In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share confidential, proprietary, and sensitive information, including personal information, business data, trade secrets, intellectual property, information we collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information.
These activities may subject us to numerous data privacy and security obligations governing the collection, use, disclosure, protection, and other processing of personal data, such as various laws, regulations, guidance, industry standards, external and internal data privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.
In the United States, there are both state and federal data privacy and security laws, including data breach notification laws, data privacy laws (including biometric privacy laws), consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), the Health Insurance Portability and Accountability Act ("HIPPA"), and other similar laws (e.g., wiretapping laws). For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the "CCPA") applies to personal data of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and certain rights to California residents with respect to their personal data. The CCPA provides for civil penalties of up to $7,500 per intentional violation and $2,500 per unintentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages.
Outside the United States there are additional laws, regulations, and industry standards governing data privacy and security. For example, the General Data Protection Regulation ("GDPR") and the GDPR as incorporated into UK law pursuant to the European Union (Withdrawal) Act 2018 (the "UK GDPR") impose strict requirements for processing personal data, including health-related information. Under the GDPR and UK GDPR, companies may face fines of up to 20 million Euros or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data. In addition, the GDPR and UK GDPR impose specific restrictions on the transfer of personal data to countries outside of the EEA and UK. Although there are currently various mechanisms that may be used to make such transfers in compliance with law, such as the EEA and UK's standard contractual clauses, these mechanisms are subject to legal challenges. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions are subject to scrutiny from regulators, individual litigants, and activities groups.
Preparing for and complying with these obligations requires us to devote resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf.
If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims); additional reporting requirements and/or oversight; bans on processing personal data; and orders to destroy or not use personal data. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.