In the course of our operations, we collect, use, store, disclose, transfer and otherwise process an increasing volume of sensitive, and personal information including detailed recordings of MRI and MRS results from patients as well as information from our employees and third parties with whom we conduct business. The collection, use, storage, disclosure, transfer and other processing of personal information is increasingly subject to a wide array of federal, state and foreign laws, rules, regulations, and standards regarding data privacy and security including comprehensive laws of broad application, such as the CCPA and the GDPR, that are intended to protect the privacy of personal information that is collected, used, stored, disclosed, transferred or otherwise processed in or from the governing jurisdiction. As we seek to expand our business, we are, and may increasingly become, subject to various laws, rules, regulations and standards, as well as contractual obligations, relating to data privacy and security in the jurisdictions in which we operate or in the jurisdictions where our patients may be. When conducting clinical studies, we face risks associated with collecting trial participants' data, especially health data, in a manner consistent with applicable laws and regulations, such as GCP guidelines or FDA human subject protection regulations.
In many cases, these laws, rules, regulations and standards apply not only to third-party transactions, but also to transfers of information between or among us, any of our affiliates and other parties with whom we conduct business. These laws, rules, regulations and standards may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that may harm our business, financial condition and results of operations. The regulatory framework for data privacy and security worldwide is continuously evolving and developing and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future.
We are subject to many diverse laws and regulations relating to data privacy and security. In the United States, various federal and state regulators have adopted, or are considering adopting, laws and regulations concerning personal information and data security. Additionally, our customers may be subject to additional federal and state privacy and security laws, rules, regulations and standards, including HIPAA, that they may require us to comply with through contractual obligations. This patchwork of legislation and regulation may give rise to conflicts or differing views of personal privacy rights. For example, certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than federal, foreign or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. Additionally, new privacy rules are being enacted in the United States and globally, and existing ones are being updated and strengthened. The CCPA regulates the processing of personal information of California residents and increases the privacy and security obligations of covered companies handling such personal information. The CCPA requires covered companies to, amongst other things, provide new and additional disclosures to California consumers and provide such consumers new data protection and privacy rights, including the ability to access their personal information and opt out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. The CCPA was amended in September 2018 and November 2019, and it is possible that further amendments will be enacted, but even in its current form it remains unclear how various provisions of the CCPA will be interpreted and enforced. Moreover, a new privacy law, the California Privacy Rights Act, ("CPRA") a consumer privacy ballot initiative that amends and expands the CCPA, was recently passed. The CPRA affords California residents significantly more control over their personal information, imposes heightened compliance obligations on covered companies, and establishes a new enforcement agency dedicated to consumer privacy. The CPRA's substantive provisions become effective January 1, 2023, and new regulations are expected to be introduced by July 1, 2022. While aspects of the CPRA and its interpretation remain to be determined in practice, they create further uncertainty and may result in additional costs and expenses in an effort to comply. Further, all 50 states have passed laws regulating the actions that a business must take if it experiences a data breach, such as prompt disclosure to affected customers. In addition to data breach notification laws, some states have enacted statutes and rules requiring businesses to reasonably protect certain types of personal information they hold or to otherwise comply with certain specified data security requirements for personal information. We are also subject to the supervisory and enforcement authority of the Federal Trade Commission with regard to the collection, use, sharing, and disclosure of certain data collected from or about individuals. State laws are changing rapidly and there is discussion in Congress of a new federal data protection and privacy law to which we would become subject if it is enacted. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, divert resources from other initiatives and projects, and could restrict the way products and services involving data are offered, all of which may harm our business, financial condition and results of operations.
In the event we expand our operations internationally, we may become subject to additional foreign data privacy and security laws, rules, regulations, requirements, and standards, which in the European Union, for instance, have been significantly reformed. On May 25, 2018, the General Data Protection Regulation ("GDPR") entered into force and became directly applicable in all European Union member states. The GDPR implements more stringent operational requirements than its predecessor legislation. For example, the GDPR requires companies to make more detailed disclosures to data subjects, requires disclosure of the legal basis on which companies can process personal data, makes it harder for companies to obtain valid consent for processing, requires the appointment of data protection officers when sensitive personal data, such as health data, is processed on a large scale, provides more robust rights for data subjects, introduces mandatory data breach notification through the European Union, imposes additional obligations on companies when contracting with service providers and requires companies to adopt appropriate privacy governance including policies, procedures, training and data audits. The GDPR permits data protection authorities to impose large penalties for violations of the GDPR, including potential fines of up to €20 million or four percent of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. If we become subject to the GDPR and do not comply with our obligations under the GDPR, we could be exposed to significant fines. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. In addition, we may be the subject of litigation or adverse publicity, which could negatively affect our business, financial condition and results of operations.
We expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, rules, regulations and standards may have on our business. New laws, amendments to or re-interpretations of existing laws, regulations, standards and other obligations may require us to incur additional costs and restrict our business operations. Because the interpretation, scope, and application of laws, regulations, standards and other obligations relating to data privacy and security are still uncertain, it is possible that these laws, regulations, standards and other obligations may be interpreted and applied in a manner that is inconsistent with our data processing practices and policies or the features of our products and services. If so, in addition to the possibility of fines, lawsuits, regulatory investigations, public censure, other claims and penalties, and significant costs for remediation and damage to our reputation, we could be materially and adversely affected if legislation or regulations are expanded to require changes in our data processing practices and policies or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively impact our business, financial condition and results of operations. We may be unable to make such changes and modifications in a commercially reasonable manner, or at all. In addition to government regulation, privacy advocates and industry groups have and may in the future propose self-regulatory standards from time to time. These and other industry standards may legally or contractually apply to us, or we may elect to comply with such standards. Any inability to adequately address data privacy or security-related concerns, even if unfounded, or to comply with applicable laws, regulations, standards and other obligations relating to data privacy and security, could result in additional cost and liability to us, harm our reputation and brand, damage our relationships with consumers and harm our business, financial condition and results of operations.
We make public statements about our use and disclosure of personal information through our privacy policies, information provided on our website and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide promises and assurances about data privacy and security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices. Any concerns about our data privacy and security practices, even if unfounded, could damage the reputation of our business and harm our business, financial condition and results of operations.
Complying with these numerous, complex and often changing laws, rules, regulations, and standards is expensive and difficult. Any failure or perceived failure by us or our service providers to comply with our posted privacy policies or with any applicable or potentially applicable federal or state laws, rules, regulations, standards, certifications or orders relating to data privacy, security or consumer protection, or any compromise of security that results in the theft, unauthorized access, acquisition, use, disclosure, or misappropriation of personal information or other user data, could result in significant fines or penalties, negative publicity or proceedings or litigation by governmental agencies or consumers, including class action privacy litigation in certain jurisdictions, which would subject us to significant awards, penalties or judgments, one or all of which could require us to change our business practices or increase our costs and could materially and adversely affect our business, financial condition and results of operations. In addition, if our practices are not consistent, or viewed as not consistent, with applicable legal and regulatory requirements, including changes in laws, regulations and standards or new interpretations or applications of existing laws, regulations and standards, we may also become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, criminal or civil sanctions, all of which may harm our business, financial condition and results of operations.