The integrity and protection of our own data, and that of our customers and employees, is critical to our business. The regulatory environment governing information, security and privacy laws is increasingly demanding and continues to evolve. Implementing and maintaining compliance with applicable security and privacy regulations may increase our operating costs and/or adversely impact our ability to market our products and services to customers. Although our computer and communications hardware are protected through physical and software safeguards, they are still vulnerable to fire, storm, flood, power loss, earthquakes, telecommunications failures, physical or software break-ins, software viruses, and similar events. Furthermore, the increase in remote working may also result in additional consumer privacy, IT security, and fraud-related risks. These events could lead to the unauthorized access, disclosure, and use of non-public information.
We could be subject to risks caused by misappropriation, misuse, leakage, falsification, system malfunction or intentional or accidental release or provision of access to or loss of information maintained in our information systems and networks and those of our third-party suppliers. The contractors, consultants, business partners, and/or other third parties that we work with may not maintain the same high-quality physical and software safeguards and information and technology systems and controls to prevent cyber security threats that we maintain. Further, these third parties may be vulnerable to breakdown, intrusions, or other damage or interruption from service interruptions, system malfunctions, natural disasters, terrorism, cyberattack, and telecommunication and electrical failures, as well as security breaches from their own inadvertent or intentional actions. For example, in the year ended December 31, 2022, one of our contractors mistakenly posted the application programming interface ("API") credentials of some of Abcam's commercial production and business environments in a public workspace. As a result, there was the potential for an unauthorized third party with knowledge of how to use such API credentials to gain access to sensitive information. While we reported the incident and notified those that could have been affected, we have no evidence to suggest that our systems or any such information was accessed by any unauthorized third party, but we cannot guarantee that such incidents will not have an impact in the future. Furthermore, any companies we acquire may not maintain the same high-quality physical and software safeguards and information and technology systems and controls to prevent cyber security threats that we maintain. There may also be pre-existing cybersecurity incidents or risks that we failed or were unable to discover or identify in the course of performing due diligence investigations of target businesses. In addition, the techniques used by criminal elements to attack computer systems are sophisticated, change frequently and may originate from less regulated and remote areas of the world. As a result, we may not be able to address these techniques proactively or implement adequate preventative measures. We are also reliant on the quality of our training of employees to allow them to spot and appropriately respond to cyber security threats.
We have been subject to a number of actual and attempted cyber-attacks such as through phishing scams and require employees to remain vigilant to ensure that such attempts are unsuccessful. Although none of these actual or attempted cyber-attacks has had a material adverse impact on our operations or financial condition, we cannot guarantee that any such incidents will not have such an impact in the future. If our computer systems are compromised, we could be subject to fines, damages, litigation and enforcement actions, customers could curtail or cease using its applications, and we could lose trade secrets, the occurrence of which could harm our business. If we are unable to maintain reliable information technology systems and appropriate controls with respect to global data privacy and security requirements and prevent data breaches, we may suffer regulatory consequences in addition to business consequences. As a global organization, we are subject to data privacy and security laws, regulations, and customer-imposed controls in numerous jurisdictions as a result of having access to and processing confidential, personal and/or sensitive data in the course of our business. There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. In particular, regulations promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") establish privacy and security standards that limit the use and disclosure of individually identifiable health information (known as "protected health information") and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can require complex factual and statistical analyses and may be subject to changing interpretation. Although we take measures to protect sensitive data from unauthorized access, use or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or breached due to employee error, malfeasance or other malicious or inadvertent disruptions. Any such breach or interruption could compromise our networks, and the information stored there could be accessed by unauthorized parties, manipulated, publicly disclosed, lost or stolen. Any such access, breach or other loss of information could result in legal claims or proceedings and liability under federal or state laws that protect the privacy of personal information, such as the HIPAA and the Health Information Technology for Economic and Clinical Health Act and may result in regulatory penalties. Notice of breaches must be made to affected individuals, the United States Department of Health and Human Services ("HHS"), and for extensive breaches, notice may need to be made to the media or state Attorneys General. Such a notice could harm our brand and reputation and adversely affect our ability to compete.
