Our business is subject to complex and evolving U.S., state and international data and privacy protection laws. In the U.S., numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act) govern the collection, use, disclosure, and protection of health-related and other personal information. Compliance with these laws is difficult, constantly evolving, and time consuming. These laws may differ from each other in significant ways, thus complicating compliance efforts. Many of the state laws enable a state attorney general to bring actions and provide private rights of action to consumers as enforcement mechanisms. Failure to comply with data protection laws and regulations could result in government enforcement actions and create liability for us (which could include civil and/or criminal penalties), private litigation and/or adverse publicity. Federal regulators, state attorneys general, and plaintiffs' attorneys have been and will likely continue to be active in this space. We may also obtain health information from third parties (e.g., healthcare providers who prescribe our products) that are subject to privacy and security requirements under HIPAA, and other privacy and data security and consumer protection laws. Although we are not directly subject to HIPAA, other than potentially with respect to providing certain employee benefits, we could potentially be subject to criminal penalties if we, our affiliates, or our agents knowingly receive individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA, and could also potentially be subject to other civil and/or criminal penalties if we obtain, use or disclose information in a manner not permitted by other privacy and data security and consumer protection laws.
The Federal Trade Commission (the "FTC") also sets expectations for failing to take appropriate steps to keep consumers' personal information secure, or failing to provide a level of security commensurate to promises made to individual about the security of their personal information (such as in a privacy notice) may constitute unfair or deceptive acts or practices in violation of Section 5(a) of the FTC Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds,the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. With respect to privacy, the FTC also sets expectations that companies honor the privacy promises made to individuals about how the company handles consumers' personal information; any failure to honor promises, such as the statements made in a privacy policy or on a website, may also constitute unfair or deceptive acts or practices in violation of the FTC Act. While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power to enforce promises as it interprets them, and events that we cannot fully control, such as data breaches, may be result in FTC enforcement. Enforcement by the FTC under the FTC Act can result in civil penalties or enforcement actions.
Additionally, EU Member States, the UK and other jurisdictions where we may in the future operate, have adopted data protection laws and regulation which impose significant compliance obligations. For example, the EU General Data Protection Regulation including as implemented in the UK (collectively, "GDPR"), applies to our activities conducted from an establishment in the EU/UK or related to products and services that we may offer to EU/UK users that involve the collection, use, storage, transfer, and other processing of personal data, including personal health data. The GDPR creates a broad range of compliance obligations and restrictions on the ability to collect, analyze and transfer personal data, which could cause us to change our business practices, and has significantly increased financial penalties for noncompliance (including possible fines of up to 4% of global annual turnover for the preceding financial year or €20 million (whichever is higher) for the most serious infringements). The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with data protection authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In particular, these obligations and restrictions relate to the processing and protecting of personal data, including obligations to having a lawful basis for processing personal data (which may result in some instances in obtaining the consent of the individuals to whom the personal data relates), provide detailed information about the processing activities to the individuals, dealing with restrictions on sharing of personal data with third parties and the transferring of personal data out of the EU/UK, having contractual arrangements in place where required (such as with clinical trial sites and vendors), having appropriate technical and organizational security and confidentiality measures in place to protect the personal data we collect and process, reporting in certain instances personal data breaches to data protection authorities and/or affected individuals, appointing data protection officers, conducting data protection impact assessments, responding to privacy rights requests, and having appropriates policies and procedures in place to be able to demonstrate compliance with the obligations following the GDPR. With regard to transfer of personal data, the GDPR restricts the ability of companies to transfer personal data from the European Economic Area to the United States and other countries, which may adversely affect our ability to transfer personal data or otherwise may cause us to incur significant costs for implementing lawful transfer mechanisms, conducting data transfer impact assessments, and implementing additional measures where necessary to ensure that personal data transferred are adequately protected in a manner essentially equivalent to the EU/UK. The GDPR provides different transfer mechanisms we can use to lawfully transfer personal data from the EU/UK to countries outside the EU/UK. An example is relying on adequacy decisions of the European Commission, such as the EU-U.S. Data Privacy Framework which was adopted by the European Commission in July 2023. Another example of a lawful transfer mechanism is using the EU Standard Contractual Clauses as approved by the European Commission in June 2021, which are the most common used transfer mechanism used to transfer personal data out of the EU/UK. In order to use the EU Standard Contractual Clauses mechanism, the exporter and the importer must ensure that the importer may guarantee a level of personal data protection in the importing country's level of protection must be adequate that is essentially equivalent to that of the EEA. Compliance with EU/UK data transfer obligations involves conducting transfer impact assessments, which includes documenting detailed analyses of data access and protection laws in the countries in which data importers are located, which can be costly and time-consuming. Data importers must also expend resources in analyzing their ability to comply with transfer obligations, including implementing new safeguards and controls to further protect personal data.
