U.S. states have enacted and are considering enacting laws relating to the protection of personal information (including health and other data of patients, research subjects, and other individuals), which may be more rigorous than, or impose additional requirements beyond those required by, HIPAA. For example, the California Consumer Privacy Act ("CCPA"), which became effective on January 1, 2020, gives California consumers expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA allows for statutory fines for noncompliance (up to $7,500 per violation) as well as a limited private right of action for data breaches, which may increase the volume of data breach litigation. In addition, the California Privacy Rights Act of 2020, which went into effect on January 1, 2023, expanded the CCPA by, among other things, giving California residents the ability to limit use of certain sensitive personal information, establishing restrictions on personal information retention, expanding the types of data breaches subject to the CCPA's private right of action, and establishing a new California Privacy Protection Agency to implement and enforce the new law. Many other privacy and security laws have been proposed at the federal level and in other states, certain of which impose obligations similar to the CCPA, including such laws in Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Further, Washington also has enacted the My Health, My Data Act, which, among other things, provides for a private right of action. While limited exemptions to some of these laws may apply to portions of our business, the recency of these laws' enactment and evolving interpretations of these laws may increase our compliance costs and potential liability. These or other proposed or enacted laws relating to privacy and security could similarly increase our compliance obligations and costs in the future.
We may also become subject to laws and regulations in non-U.S. countries covering privacy and security and the protection of health-related and other personal information. In particular, the European Economic Area ("EEA"), the United Kingdom ("UK"), and Switzerland have adopted privacy and security protection laws and regulations that impose significant compliance obligations. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure, processing, and security of information that identifies or may be used to identify an individual, such as names, contact information, and sensitive personal information such as health data. These laws and regulations are subject to frequent revisions and differing interpretations, and have generally become more stringent over time.
The General Data Protection Regulation 2016/679 ("GDPR") applies to the processing of personal information and imposes many requirements for controllers and processors of personal information, including, for example, higher standards for obtaining consent from individuals to process their personal information, more robust disclosures to individuals and a strengthened individual data rights regime, shortened timelines for data breach notifications, limitations on retention and secondary use of information, increased requirements pertaining to health data and pseudonymized (i.e., key-coded) data and additional obligations when contracting third-party processors in connection with the processing of the personal information. The GDPR allows EEA countries to make additional laws and regulations further limiting the processing of genetic, biometric or health data. Failure to comply with the requirements of the GDPR and the applicable national privacy and security laws of EEA countries may result in fines of up to €20,000,000 or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties; we may also be liable should any individual who has suffered financial or non-financial damage arising from our infringement of the GDPR exercise their right to receive compensation against us. Furthermore, adverse publicity relating to our failure to comply with the GDPR could cause a loss of goodwill, which could have an adverse effect on our reputation, brand, business and financial condition. Additionally, the UK has implemented legislation similar to the GDPR, referred to as the UK GDPR, which provides for fines of up to the greater of £17.5 million or 4% of global turnover.
Certain jurisdictions, including the EEA, have enacted data localization laws and cross-border personal information transfer laws. For example, absent appropriate safeguards or other circumstances, the GDPR and laws in Switzerland and the UK generally restrict the transfer of personal information to countries outside the EEA, Switzerland and the UK, such as the United States. On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. The decision concludes that the United States ensures an adequate level of protection – comparable to that of the European Union – for personal information transferred from the EU to U.S. companies under the framework. Based on this new adequacy decision, personal information can flow from the EU to U.S. companies participating in the EU-U.S. Data Privacy Framework, without having to put in place additional data protection safeguards. While we are not certified under the EU-U.S. Data Privacy Framework, we rely on other data transfer tools such as the EU standard contractual clauses ("EU SCCs") and the UK addendum to the EU SCCs to transfer personal information to third countries outside the EEA and the UK, taking into consideration the enhanced due diligence obligations on data exporters and importers to ensure that the laws of the country to which the personal information is transferred offer a level of data protection that is essentially equivalent to the EEA and the UK. To the extent we transfer personal information from other jurisdictions to the United States, we may not be able to implement or maintain an appropriate data transfer mechanism to continue such international transfers of data. Additionally, the interpretation of data transfer requirements, regulatory guidance and opinions, and other developments relating to cross-border data transfer may require us to implement additional contractual and technical safeguards for any personal information transferred out of the EEA, Switzerland and the UK, or other regions, which may increase compliance costs, lead to increased regulatory scrutiny or liability, and may require additional contractual negotiations, which may adversely impact our business, financial condition, and operating results.
We expect an increase in regulatory and cybersecurity requirements that may apply to our business. For instance, we are taking steps to assess our exposure to the EU NIS2 Directive 2022/2555. The NIS2 Directive requires organizations of a certain size providing certain services, including in the health sector, to adopt appropriate cybersecurity risk-management measures and to report certain cybersecurity incidents. EU countries must apply the requirements of the NIS2 Directive as of October 18, 2024. Failure to comply with the requirements of the NIS2 Directive may result in sanctions, including administrative fines of up to €10,000,000 or 2% of worldwide annual turnover, whichever is greater, for large organizations.
Separate from, and in addition to, requirements under the GDPR and UK GDPR, certification requirements for the hosting of health data will vary by jurisdiction. To the extent we operate in various EEA countries or the UK, there might be other national healthcare regulations or regulatory requirements with which we will be required to comply. For example, France requires hosts of health data to obtain a prior certification with the competent certification body.
The interpretation and application of consumer, health-related and privacy and security laws in the United States, the EEA, Switzerland, the UK and elsewhere are often uncertain, contradictory and in flux. Any failure or perceived failure to comply with federal, state or foreign laws or regulations, contractual or other legal obligations related to privacy or security may result in claims, warnings, communications, requests or investigations from individuals, supervisory authorities or other legal or regulatory authorities in relation to our processing of personal information, and regulatory investigations or other proceedings. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices. If so, this could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. In addition, these privacy regulations vary between states, may differ from country to country, and may vary based on whether testing is performed in the United States or in the local country. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business.