations or the operations of our collaborators and third-party providers. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we could be subject to significant penalties if we violate HIPAA.
In addition, certain state laws govern the privacy and security of health-related and other personal information in certain circumstances, some of which may be more stringent, broader in scope, or offer greater individual rights with respect to protected health information than HIPAA, many of which may differ from each other, thus, complicating compliance efforts. These laws are evolving rapidly and may differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. By way of example, the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020, gives California residents individual privacy rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that are expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability and many similar laws have been proposed at the federal level and in other states. Further, the California Privacy Rights Act (CPRA) was recently passed in California. The CPRA imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher-risk data, and opt-outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions of the CPRA went into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. Other states are exploring their own laws, which may or may not be similar to the CCPA or the CPRA. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.
There also are a wide variety of privacy laws in other countries that may impact our operations, now or in the future. For example, in Europe, the General Data Protection Regulation (GDPR) imposes stringent requirements regarding the collection, use, disclosure, storage, transfer, or other processing of personal data of individuals within the European Economic Area (EEA), including providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenue of the noncompliant company, whichever is greater. The GDPR also confers a private right of action in some circumstances on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Among other things, the GDPR requires the establishment of a lawful basis for the processing of data, imposes requirements relating to the consent of the individuals to whom the personal data relates, including detailed notices for clinical trial subjects and investigators, as well as requirements regarding the security of personal data and notification of data processing obligations to the competent national data processing authorities. In addition, the GDPR increases the scrutiny of transfers of personal data from the EEA to the United States and other jurisdictions that the European Commission does not recognize as having "adequate" data protection laws. Recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States. For example, on July 16, 2020, the Court of Justice of the European Union (CJEU) invalidated the EU-US Privacy Shield Framework (Privacy Shield) under which personal data could be transferred from the EEA to United States entities that had self-certified under the Privacy Shield scheme. While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on the standard contractual clauses alone may not necessarily be sufficient in all circumstances. Use of the standard contractual clauses must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain. The European Commission issued revised standard contractual clauses on June 4, 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board. The revised standard contractual clauses must be used for relevant new data transfers beginning on September 27, 2021 and existing standard contractual clauses arrangements were required to be migrated to the revised clauses by December 27, 2022. The new standard contractual clauses apply only to the transfer of personal data outside of the EEA and not the United Kingdom; the United Kingdom's Information Commissioner's Office launched a public consultation on its draft revised data transfers mechanisms in August 2021 and the United Kingdom standard contractual clauses came into force in March 2022, with a two-year grace period. There is some uncertainty around whether the revised clauses can be used for all types of data transfers, particularly whether they can be relied on for data transfers to non-EEA entities subject to the GDPR. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints, and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location, or segregation of our relevant systems and operations, and could adversely affect our financial results.
Further, following the withdrawal of the United Kingdom from the European Union and the EEA and the end of the transition period, from January 1, 2021, we have to comply with the GDPR and separately the GDPR as implemented in the United Kingdom, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR and has the ability to fine up to the greater of €20 million/£17 million or 4% of global turnover. The relationship between the United Kingdom and the European Union and the EEA in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term. The European Commission has adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from European Union member states to the United Kingdom without additional safeguards. However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews or extends that decision, which could have implications for our transfer of personal data.
In many jurisdictions, enforcement actions and consequences for noncompliance are rising. In the United States, these include enforcement actions in response to rules and regulations promulgated under the authority of federal agencies and state attorneys general and legislatures and consumer protection agencies. In addition, privacy advocates and industry groups have regularly proposed, and may propose in the future, self-regulatory standards that may legally or contractually apply to us. If we fail to follow these security standards, even if no personal information is compromised, we may incur significant fines or experience a significant increase in costs. Many state legislatures have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security, and data breaches. Laws in all U.S. states require businesses to provide notice to customers whose personally identifiable information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly.
Compliance with U.S. and international data protection laws and regulations could require us to take on more onerous obligations in our contracts, restrict our ability to collect, store, use, transfer, disclose, and otherwise process data, update our data privacy and security policies and procedures, or in some cases, impact our ability to operate in certain jurisdictions. Failure by us or our collaborators and our service providers to comply with U.S. and international data protection laws and regulations could result in government enforcement actions (which could include civil or criminal penalties), private litigation, and/or adverse publicity and could negatively affect our operating results and business. Moreover, clinical trial subjects about whom we or our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose such information. Claims that we have violated individuals' privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend, could result in adverse publicity and adversely affect our business, financial condition, results of operations, and prospects. Should any of these events occur, they could have a material adverse effect on our business, financial condition, results of operations, and prospects.