Data protection authorities from the different EU member states, as well as in the United Kingdom and Switzerland, have promulgated national privacy laws that impose additional requirements, which add to the complexity of processing and transferring EU personal data, with the United Kingdom and Switzerland following the EU with the publication of new Model Clauses to be incorporated in all applicable contracts within a specified timeframe in order to legitimize data transfers from those jurisdictions. Our ability to continue to transfer personal data outside of the EU, United Kingdom, or Switzerland may become significantly more costly and may subject us to increased scrutiny and liability under the GDPR or similar local laws, and we may experience operating disruptions if we are unable to conduct these transfers in the future.
The California Consumer Privacy Act, or CCPA, establishes certain requirements for data use and sharing transparency and provides California residents certain rights concerning the use, disclosure, and retention of their personal data. The CCPA and its implementing regulations have already been amended multiple times since their enactment. In November 2020, California voters approved the California Privacy Rights Act ("CPRA") ballot initiative, which introduced significant amendments to the CCPA and established and funded a dedicated California privacy regulator, the California Privacy Protection Agency. The amendments introduced by the CPRA went into effect on January 1, 2023, and new implementing regulations continue to be introduced by the California Privacy Protection Agency. Failure to comply with the CCPA may result in, among other things, significant civil penalties and injunctive relief, or potential statutory or actual damages. In addition, California residents have the right to bring a private right of action in connection with certain types of incidents. These claims may result in significant liability and damages. We implemented processes to manage compliance with the CCPA and continue to assess the impact of the CPRA, and other state legislation, on our business as additional information and guidance becomes available. These laws and regulations are evolving and subject to interpretation, and may impose limitations on our activities or otherwise adversely affect our business. Similarly, there are a number of legislative proposals in the European Union, the United States, at both the federal and state level, and in other jurisdictions that could impose new obligations or limitations in areas affecting our business. For example, other states, including Virginia, Colorado, Utah, Indiana, Iowa, Tennessee, Montana, Texas and Connecticut have enacted privacy laws similar to the CCPA that impose new obligations or limitations in areas affecting our business and we continue to assess the impact of these state legislations on our business as additional information and guidance becomes available. In addition, some countries are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our services and research activities. These laws and regulations, as well as any associated claims, inquiries, or investigations or any other government actions may lead to unfavorable outcomes including increased compliance costs, delays or impediments in the development of new products, negative publicity, increased operating costs, diversion of management time and attention, and remedies that harm our business, including fines or demands or orders that we modify or cease existing business practices.
Certain of these laws and regulations are described in greater detail in the previous section under "Business - Government Regulation - Healthcare Privacy Laws." Compliance with these laws and regulations is difficult, constantly evolving, time consuming, and requires a flexible privacy framework and substantial resources. If we, our agents, or our third party partners fail to comply or are alleged to have failed to comply with these or other applicable data protection and privacy laws and regulations, or if we were to experience a data breach involving personal information, we could be subject to government enforcement actions or private lawsuits. Any associated claims, inquiries, or investigations or other government actions could lead to unfavorable outcomes that have a material impact on our business including through significant penalties or fines, monetary judgments or settlements including criminal and civil liability for us and our officers and directors, increased compliance costs, delays or impediments in the development of new products, negative publicity, increased operating costs, diversion of management time and attention, or other remedies that harm our business, including orders that we modify or cease existing business practices.