The global data protection landscape is rapidly evolving, and we may be or become subject to or affected by numerous federal, state and foreign laws and regulations, as well as regulatory guidance, governing the collection, use, disclosure, transfer, security and processing of personal data, such as information that we collect about subjects and health care providers in connection with clinical trials. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, which may create uncertainty in our business, affect our or our service providers' ability to operate in certain jurisdictions or to collect, store, transfer use and share personal data, result in liability or impose additional compliance or other costs on us. Any failure or perceived failure by us to comply with federal, state, or foreign laws or self-regulatory standards could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others.
In the United States, numerous federal and state laws and regulations, including federal health information privacy laws (e.g., HIPAA, as amended by HITECH, state data breach notification laws, state health information privacy laws and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA, as amended by HITECH, or other privacy and data security laws. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use, or disclose protected health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. However, determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation.
If we are unable to properly protect the privacy and security of protected health information or other personal, sensitive, or confidential information in our possession, we could be found to have breached our contracts. Further, if we fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face significant administrative, civil and criminal penalties. Enforcement activity can also result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal and outside resources. Furthermore, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems.
Many state laws govern the privacy and security of personal information and data in specified circumstances, many of which differ from each other in significant ways, are often not pre-empted by HIPAA, and may have a more prohibitive effect than HIPAA, thus complicating compliance efforts. For example the CCPA, which went into effect in January 2020 and provides new data privacy rights for consumers and new operational requirements for companies, which may increase our compliance costs and potential liability. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. While there is currently an exception for protected health information that is subject to HIPAA and clinical trial regulations, as currently written, the CCPA may impact certain of our business activities. In addition, the California Consumer Rights Act (the "CPRA") was recently enacted to strengthen elements of the CCPA and became effective on January 1, 2023. A number of other states have enacted similar comprehensive privacy laws or considered similar privacy proposals. The Colorado Privacy Act, the Connecticut Personal Data Privacy and Online Monitoring Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act all became effective during 2023. Privacy laws in Montana, Oregon, and Texas will take effect in 2024. In addition, laws in other U.S. states are set to take effect beyond 2024, and additional U.S. states have proposals under consideration. These privacy laws may impact our business activities and exemplify the vulnerability of our business to the evolving regulatory environment related to personal data.
In addition to our operations in the United States, which may be subject to health care and other laws relating to the privacy and security of health information and other personal information, we are conducting, and we may conduct in the future, clinical trials in EEA and may become subject to additional European data privacy laws, regulations and guidelines. The General Data Protection Regulation, (EU) 2016/679 ("GDPR") became effective on May 25, 2018, and deals with the collection, use, storage, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals in the EEA. The GDPR imposes a broad range of strict requirements on companies subject to the GDPR, including requirements relating to having legal bases for processing personal information relating to identifiable individuals and transferring such information outside the EEA, including to the United States, providing details to those individuals regarding the processing of their personal health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, keeping personal information secure, having data processing agreements with third parties who process personal information, responding to individuals' requests to exercise their rights in respect of their personal information, reporting security breaches involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers, conducting data protection impact assessments, and record-keeping. The GDPR increases substantially the penalties to which we could be subject in the event of any non-compliance, including fines of up to €10,000,000 or up to 2% of our total worldwide annual turnover for certain comparatively minor offenses, or up to €20,000,000 or up to 4% of our total worldwide annual turnover, whichever is greater, for more serious offenses. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In addition, the GDPR includes restrictions on cross-border data transfers.
Further, national laws of member states of the European Union have been adapted to the requirements under the GDPR, thereby implementing national laws which may partially deviate from the GDPR and impose different obligations from country to country, so that we do not expect to operate in a uniform legal landscape in the EEA. Also, as it relates to processing and transfer of genetic data, the GDPR specifically allows national laws to impose additional and more specific requirements or restrictions, and European laws have historically differed quite substantially in this field, leading to additional uncertainty.
The GDPR also regulates the transfer of personal data subject to the GDPR to so-called third countries that have not been found by the European Commission to provide an adequate level of data protection. Legal developments in Europe have created complexity and uncertainty regarding such transfers. For instance, on July 16, 2020, the Court of Justice of the European Union, or CJEU, invalidated, by means of the so-called Schrems II judgment, the EU-U.S. Privacy Shield Framework, or the Privacy Shield, under which personal data could be transferred from the EEA to U.S. entities who had self-certified under the Privacy Shield scheme. However, on July 10, 2023, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the European Union to the United States – the EU-U.S. Data Privacy Framework – which provides EU individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data, and allows U.S. companies to self-certify to the U.S. Department of Commerce their compliance with a set of agreed privacy principles in order to freely receive EU personal data. The adequacy decision followed the signing of an executive order introducing new binding safeguards to address the points raised in the Schrems II judgment. The European Commission will continually review developments in the United States along with its adequacy decision.
Following the United Kingdom's withdrawal from the European Union (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the EU GDPR has been implemented in the United Kingdom (as the UK GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover. In June of 2021, the European Commission issued a decision, which will sunset on June 27, 2025 without further action, that the United Kingdom ensures an adequate level of protection for personal data transferred under the EU GDPR from the EU to the United Kingdom. Adequacy decisions can be adapted or even withdrawn in the event of developments affecting the level of protection in the applicable jurisdiction. In addition, the Parliament of the United Kingdom is currently considering the Data Protection and Digital Information Bill to harmonize the 2018 Data Protection Act, U.K. GDPR, and the Privacy and Electronic Communications Regulations under one legislative framework.
We are conducting clinical trials in the EEA, and the GDPR increases our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we are required to have in place additional mechanisms and safeguards to ensure compliance with the GDPR, including as implemented by individual countries. Compliance with the GDPR is a rigorous and time-intensive process that increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. We expect that we will continue to face uncertainty as to whether our efforts to comply with any obligations under European privacy laws will be sufficient. If we are investigated by a European data protection authority, we may face fines and other penalties. Any such investigation or charges by European data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new clients or biopharmaceutical partners. We may also experience hesitation, reluctance, or refusal by European or multi-national vendors or biopharmaceutical partners to continue to use our products due to the potential risk exposure as a result of the current (and, in particular, future) data protection obligations imposed on them by certain data protection authorities in interpretation of current law, including the GDPR. Such vendors or biopharmaceutical partners may also view any alternative approaches to compliance as being too costly, too burdensome, too legally uncertain, or otherwise objectionable and therefore decide not to do business with us. Any of the forgoing could materially harm our business, prospects, financial condition and results of operations.