We collect and use personal information, such as name, mailing address, email addresses, mobile phone number, medical and location information, and the collection and use of this information is regulated by privacy and data protection laws, rules and regulations. We also receive personal information from third parties subject to the same legal obligations. Violations of these laws could lead to civil and criminal penalties as well as adverse publicity that could harm our ability to initiate and complete clinical trials. We also face risks inherent (i) in the collection, use, and selective disclosure of large volumes of personal and non-personal proprietary data and (ii) in the protecting of personal and sensitive information from the Cyber and Technology Risks discussed above.
Any failure by us or any of our third-party service providers to follow such laws, regardless of fault, could result in significant liability or reputational harm under various state, federal and international privacy, data protection and other laws, including, the laws listed below. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues that may affect our business and increase the uncertainty of inconsistent regulator enforcement across jurisdictions that, include but not limited to:
- The Federal Trade Commission (the "FTC"), who is responsible for enforcement against unfair and deceptive business practices and expects a company's data security measures to be reasonable and appropriate. Individually identifiable health information is considered sensitive data that merits stronger safeguards. With respect to privacy, the FTC also sets expectations that companies honor the privacy promises made to individuals about how the company handles consumers' personal information; any failure to honor promises, such as the statements made in a privacy policy or on a website, may constitute unfair or deceptive acts or practices in violation of the Federal Trade Commission Act. While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power to enforce our promises to maintain adequate security safeguards as it interprets them, and events that we cannot fully control, such as data breaches, may be result in FTC enforcement resulting in civil penalties or enforcement actions. Additionally, as may be applicable, protection of individually identifiable health information in the United States may be subject to the Health Insurance and Portability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, which may be enforced separately by the Health and Human Services Agency that could result in civil and criminal penalties. HIPAA imposes certain requirements relating to the privacy, security and transmission of individually identifiable health information, which are applicable to "business associates"-certain persons or entities that create, receive, maintain or transmit protected health information in connection with providing a specified service or performing a function on behalf of a covered entity.
- California, which continues to be a critical state with respect to evolving consumer privacy laws after enacting the California Consumer Privacy Act (the "CCPA"), later amended by ballot measure through the California Privacy Rights Act (the "CPRA"). The CPRA took effect in January 2023 with enforcement beginning on July 1, 2023, subject to regulations promulgated through a newly created enforcement agency called the California Privacy Protection Agency ("CPPA"). Failure to comply with the CCPA and the CPRA may result in significant civil penalties, injunctive relief, or statutory or actual damages as determined by the CPPA and California Attorney General through its investigative authority. Notably, comparable consumer privacy laws have and are expected to take effect in many other states, including Virginia, Colorado, Connecticut, Utah, Montana, Oregon, Texas, Delaware, Iowa and Tennessee. Compliance with these new privacy regulations may result in additional costs and expense of resources to maintain compliance.
- The European Union (the "EU") and United Kingdom ("UK") GDPR, which applies extraterritorially, and imposes several strict requirements for controllers and processors of personal information, including higher standards for obtaining consent from individuals to process their personal information, increased requirements pertaining to the processing of special categories of personal information (such as health information) and pseudonymized (i.e., key-coded) data, and transfer of personal information from the
EEA/UK/Switzerland to countries not deemed to have adequate data protections laws. On the latter point, the EU GDPR (covering the EEA) as well as UK and Swiss data protection laws impose strict rules on the cross-border transfer of personal data out of the EU, UK, or Switzerland to a "third country," including the United States. On June 4, 2021, the European Commission finalized new versions of the Standard Contractual Clauses (the "SCCs"). The UK Information Commissioner's Office of the Data Protection Authority published the UK version of the SCCs, and by March 2024, we will be required to use and honor these clauses for transfers of UK residents' personal data to a foreign country that does not have adequate data protection. Effective July 10, 2023, the new EU-U.S. Data Privacy Framework ("DPF") has been recognized as adequate under EU law to allow transfers of personal data from the EU to certified companies in the United States. However, the DPF is subject to further legal challenges which could cause the legal requirements for personal data transfers from the EU to the United States to become uncertain once again. While the DPF does not apply to the UK, on October 12, 2023, the UK government adopted an adequacy decision concluding that the United States ensures an adequate level of protection transferred from the UK to the United States under the UK Extension to the EU-U.S. Data Privacy Framework. We anticipate a similar adequacy decision from the Swiss government (the "Swiss DPF"). Both the UK and Swiss DPF could also be contested or otherwise affected by any challenges to the EU-U.S. DPF. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. In the EU and other markets, potential new rules and restrictions on the flow of data across borders could increase the cost and complexity of doing business in those regions. The GDPR also provides that countries in the EEA may establish their own laws and regulations further restricting the processing of certain personal information, including genetic data, biometric data, and health data. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for severe noncompliance of up to €20 million or 4 percent of the annual global revenues of the noncompliant company, whichever is greater.
- In Japan, The Act on the Protection of Personal Information, in effect since 2003 and amended several times, with the most recent amendments coming into effect in April 2022, provides a comprehensive data privacy and protection regime comparable to the GDPR to every Personal Information Controller ("PIC") in Japan that is either a person or an entity that handles personal information in the course of their or its business. PICs have legal obligations to secure personal information and report losses to the Japanese government. Noncompliance is regulated by the Personal Information Protection Commission, which has the power to issue orders for "improvement" in response to violations of privacy law by PICs that include civil and criminal penalties.
Compliance with these laws and regulations may require significant additional cost expenditures or changes in products or our business that increase competition or reduce revenue. As stated above, noncompliance or any perceived noncompliance could result in the imposition of fines, penalties, or orders to stop noncompliant activities, withdrawal of non-compliant products from a market, or other enforcement action or litigation.
We cannot provide assurance that (i) current or future legislation will not prevent us from generating or maintaining personal information or (ii) patients will consent to the use of their personal information (as necessary). Either of these circumstances may prevent us from undertaking or publishing essential research and development, manufacturing, and commercialization, which could have a material adverse effect on our business, results of operations, financial condition, and prospects.
Federal, state, and foreign government requirements include obligations of companies to notify regulators and/or individuals of security breaches involving personal information resulting from Technology Risks or Cyber Risks experienced by us, or our vendors, contractors, or organizations with whom we had specific contractual obligations to protect our data. Further, the improper access to, use of, or disclosure of our data or a third-party's personal information could subject us to individual or consumer class action litigation and governmental investigations and proceedings by federal, state and local regulatory entities in the United States and by international regulatory entities. Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with the new data protection rules and possible government oversight.
In addition to government regulation, privacy advocates and industry groups have and may in the future propose self-regulatory standards from time to time. These and other industry standards may legally or contractually apply to us, or we may elect to comply with such standards. It is possible that if our practices are not consistent or viewed as not consistent with legal and regulatory requirements, including changes in laws, regulations and standards or new interpretations or applications of existing laws, regulations and standards, we may become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, loss of export privileges, or severe criminal or civil sanctions, all of which may have a material adverse effect on our business, operating results, reputation, and financial condition.
Any such liability, litigation, investigations and proceedings may or may not be covered by our liability insurance. and may subject us to significant penalties and negative publicity, require us to change our business practices, increase our costs, severely disrupt our business, and may result in significant reputational harm producing a material adverse effect on our client base, patient base and revenue.