HIPAA imposes requirements relating to the privacy, security and transmission of individually identifiable health information. HIPAA imposes privacy and security obligations on covered entity health care providers, health plans, and health care clearinghouses, as well as their "business associates"-certain persons or entities that create, receive, maintain or transmit protected health information in connection with providing a specified service on behalf of a covered entity. We may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Although we are not directly subject to HIPAA, other than potentially with respect to providing certain employee benefits, we could potentially be subject to criminal penalties if we, our affiliates, or our agents knowingly receive individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. In addition, numerous other federal and state laws and regulations govern privacy and security, including state data breach notification laws, state health information and/or genetic privacy laws, and federal and state consumer protection laws (e.g., Section 5 of the FTC Act, and the California Consumer Privacy Act (CCPA)), many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Compliance with these laws is difficult, constantly evolving, and time consuming. Federal regulators, state attorneys general, and plaintiffs' attorneys have been and will likely continue to be active in this space.
Furthermore, states are constantly adopting new laws or amending existing laws relating to the data privacy and security and consumer protection, requiring attention to frequently changing regulatory requirements. For example, in California, the CCPA establishes certain requirements for data use and sharing transparency and creates new data privacy rights for California residents. The CCPA and its implementing regulations have already been amended multiple times since their enactment. In November 2020, California voters approved the California Privacy Rights Act (CPRA) ballot initiative which introduced significant amendments to the CCPA and established and funded a dedicated California privacy regulator, the California Privacy Protection Agency (CPPA). The amendments introduced by the CPRA go into effect on January 1, 2023, and new implementing regulations continue to be introduced by the CPPA. Failure to comply with the CCPA may result in, among other things, significant civil penalties and injunctive relief, or potential statutory or actual damages. In addition, California residents have the right to bring a private right of action in connection with certain types of incidents. These claims may result in significant liability and potential damages. We implemented processes to manage compliance with the CCPA and continue to assess the impact of the CPRA, and other state legislation, on our business as additional information and guidance becomes available.
The Federal Trade Commission (FTC) also sets expectations for failing to take appropriate steps to keep consumers' personal information secure, or failing to provide a level of security commensurate to promises made to individual about the security of their personal information (such as in a privacy notice) may constitute unfair or deceptive acts or practices in violation of Section 5(a) of the Federal Trade Commission Act (FTC Act). The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. With respect to privacy, the FTC also sets expectations that companies honor the privacy promises made to individuals about how the company handles consumers' personal information; any failure to honor promises, such as the statements made in a privacy policy or on a website, may also constitute unfair or deceptive acts or practices in violation of the FTC Act. While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power to enforce promises as it interprets them, and events that we cannot fully control, such as data breaches, may result in FTC enforcement. Enforcement by the FTC under the FTC Act can result in civil penalties or enforcement actions.
Similarly, there are a number of legislative proposals in the EU, the U.S. (at both the federal and state level), as well as in other jurisdictions that could change existing obligations, and/or impose new obligations or limitations in areas affecting our business. These laws and regulations are evolving and subject to interpretation, and may impose limitations on our activities or otherwise adversely affect our business. In addition, some countries are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our services and research activities. These laws and regulations, as well as any associated claims, inquiries, or investigations or any other government actions may lead to unfavorable outcomes including increased compliance costs, delays or impediments in the development of new products, negative publicity, increased operating costs, diversion of management time and attention, and remedies that harm our business, including fines or demands or orders that we modify or cease existing business practices.
If we, our agents, or our third party partners fail to comply or are alleged to have failed to comply with these or other applicable data protection and privacy laws and regulations, or if we were to experience a data breach involving personal information, we could be subject to government enforcement actions or private lawsuits. Any associated claims, inquiries, or investigations or other government actions could lead to unfavorable outcomes that have a material impact on our business including through significant penalties or fines, monetary judgments or settlements including criminal and civil liability for us and our officers and directors, increased compliance costs, delays or impediments in the development of new products, negative publicity, increased operating costs, diversion of management time and attention, or other remedies that harm our business, including orders that we modify or cease existing business practices.
In addition, the EU's legislative and regulatory landscape for privacy and data security continues to evolve. There has been increased attention to privacy and data security issues that could potentially affect our business, including the EU General Data Protection Regulation including as implemented in the UK (collectively, GDPR), which imposes penalties for breaches of related obligations up to 4% of annual global turnover, or €20 million EUR, whichever amount is higher.
