The GDPR and UK GDPR apply to companies established in the EEA and UK, respectively, as well as to companies that are not established in the EEA or UK, respectively, and which collect and use personal data in relation to (i) offering goods or services to, or (ii) monitoring the behavior of, individuals located in the EEA or UK, respectively. If we conduct clinical trial programs in the EEA or UK (whether the trials are conducted directly by us or through a clinical vendor or collaborator) or enter into research collaborations involving the monitoring of individuals in the EEA or UK, or market our products to individuals in the EEA or UK, we will be subject to the GDPR or UK GDPR, as applicable. The GDPR and UK GDPR put in place stringent operational requirements for processors and controllers of personal data, including, for example, high standards for obtaining consent from individuals to process their personal data (or reliance on another appropriate legal basis), the provision of robust and detailed disclosures to individuals about how personal data is collected and processed (in a concise, intelligible and easily accessible form), an individual data rights regime (including access, erasure, objection, restriction, rectification and portability), maintaining a record of data processing, data export restrictions governing transfers of data from the EEA and UK, respectively, short timelines for data breach notifications to be given to data protection regulators or supervisory authorities (and in certain cases, affected individuals) of data breaches, and limitations on retention of information. The GDPR and UK GDPR also put in place increased requirements pertaining to health data and other special categories of personal data, as well as a definition of pseudonymized (i.e., key-coded) data. Further, the GDPR provides that EEA member states may establish their own laws and regulations limiting the processing of genetic, biometric, or health data, which could limit our ability to collect, use, and share such data and/or could cause our costs to increase. In addition, there are certain obligations if we contract third-party processors in connection with the processing of personal data. If our or our collaborators' or service providers' privacy or data security measures fail to comply with the GDPR or UK GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data, or fines of up to 20 million Euros in the case of GDPR or £17.5 million in the case of UK GDPR or, in each case, up to 4% of our total worldwide annual revenue of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, including class-action type litigation, negative publicity, reputational harm and a potential loss of business and goodwill.
Recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA and the UK to the United States. Most recently, on July 16, 2020, the Court of Justice of the European Union (the "CJEU") invalidated the EU-US Privacy Shield Framework (the "Privacy Shield") under which personal data could be transferred from the EEA to US entities who had self-certified under the Privacy Shield scheme. This framework has been replaced by the E.U.-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision in July 2023, and the UK-US Data Bridge, which took effect in October 2023. While we do not currently rely upon these frameworks, we expect there to be legal challenges to this framework in the future, which could draw into question the legitimacy of other cross-border transfer mechanisms, including the standard contractual clauses on which we rely to transfer personal data from the EEA and UK to the U.S. and other jurisdictions. On June 4, 2021, the European Commission released two revised sets of standard contractual clauses for transfers of personal data from the EEA to the U.S. and has indicated that it will release additional revised standard contractual clauses in the near future.
These recent developments may require us to review and amend the legal mechanisms by which we make and/ or receive personal data transfers to/ in the United States. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Other countries outside of the EEA and UK maintain different privacy laws that we are subject to which may further increase our costs of compliance and expose us to greater legal risk.
There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. In particular, regulations promulgated pursuant to HIPAA establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. While we do not believe that we are directly subject to HIPAA as either a "covered entity" or "business associate," U.S. sites at which we conduct clinical trials are likely to be covered entities and thus must ensure that they obtain adequate patient authorization or establish another basis under HIPAA to disclose a clinical trial subject's individually identifiable health information to us and other entities participating in our clinical trials.
In the United States, the CCPA came into effect in January 2020 and was expanded by the California Privacy Rights Act, which took effect on January 1, 2023 (collectively, "CCPA"), and which, collectively, (i) requires certain disclosures to California individuals; (ii) increases the privacy and security obligations of entities handling certain personal information; and (iii) affords such individuals, in certain situations, abilities to request the erasure of personal information, opt out of certain sales of personal information, opt out of the "sharing" of personal information (i.e., disclosing of personal information for cross-context behavioral advertising), and limit the use and disclosure of "sensitive personal information" for purposes other than those for which it was disclosed, among others. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Because we have not yet generated revenue and do not meet the CCPA's other jurisdictional tests, we do not yet meet the applicable threshold for the CCPA to apply to our business. If our business becomes subject to CCPA in the future, it could increase our compliance costs and potential liability. Similar laws have been proposed or passed in more than half of the states in the U.S. and in the U.S. Congress. Furthermore, all fifty U.S. states, the District of Columbia, Puerto Rico, and other U.S. territories have enacted data breach notification laws that require, among other things, notifications to state governments and/or the affected individuals in the event of a data breach, which differ from one another and impose significant compliance burden. As such, we will need to review periodically our operations in comparison to developments in such laws. Achieving and sustaining compliance with applicable international, federal and state privacy, security, and breach reporting laws may prove time-consuming and costly.