In the ordinary course of business we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive and confidential information, including proprietary and confidential business data, trade secrets, intellectual property, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, and employee data (collectively, sensitive data). Our data processing activities actually or may subject us to numerous privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. Data privacy and security obligations are stringent and changing, with new data privacy and security laws being proposed or enacted. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. The laws and regulations that may affect our ability to operate include, but may not be limited to:
- the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 and its implementing regulations ("HIPAA"), which imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Most healthcare providers, including research institutions from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA. We do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties. Depending on the facts and circumstances, however, we could be subject to significant administrative, civil and criminal penalties if we obtain, use or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA;- the California Consumer Privacy Act of 2018 ("CCPA"), which requires covered businesses to provide certain disclosures in privacy notices to California residents, including consumers, business representatives, and employees, and requires businesses honor certain requests of California residents to exercise certain privacy rights. The CCPA provides for administrative fines of up to $7,500 per intentional violation, as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with data breach litigation. Although there are limited exemptions for clinical trial data under the CCPA, the CCPA and other similar laws may impact our business activities depending on how it is interpreted. Further, the amendments to the CCPA expanded the CCPA's requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency to implement and enforce the law. Additional compliance investment and potential business process changes may be required. Similar laws have been passed in other states and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging; and - foreign data protection laws, including the European Union's General Data Protection Regulation ("EU GDPR") and the United Kingdom GDPR ("UK GDPR"), which contain provisions specifically directed at the processing of health data and, more broadly, imposes significant and complex compliance burdens on processing personal data. Under the EU and UK GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines for noncompliance of up to €20 million under the EU GDPR (£17.5 million under the UK GDPR) or 4% of annual global revenue of the noncompliance company, whichever is greater. Noncompliance with the EU and UK GDPR could also result in private litigation related to the processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. These laws such as the EU and UK GDPR impose numerous requirements for the collection, use, storage and disclosure of personal data of data subjects, including requirements relating to providing notice to and obtaining consent from data subjects, personal data breach notification, cross-border transfers of personal data, and honoring and providing for the rights of individuals in relation to their personal data, including the right to access, correct and delete their data. Among other requirements, the EU and UK GDPR regulate transfers of personal data subject to the EU and UK GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EU and the United States remains uncertain.
Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA's standard contractual clauses, the UK's International Data Transfer Agreement /
Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States or other relevant countries. If there were no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal data out of Europe for allegedly violating the EU GDPR's cross-border data transfer limitations. Moreover, failure or perceived failure to comply with the EU GDPR and/or the UK GDPR, and other countries' privacy or data security-related laws, rules or regulations could result in significant regulatory penalties and fines and affect our compliance with contracts entered into with our partners, collaborators and other third parties.
In addition to data privacy and security laws, clinical trial subjects about whom we or any of our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information. Claims that we have violated individuals' privacy rights, failed to comply with data protection laws or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend and could result in adverse publicity that could materially and adversely affect our business, financial condition, results of operations and prospects. We also publish policies, marketing materials, and other statements regarding data privacy and security and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.
Although we work to comply with applicable privacy and data security laws, regulations and standards, contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Compliance with these data protection obligations could require us to take on more onerous obligations in our contracts, require us to engage in costly compliance exercises, restrict our ability to collect, use, disclose and otherwise process personal data, or in some cases, impact our or our partners' or suppliers' ability to operate in certain jurisdictions. Any actual or perceived failure to comply by us or our personnel, representatives, contractors, consultants, collaborators, or other third parties could result in government investigations and/or enforcement actions, fines, civil or criminal penalties, additional reporting requirements and/or oversight, bans on processing personal data (including clinical trial data), orders to destroy or not use personal data, private litigation (including class claims) or adverse publicity and could otherwise negatively affect our results of operations and business.