We are, and may increasingly become, subject to various laws and regulations, as well as contractual obligations and mandatory industry standards relating to privacy and security in the jurisdictions in which we operate. The regulatory environment related to data privacy and security is increasingly rigorous, with new and constantly changing requirements applicable to our business, and enforcement practices are likely to remain uncertain for the foreseeable future. These laws and regulations may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that may have a material adverse effect on our business, financial condition, results of operations and prospects.
In the US, various federal and state regulators, including governmental agencies like the Federal Trade Commission, have adopted, or are considering adopting, laws and regulations concerning personal information privacy and data security. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. For example, the California Consumer Privacy Act of 2018, or the CCPA, which increases privacy rights for California residents and imposes obligations on companies that process their personal information and meet certain revenue or volume processing thresholds, came into effect on January 1, 2020, and was further amended by the California Privacy Rights Act, or the CPRA, on November 3, 2020. Among other things, the CCPA requires covered companies to provide new disclosures to California residents and provide such residents new data protection and privacy rights, including the ability to opt-out of certain sales of personal information. The CPRA significantly modifies the CCPA by expanding residents' rights with respect to certain personal information and creates a new state agency to oversee implementation and enforcement efforts. Many of the CPRA's provisions will become effective on January 1, 2023. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches. This private right of action may increase the likelihood of, and risks associated with, data breach litigation, including class action litigation. In addition, laws in all 50 US states require businesses to provide notice to individuals if certain of their personal information has been disclosed as a result of a qualifying data breach.
Moreover, the CCPA has prompted a number of proposals for new federal and state-level privacy legislation. Specifically, in 2023, state consumer privacy laws similar to the CCPA and CPRA enter into force in Connecticut, Colorado, Utah and Virginia, State laws and regulations are not necessarily preempted by federal laws and regulations, such as HIPAA, particularly if a state affords greater protection to individuals than federal law. Where state laws are more protective, we have to comply with the stricter provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and data we receive, use and share, potentially exposing us to additional expense, adverse publicity and liability. Legal requirements relating to the collection, storage, handling, and transfer of personal information and personal data continue to evolve and may result in increased public scrutiny and escalating levels of enforcement, sanctions and increased costs of compliance. This legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.
Internationally, data protection and privacy laws, regulations and standards in many jurisdictions apply broadly to the collection, use, retention, security, disclosure, transfer or other processing of personal data. For example, the EU General Data Protection Regulation, or GDPR, which became effective on May 25, 2018, is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including imposing special requirements in respect of the processing of health and other sensitive data. Specifically, the GDPR enhances data protection obligations for data controllers of personal data, including, for example, requirements to establish a legal basis for processing, stringent standards for obtaining consent from individuals to process their personal data, robust disclosures to individuals about how personal data is used, a strengthened individual data rights regime (including rights of access and deletion in certain circumstances), strict rules regarding the transfer of personal data out of the European Economic Area, including to the US, requirements to implement safeguards to protect the security and confidentiality of personal data that requires the adoption of administrative, physical and technical safeguards, mandatory data breach notification, limitations on retention and secondary use of personal data, and obligations to take certain measures when engaging third party processors in connection with the processing of personal data. The GDPR also creates direct obligations on service providers acting as processors. EU member states are tasked under the GDPR to enact, and have enacted, certain implementing legislation that adds to and/or further interprets the GDPR requirements and potentially extends our obligations and potential liability for failing to meet such obligations. Failure to comply with the requirements of the GDPR and the related national data protection laws of the European Union Member States may result in potential fines of up to €20 million or 4% of annual global revenues, whichever is greater, and other administrative penalties. The GDPR also confers a private right of action on data subjects and nonprofit organizations, acting subject to a mandate granted by the data subject, to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. In addition, further to the UK's exit from the EU on January 31, 2020, the GDPR ceased to apply in the UK at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the UK's European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020 but subject to certain UK specific amendments) into UK law, referred to as the UK GDPR. The UK GDPR and the UK Data Protection Act 2018 set out the UK's data protection regime, which is independent from but aligned to the EU's data protection regime. Non-compliance with the UK GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher.
Certain legal regimes outside of the US, including in the United Kingdom and under the GDPR, prohibit the transfer of personal data to the US unless certain measures are in place, including, for example, executing Standard Contractual Clauses, or a derogation applies. However, certain EU court decisions cast doubt on the ability to use the European Commission's Standard Contractual Clauses to lawfully transfer personal data to the US and other third countries. Use of the Standard Contractual Clauses must be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and additional supplementary technical, organizational and/or contractual measures and/or contractual provisions may need to be put in place. On December 13, 2022, the European Commission published a draft adequacy decision on the EU-US Data Privacy Framework or the Framework, the successor to the EU-US Privacy Shield Framework that was invalidated by the Court of Justice of the European Union's July 2020 decision in the so-called Schrems II case (Case C-311/18). If approved, the Framework will allow US companies to self-certify to the US Department Commerce their compliance with a set of agreed privacy principles in order to freely receive EU personal data. However, data subjects, civil liberties groups, and data protection authorities may challenge the Framework, which could lead to further scrutiny by the courts. There is no guarantee that any transfer mechanism upon which we rely will be deemed to be valid by the relevant authorities, or that mechanisms that are currently deemed to be valid will remain valid in the future. This uncertainty, and its eventual resolution, may increase our costs of compliance, impede our ability to transfer data and conduct our business and harm our business or results of operations. Additionally, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of operating our business.
Compliance with US and international data protection laws and regulations could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. Any actual or alleged failure to comply with US or international laws and regulations relating to privacy, data protection, and data security could result in governmental investigations, proceedings and enforcement actions (which could include civil or criminal penalties), private litigation or adverse publicity, harm to our reputation, and could negatively affect our operating results and business. Moreover, clinical trial subjects about whom we or our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information or impose other obligations or restrictions in connection with our use, retention and other processing of information, and we may otherwise face contractual restrictions applicable to our use, retention, and other processing of information. Claims that we have violated individuals' privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.