The collection and use of personal data, including health-related data, in the European Economic Area (EEA) (being the European Union plus Norway, Iceland and Liechtenstein) is governed by the European Union's General Data Protection Regulation 2016/679 (GDPR), which became effective May 25, 2018, and related applicable data protection and privacy laws of the member states of the EEA and the United Kingdom. The GDPR applies to the processing of personal data by any company established in the EEA and to companies established outside the EEA to the extent they process personal data in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. The GDPR is wide-ranging in scope and imposes numerous additional requirements on companies that process personal data of EEA data subjects, including imposing special requirements in respect of the processing of health and other sensitive data. The GDPR enhances data protection obligations for data controllers of personal data, including stringent requirements relating to the consent of data subjects, expanded disclosures about how personal data is used, requirements to conduct data protection impact assessments for "high risk" processing, limitations on retention of personal data, mandatory data breach notification and "privacy by design" requirements, and creates direct obligations on service providers acting as processors. It also establishes rights for individuals with respect to their personal data, including rights of access and deletion in certain circumstances.
The GDPR also imposes strict rules on the transfer of personal data outside of the EEA to countries that do not ensure an adequate level of protection, like the United States (so-called "third countries"). These transfers are prohibited unless an appropriate safeguard specified by the GDPR is implemented, such as the Standard Contractual Clauses (SCCs) approved by the European Commission, or a derogation applies. The Court of Justice of the European Union (CJEU) confirmed in its judgment in the "Schrems II" case (Case C-311/18) in July 2020 that the SCCs remain a valid mechanism for transfers of personal data to third countries. However, the CJEU also ruled that transfers made pursuant to the SCCs and other alternative transfer mechanisms need to be analyzed on a case-by-case basis to ensure EU standards of data protection are met in the jurisdiction where the data importer is based, and there continue to be concerns about whether the SCCs and other mechanisms will face additional challenges. European regulators have issued recent guidance following the CJEU case that imposes significant new diligence requirements on transferring data outside the EEA, including under an approved transfer mechanism. This guidance requires an "essential equivalency" assessment of the laws of the destination country. If essentially equivalent protections are not available in the destination country, the exporting entity must then assess if supplemental measures can be put in place that, in combination with the chosen transfer mechanism, would address the deficiency in the laws and ensure that essentially equivalent protection can be given to the data. Complying with this guidance will be expensive and time consuming and may, in the worst case scenario, ultimately prevent us from transferring personal data outside the EEA, which would cause significant business disruption. Like many other businesses, until the legal uncertainties regarding how to legally continue transfers pursuant to the SCCs and other mechanisms are settled, we will continue to face uncertainty as to whether our efforts to comply with our obligations under the GDPR will be sufficient. This and other future developments regarding the flow of data across borders could increase the complexity of transferring personal data across borders in some markets and may lead to governmental enforcement actions, litigation, fines and penalties or adverse publicity, which could have an adverse effect on our reputation and business. That said, as far as transfers of personal data from the EU to the US are concerned, on 10 July 2023, the EU and US announced that they had reached an agreement in principle on a new deal to allow personal data to transfer from the EEA to the US to try and resolve the uncertainty created by the above decision (known as the EU-US Data Privacy Framework, or the "DPF") and to replace the previous EU-US Privacy Shield framework which was invalidated in the "Schrems II" case. Companies participating in the DPF may rely on this framework to receive personal data from the EU/EEA. The US is now subject to an adequacy decision from the European Commission which is now in place. Similar to the EU-US Privacy Shield, the DPF has already been challenged. The challenge is still in its very early stages and the result and potential effects of the challenge is yet unclear. Even if this particular challenge is unsuccessful, it is likely that the DPF will be subject to legal review, with the ultimate risk consisting of the invalidation of the DPF as an EU-US transfer tool.
Failure to comply with the requirements of the GDPR and the related national data protection laws of the European Union Member States and Norway, Iceland and Liechtenstein may result in fines up to €20 million or 4% of a company's global annual revenues for the preceding financial year, whichever is higher. The authorities have shown a willingness to impose significant fines and issue orders preventing the processing of personal data on non-compliant businesses. Moreover, the GDPR grants data subjects the right to claim material and non-material damages resulting from infringement of the GDPR and introduces the right for non-profit organizations to bring claims on behalf of data subjects. Given the breadth and depth of changes in data protection obligations, maintaining compliance with the GDPR requires significant time, resources and expense, and we may be required to put in place additional controls and processes ensuring compliance as the regulatory landscape continues to evolve. This may be onerous and adversely affect our business, financial condition and results of operations.
