The global data protection landscape is rapidly evolving, and we and our partners and vendors are or may become subject to various federal, state and foreign laws, regulations and requirements governing the collection, use, disclosure, retention and security of personal information, such as information that we may collect in connection with clinical trials. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business.
In the United States, numerous federal and state laws and regulations, including data breach notification laws, health information privacy laws and federal and state consumer protection laws and regulations that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our partners. For example, most healthcare providers, including research institutions from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009. Under HIPAA, we could potentially face substantial criminal or civil penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA's requirements for disclosure of individually identifiable health information, or otherwise violate applicable HIPAA requirements related to the protection of such information. Even when HIPAA does not apply, failing to take appropriate steps to keep consumers' personal information secure may constitute a violation of the Federal Trade Commission Act.
In addition, we may maintain sensitive personally identifiable information, including health information, that we receive throughout the clinical trial process, in the course of our research collaborations and directly from individuals (or their healthcare providers) who enroll in our patient assistance programs. As such, we may be subject to state laws requiring notification of affected individuals and state regulators in the event of a breach of personal information. In 2018 California passed into law the California Consumer Privacy Act, or CCPA, which took effect on January 1, 2020, and imposed many requirements on businesses that process the personal information of California residents. Many of the CCPA's requirements are similar to those found in the General Data Protection Regulation, or the GDPR, including requiring businesses to provide notice to data subjects regarding the information collected about them and how such information is used and shared, and providing data subjects the right to request access to such personal information and, in certain cases, request the erasure of such personal information. The CCPA also affords California residents the right to opt-out of "sales" of their personal information. The CCPA contains significant penalties for companies that violate its requirements. In November 2020 California voters passed a ballot initiative for the California Privacy Rights Act, or the CPRA, which went into effect on January 1, 2023, and significantly expanded the CCPA to incorporate additional GDPR-like provisions including requiring that the use, retention, and sharing of personal information of California residents be reasonably necessary and proportionate to the purposes of collection or processing, granting additional protections for sensitive personal information, and requiring greater disclosures related to notice to residents regarding retention of information. The CPRA also created a new enforcement agency – the California Privacy Protection Agency – whose sole responsibility is to enforce the CPRA and other California privacy laws, which will further increase compliance risk. The provisions in the CPRA may apply to some of our business activities. In addition, fourteen other states have passed their own versions of comprehensive privacy laws. Four of these laws are already in effect, and the others will go into effect in coming years. Other states will be considering these laws in the future, and Congress has also been debating passing a federal privacy law. On top of these comprehensive privacy laws, Washington, Nevada, and Connecticut have also passed laws specifically regulating consumer health data. The Washington law is particularly noteworthy because it includes a private right of action. These laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.
Our Phase 1 trial for TERN-701, the CARDINAL trial, includes sites from the United States, Europe and other countries. Any clinical trial programs and research collaborations, among other activities, that we engage in outside the United States may implicate international data protection laws, including, in the EEA, the GDPR, which became effective in 2018. The GDPR imposes stringent operational requirements for processors and controllers of personal data. Among other things, the GDPR requires covered companies to provide detailed notices and to abide by consent requirements for clinical trial subjects and other data subjects, to follow procedures regarding the security of personal data and notification of data processing obligations or security incidents to appropriate data protection authorities or data subjects, and to honor and provide certain privacy rights to individuals within the EEA, including the right to access, correct and delete their personal data. If our privacy or data security measures fail to comply with the requirements of the GDPR or other applicable laws or regulations, we may be subject to litigation, regulatory investigations, enforcement notices and/or enforcement actions requiring us to change the way we use personal data and/or fines. In addition to statutory enforcement, a personal data breach can lead to negative publicity and a potential loss of business. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Further, from January 1, 2021, we have had to comply with the GDPR and the United Kingdom GDPR, or UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, i.e. fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term. The European Commission has adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards. However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews or extends that decision.
Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States; in July 2020, the Court of Justice of the European Union, or CJEU, invalidated the EU-US Privacy Shield Framework, or Privacy Shield for purposes of international transfers. The EU-US Privacy Shield has now been replaced with the EU-US Data Privacy Framework (DPF), which is intended to address the issues cited by the CJEU in its 2020 court decision. The European Commission issued an adequacy decision for the DPF on July 10, 2023, and it is now a valid mechanism to transfer data from the EU to the US for entities that have registered as part of the DPF. However, it is possible that the validity of the DPF will be challenged in court, which could further create instability related to international data transfers.
The CJEU's decision in 2020 also imposed further restrictions on the use of SCCs. The European Commission issued revised SCCs on June 4, 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board. The revised SCCs must be used for relevant new data transfers from September 27, 2021. There is also some uncertainty around whether the revised clauses can be used for all types of data transfers, particularly whether they can be relied on for data transfers to non-EEA entities subject to the GDPR. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.
The new SCCs apply only to the transfer of personal data outside of the EEA and not the United Kingdom. The United Kingdom has its own guidance for data transfers to other jurisdictions that are not covered by an "adequacy" decision (which includes the United States) and has adopted the International Data Transfer Agreement, which can serve as a basis for companies to lawfully transfer outside of the United Kingdom. The United Kingdom also has its own data privacy framework (called the "UK-US Data Bridge") that allows registered companies to transfer data from the UK to the US in accordance with the UK GDPR.
Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. We will likely be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws. Claims that we have violated individuals' privacy rights, failed to comply with applicable laws or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend, and could result in adverse publicity that could harm our business. Moreover, even if we take all necessary action to comply with regulatory requirements, we could be subject to a hack or data breach, which could subject us to fines and penalties, as well as reputational damage.
If we or our partners or vendors fail to comply with applicable federal, state, or local regulatory requirements, we could be subject to a range of regulatory actions that could affect our or any collaborators' ability to seek to commercialize our clinical candidates. Any threatened or actual government enforcement action could also generate adverse publicity and require that we devote substantial resources that could otherwise be used in other aspects of our business. Any of the foregoing could harm our competitive position, business, financial condition, results of operations and prospects.