Additionally, the Gramm-Leach-Bliley Act of 1999 (along with its implementing regulations) (the "GLBA") restricts certain collection, processing, storage, use and disclosure by covered companies of certain personal information, requires notice to individuals of privacy practices and provides individuals with certain rights to prevent the use and disclosure of certain non-public or otherwise legally protected information. The GLBA also imposes requirements regarding the safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. In addition, many U.S. states in which we operate now or may operate in the future have laws that protect the privacy and security of sensitive and personal information. Certain U.S. state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, the California Consumer Privacy Act of 2018 (the "CCPA"), which went into effect on January 1, 2020, imposes stringent data privacy and security requirements and obligations with respect to the personal information of California residents and households. Among other things, it requires covered companies to provide new disclosures to California consumers and provide such consumers new data protection and privacy rights, including the ability to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information that may increase the likelihood of, and risks associated with, data breach litigation. It remains unclear how various provisions of the CCPA will be interpreted and enforced, and multiple states have enacted or are expected to enact similar laws. The effects of the CCPA and other similar state laws on our business are potentially significant and may require us to modify our data processing practices and policies and to incur costs and expenses in an effort to comply. State laws are changing rapidly, and there is discussion in U.S. Congress of a new federal data protection and privacy law to which we may be subject.
In Europe, laws, regulations, and standards in many jurisdictions apply broadly to the collection, use, retention, security, disclosure, transfer and other processing of personal information. For example, in the European Economic Area (the "EEA"), the collection and use of personal data is governed by the provisions of the General Data Protection Regulation (the "GDPR"). The GDPR came into effect in May 2018, superseding the European Union Data Protection Directive and imposing more stringent data privacy and security requirements on companies in relation to the processing of personal data of European Union ("EU") data subjects. The GDPR, together with national legislation, regulations and guidelines of EU member states govern the processing of personal data, impose strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer, and otherwise process personal data. In particular, the GDPR includes obligations and restrictions concerning the consent and rights of individuals to whom the personal data relates; providing detailed disclosures about how personal data is collected and processed (in a concise, intelligible and easily accessible form); demonstrating that an appropriate legal basis is in place or otherwise exists to justify data processing activities; granting rights for data subjects in regard to their personal data (including data access rights, the right to be "forgotten" and the right to data portability); introducing the obligation to notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches; imposing limitations on retention of personal data; maintaining a record of data processing; and complying with the principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit.
Fines for certain violations of the GDPR are significant. e.g., up to 4.0% of a company's global annual revenue or €20 million, whichever is greater. Such fines are in addition to any civil litigation claims by customers and data subjects. European data protection authorities may interpret the GDPR and national laws differently and` impose additional requirements, which contributes to the complexity of processing personal data in or from the EEA. Guidance on implementation and compliance practices is often updated or otherwise revised. From January 1, 2021, we are subject to the GDPR and also the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, e.g. fines up to the greater of €20.0 million / £17.5 million or 4.0% of global turnover.
We are also subject to EU and United Kingdom rules with respect to cross-border transfers of personal data out of the EEA and the United Kingdom, respectively. Recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA and the United Kingdom to the United States. Most recently, on July 16, 2020, the Court of Justice of the European Union ("CJEU") invalidated the EU-US Privacy Shield Framework ("Privacy Shield") under which personal data could be transferred from the EEA to US entities who had self-certified under the Privacy Shield scheme.
While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. Use of the standard contractual clauses must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place. The European Commission has published revised standard contractual clauses for data transfers from the EEA: the revised clauses have been mandatory for relevant transfers since September 27, 2021; existing standard contractual clauses arrangements must be migrated to the revised clauses by December 27, 2022. The United Kingdom's Information Commissioner's Office has published new data transfer standard contracts for transfers from the UK under the UK GDPR. This new documentation will be mandatory for relevant data transfers from September 21, 2022; existing standard contractual clauses arrangements must be migrated to the new documentation by March 21, 2024.
Several other countries, such as China and Russia, have also passed laws that require personal data relating to their citizens to be maintained on local servers and impose additional data transfer restrictions, which could increase the cost and complexity of delivering our products and services.
We are also reliant on certain manual processes for collecting and processing data, and any failures in these processes or failure to handle the data collected in accordance with relevant regulations could lead to enforcement actions. Complying with all applicable laws, regulations, standards, and obligations relating to data privacy, security and transfers may cause us to incur substantial operational costs or require us to modify our data processing practices and processes. Government enforcement actions can be costly and interrupt the regular operation of our business, and data breaches or violations of data privacy laws can result in significant fines, reputational damage, and civil lawsuits, any of which may adversely affect our business, financial condition and results of operations. We may not be able to respond quickly or effectively to regulatory, legislative, and other developments, and these changes may in turn impair our ability to commercialize our products or increase our cost of doing business. In addition, if our practices are not consistent or viewed as not consistent with legal and regulatory requirements, including changes in laws, regulations and standards or new interpretations or applications of existing laws, regulations, and standards, we may become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, loss of export privileges, severe criminal or civil sanctions or reputational damage. Any of the foregoing could have an adverse effect on our competitive position, business, financial condition, results of operations and prospects.