Further, the United Kingdom's vote in favor of exiting the European Union, often referred to as Brexit, and ongoing developments in the United Kingdom means that the EU GDPR regime no longer applies in the United Kingdom, though the substantive law remains very similar. Following the United Kingdom's withdrawal from the European Union on January 31, 2020, pursuant to the transitional arrangements agreed to between the United Kingdom and European Union, the GDPR continued to have effect in United Kingdom law and continued to do so until December 31, 2020, as if the United Kingdom remained a Member State of the European Union for such purposes. Following December 31, 2020, and the expiry of those transitional arrangements, the data protection obligations of the GDPR continue to apply to United Kingdom-related processing of personal data in substantially unvaried form under the so-called "UK GDPR" (i.e., the GDPR as it continues to form part of law in the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended (including by the various Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations)). However, going forward, there will be increasing scope for divergence in application, interpretation and enforcement of data protection law as between the United Kingdom and EEA. The government in the United Kingdom has in fact recently proposed a new data protection law (the Data Protection and Digital Information Bill, or "DPDI Bill"); the DPDI Bill is currently some way from being finalized but would, if adopted, make various changes to the existing data protection framework in the United Kingdom, although many aspects of the current data protection regime are likely to remain substantially similar.
Furthermore, the relationship between the United Kingdom and the EEA in relation to certain aspects of data protection law remains somewhat uncertain. For example, with respect to transfers of personal data from the EEA to the United Kingdom, the United Kingdom received an adequacy decision from the EU Commission on 28 June 2021 confirming that, for the time being, the United Kingdom is considered to provide a level of protection for personal data equivalent to that which exists within the EU. This means that, for the moment, transfers of personal data from the EEA to the United Kingdom may continue without any need for additional safeguards (such as EU standard contractual clauses). Importantly, the current adequacy decision for the United Kingdom contains a "sunset clause" which means that it will expire on 27 June 2025, unless the EU Commission decides to renew it at that stage. The current adequacy decision also contains various ongoing monitoring mechanisms, which allow the EU Commission to keep the position under review in the event that there are any future changes to data protection law in the United Kingdom which materially reduce the level of protection provided for personal data. For the time being, however, transfers of personal data from the EEA to the United Kingdom can continue on the basis of the current adequacy decision for the United Kingdom, and no additional safeguards are required. The United Kingdom has also similarly recognized the EEA states as adequate for the purposes of the UK GDPR (under "adequacy regulations", which are the United Kingdom's equivalent of EU adequacy decisions under the GDPR), meaning that personal data can currently be transferred from the United Kingdom to the EEA without any need for UK standard contractual clauses or other safeguards. Transfers from the UK to the US are also subject to partial UK finding of adequacy provided that the data transferred is covered by what is known as the UK Extension to the new EU-US DPF.
Additionally, as noted above, the United Kingdom has transposed the GDPR into United Kingdom domestic law by way of the UK GDPR with effect from January 2021, which could expose us to two parallel regimes, each of which potentially authorizes similar fines and other potentially divergent enforcement actions for certain violations. Also, following the expiry of the post-Brexit transitional arrangements, the United Kingdom Information Commissioner's Office is not able to be our "lead supervisory authority" in respect of any "cross border processing" for the purposes of the GDPR. For so long as we are unable to, and/or do not, designate a lead supervisory authority in an EEA member state, with effect from January 1, 2021, we are not able to benefit from the GDPR's "one stop shop" mechanism. Amongst other things, this would mean that, in the event of a violation of the GDPR affecting data subjects across the United Kingdom and the EEA, we could be investigated by, and ultimately fined by the United Kingdom Information Commissioner's Office and the supervisory authority in each and every EEA member state where data subjects have been affected by such violation. Other countries have also passed or are considering passing laws requiring local data residency and/or restricting the international transfer of data.