In the event we enroll patients in our ongoing or future clinical trials in the European Economic Area (EEA), we will be subject to the additional privacy restrictions imposed by the GDPR, including restrictions relating to the collection, use, storage, transfer, and other processing of personal data, including personal health data, regarding individuals in the EEA as governed by the GDPR and the related national data protection laws of the individual EEA countries. The GDPR imposes several requirements on companies that process personal data, with especially strict rules on the transfer of personal data out of the EEA, including to the U.S, and fines and penalties for failure to comply with the requirements of the GDPR and the related national data protection laws of the individual EEA countries. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. The obligations under the GDPR may be onerous and adversely affect our business, financial condition, results of operations and prospects. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with any EEA activities. Further, the United Kingdom's exit from the EU, often referred to as Brexit, has created uncertainty with regard to future data protection regulation in the United Kingdom. The European Commission has adopted an Adequacy Decision concerning the level of data protection in the United Kingdom. Personal data may now flow freely from the EEA to the United Kingdom, however, the European Commission may suspend the Adequacy Decision if it considers that the United Kingdom no longer provides for an adequate level of data protection. Similar laws exist in many other countries around the world, and these laws (which are evolving and expanding) create complicated and potentially inconsistent obligations that may impact our business.
Because of the remote work policies we implemented due to the COVID-19 pandemic, information that is normally protected, including company confidential information, may be less secure. Cybersecurity and data security threats continue to evolve and raise the risk of incidents, including breaches, that could affect our operations or compromise our business information or sensitive personal information, including health data. With the ever-changing threat landscape, and while we have implemented security measures to protect our information technology systems and infrastructure, there can be no assurance that such measures will prevent service interruptions or security breaches that could adversely affect our business.
We may also need to collect more extensive health-related information from our employees to manage our workforce. If we or our third party partners fail to comply or are alleged to have failed to comply with applicable data protection and privacy laws and regulations, and related employment rules, or if we were to experience a data breach involving personal information, we could be subject to government enforcement actions, fines, or private lawsuits.
In addition, our business could be adversely impacted if our ability to transfer personal data outside of the EEA or Switzerland is restricted, which could adversely impact our operating results. Based on previous case law of the EU Court of Justice, we have seen that transfer mechanisms may be declared invalid (e.g., the previous EU-U.S. Privacy Shield which has now been replaced by the EU-U.S. Data Protection Framework). Such decisions may have an impact on our business and compliance costs.
On September 8, 2020, the Federal Data Protection and Information Commissioner (FDPIC) of Switzerland issued an opinion concluding that the Swiss-U.S. Privacy Shield Framework does not provide an adequate level of protection for data transfers from Switzerland to the U.S. The FDPIC also found that SCCs may still be legally adequate at an individual level provided that they can pass a risk assessment conducted by the FDPIC. If the level of protection in the U.S. or any other importing country is called into question under the SCCs, this could further impact our ability to transfer data outside of the EU or Switzerland.
The UK withdrew from the EU on January 31, 2020, commonly referred to as Brexit. Marketing authorizations granted through the EU centralized procedure continue to be valid in Northern Ireland by virtue of the Northern Ireland Protocol, but such EU marketing authorizations are not valid in the rest of the UK (England, Wales and Scotland, or collectively Great Britain). EU marketing authorizations existing as of the end of the Brexit transition period on December 31, 2020, were automatically converted into Great Britain marketing authorizations as of January 1, 2021. Until the end of 2023, a marketing authorization for Great Britain can be applied for on an expedited timetable through the UK European Commission Decision Reliance Procedure (ECDRP), after having received a positive opinion from the EMA's Committee for Medicinal Products for Human Use. Effective January 1, 2024, the ECDRP has been replaced with a new international recognition framework (IRP). ECDRP submissions received before January 1, 2024 will be processed under the existing practices. A Great Britain marketing authorization can alternatively be applied for separately through the standard national level procedure.
Although the body of the UK-EU Trade and Cooperation Agreement (Cooperation Agreement) includes general terms which apply to medicinal products, greater detail on sector-specific issues is provided in an Annex to the Agreement. The Annex provides a framework for the recognition of GMP inspections and for the exchange and acceptance of official GMP documents. The regime does not, however, extend to procedures such as batch release certification. Among the changes that will now occur are that Great Britain, comprised of England, Scotland and Wales, will be treated as a third country. Northern Ireland will, with regard to EU regulations, continue to follow the EU regulatory rules. As part of the Cooperation Agreement, the EU and the UK (each, a Party) will recognize GMP inspections carried out by the other Party and the acceptance of official GMP documents issued by the other Party. The Cooperation Agreement also encourages, although it does not oblige, the parties to consult one another on proposals to introduce significant changes to technical regulations or inspection procedures. Among the areas of absence of mutual recognition are batch testing and batch release. The EU continues to apply EU laws that require batch testing and batch release to take place in the EU territory. This means that medicinal products that are tested and released in the UK must be retested and re-released when entering the EU market for commercial use.