In the ordinary course of our business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, "process") personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, data we collect about trial participants in connection with clinical trials, and health/medical data (collectively, "sensitive information"). We process data of our employees, consultants, certain individuals who may be affiliated with our customers, including physician users of our products and, in the context of clinical investigations, patients. We collect this kind of information for several purposes, such as billing, reimbursement support, marketing purposes, post-marketing safety vigilance, servicing potential warranty claims and during the course of clinical trials.
Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. Such obligations include laws that protect the confidentiality of certain sensitive information including patient health information, such as patient medical records, and restrict the use and disclosure of patient health information by healthcare providers, such as HIPAA in the United States and regulations in the European Union ("EU"), which are described in detail in "Item 1. Business - Data Privacy and Security Laws."
Many U.S. states have enacted laws regulating the collection, use and disclosure of sensitive information and requiring that companies implement reasonable data security measures. Applicable data privacy and security obligations require us, or we may voluntarily choose, to notify affected individuals, customers, governmental entities and/or credit reporting agencies of certain security breaches affecting personal data or to take other actions, such as providing credit monitoring and identity theft protection services. These laws are not consistent, and increase our compliance costs and potential liability in the event of a data breach. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information.
In the past few years, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CPRA"), (collectively, "CCPA") applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages.
Although the CCPA and other comprehensive U.S. state privacy laws include exemptions for certain clinical trials data, and protected health information governed by HIPAA, the law may increase our compliance costs and potential liability with respect to other personal data we collect about California and other applicable residents. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.
Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union's General Data Protection Regulation ("EU GDPR") and the United Kingdom's GDPR ("UK GDPR" and together with the EU GDPR, the "GDPR") impose strict requirements for processing personal data. In Europe, the Network and Information Security Directive ("NIS2") regulates resilience and incident response capabilities of entities operating in a number of sectors, including the health sector. Non-compliance with NIS2 may lead up to administrative fines of a maximum of 10 million Euros or up to 2% of the total worldwide revenue of the preceding fiscal year. The EU GDPR is directly applicable in each EU Member State. This should, in principle, result in a more uniform application of data privacy laws across the EU. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies.
It requires data controllers to, among others, be transparent and to disclose to data subjects (in a concise, intelligible and easily accessible form) how their personal information is to be used, imposes limitations on retention of information, increases requirements pertaining to pseudonymized (i.e., key-coded) data, introduces mandatory data breach notification requirements and sets higher standards for data controllers to demonstrate that they have obtained valid consent for certain data processing activities. Fines for non-compliance with the EU GDPR will be significant - the greater of € 20 million or 4% of global turnover. The EU GDPR provides that EU Member States may introduce further conditions, including limitations, to the processing of genetic, biometric, or health data, which could limit our ability to collect, use and share personal data, or could cause our compliance costs to increase, ultimately having an adverse impact on our business. Each EU Member State may also adopt additional related legislation and guidance in its own national data privacy regime and therefore the laws may differ by jurisdiction, sometimes significantly. We need to ensure compliance with the rules in each jurisdiction where we are established or are otherwise subject to local privacy laws.
In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area ("EEA") and the United Kingdom ("UK") have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.
If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR's cross-border data transfer limitations.
In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and, we are, and may become subject to such obligations in the future. For example, we may also be subject to the Payment Card Industry Data Security Standard ("PCI DSS"). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. We also rely on vendors to process payment card data, who may be subject to PCI DSS, and our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance.
We depend on a number of third parties in relation to the provision of our services, a number of which process personal data on our behalf. These third party service providers may breach their contractual or legal obligations, which could negatively affect our business and/or our reputation.
We publish privacy policies, marketing materials and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy and security, and artificial intelligence. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.
Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model.
We have in the past, and could be in the future, subject to data breaches. Our failure (or perceived failure) to comply with applicable data privacy and security obligations, or to protect sensitive information, could result in significant consequences to us, including government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), additional reporting requirements and/or oversight; bans or restrictions on processing personal data; orders to destroy or not use personal data, imprisonment of company officials and public censure, claims for damages by end-customers, and other affected individuals, and the imposition of integrity obligations and agency oversight, damage to our reputation, and loss of goodwill, any of which could harm our operations, financial performance, and business. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations.
In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Evolving and changing definitions of personal data, within the European Union, the United States, and elsewhere, may limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of data. Moreover, if the relevant laws and regulations change, or are interpreted and applied in a manner that is inconsistent with our data practices or the operation of our products, or if we expand into new regions and are required to comply with new requirements, we may need to expend resources in order to change our business operations, data practices, or the manner in which our products operate. Even the perception of privacy concerns, whether or not valid, may harm our reputation and inhibit adoption of our products.