In the ordinary course of our business, we process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data (also referred to as personal information or personally identifiable information under certain data privacy laws) and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, and patient information. Our data processing activities may subject us to numerous data privacy and security obligations, such as various federal, state, and foreign laws, regulations, guidance, industry standards, external and internal privacy and security policies, contracts, and other obligations that govern the processing of personal data by us and on our behalf. We strive to comply with applicable data privacy and security obligations to the extent possible. However, it is possible that these obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules and/or our practices. Any failure or perceived failure by us to comply with applicable privacy and data security laws and regulations, our privacy policies, or our privacy-related obligations to third parties, or any compromise of security that results in the unauthorized access, release or transfer of personal data or other sensitive information, may result in governmental enforcement actions and fines or orders requiring that we change our practices, private litigation (including class action lawsuits), or public statements against us by consumer advocacy groups or others and could cause a loss of trust in us, which could result in significant legal or financial exposure and reputational damage that could potentially have an adverse effect on our business.
In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, and consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act). For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. In addition, we may be subject to various state data privacy and security laws and regulations, including the California Consumer Privacy Act, as amended by the CPRA, which, among other things, requires covered "businesses" to provide specific disclosures to California consumers concerning the collection, sale, and sharing of their personal data, and gives such consumers the right to opt-out of certain sales of personal information. The CPRA provides for civil penalties for violations, as well as a private right of action for certain security breaches that may increase the likelihood of, and the risks associated with, security breach litigation. Additionally, the CPRA created a new state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. Many of the CPRA's provisions became effective on January 1, 2023. Several states in the U.S. have proposed or enacted laws that contain obligations similar to the CPRA that have taken effect or will take effect in coming years. The U.S. federal government also is contemplating federal privacy legislation. The effects of recently proposed or enacted legislation potentially are far-reaching and could increase our potential liability, increase our compliance costs, and adversely affect our business.
Developments in Europe have created compliance uncertainty regarding the processing of personal data from Europe. For example, the European Union's General Data Protection Regulation (EU GDPR), the United Kingdom's GDPR (UK GDPR), and the Swiss Federal Act on Data Protection extend the geographical scope of European data protection laws to non-European entities and impose strict requirements for processing personal data. For example, under the EU GDPR and/or the UK GDPR, government regulators may impose temporary or definitive bans on data processing, as well as possible fines of up to 4% of global annual turnover for the preceding financial year or €20 million, whichever is higher, for the most serious infringements. This exposes us to two parallel sets of regulations, each of which potentially authorizes similar fines and other potentially divergent enforcement actions for certain violations. Further, individuals or consumer protection organizations authorized at law to represent their interests may initiate litigation related to the processing of individuals' personal data.
In the ordinary course of our business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. The EU GDPR and UK GDPR prohibit the transfer of personal data to countries outside of the EEA, or the UK including the United States, that have not been deemed adequate by the European Commission or by the UK data protection regulator, respectively. Switzerland has adopted similar restrictions. Although there are legal mechanisms that allow for the transfer of personal data from the EEA, UK, and Switzerland to the United States, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. For example, legal developments in the EU have created complexity and uncertainty regarding such transfers and data protection authorities from the different EU Member States may interpret the EU GDPR differently. Additionally, guidance on implementation and compliance practices are often updated or otherwise revised, which adds to the complexity of processing personal data in the EU. These transfer mechanisms have also been subject to various legal challenges. In particular, on July 16, 2020, the Court of Justice of the European Union, in the case of Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (Case C-311/18) (Schrems II), invalidated the EU-U.S. Privacy Shield Program for transfers of personal data from the EU to the U.S., and added further uncertainty and complexity to the use of standard contractual clauses as a compliance mechanism for transfers of personal data outside the EU.
If there is no lawful manner for us to transfer personal data from the EEA, UK, or Switzerland to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third-parties, which could limit our ability to conduct clinical trial activities in Europe or elsewhere, and injunctions against our processing or transferring of personal data necessary to operate our business.
In addition to the EU, UK, and Switzerland, a growing number of other global jurisdictions are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of our business. Some of these laws, such as the General Data Protection Law in Brazil, or the Act on the Protection of Personal Information in Japan, impose similar obligations as those under the EU GDPR and UK GDPR. Others, such as those in Russia, India, and China, could potentially impose more stringent obligations, including data localization requirements. If we are unable to meet these evolving legal requirements or if we violate or are perceived to violate any laws, regulations, or other obligations relating to privacy, data protection, or information security, we may experience harm to our reputation and become subject to investigations, claims, and other remedies, which could expose us to significant fines, penalties, and other damages, all of which would harm our business.