The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention and security of personal data, such as information that we may collect in connection with clinical trials. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. Complying with these numerous, complex and often changing regulations is expensive and difficult, and any failure or perceived failure to comply with any data privacy laws or security laws, our policies and procedures, our contracts governing our processing of personal information or any security incident or breach involving the misappropriation, loss or other unauthorized use or disclosure of sensitive or confidential patient or consumer information, whether by us, one of our partners or another third-party, could adversely affect our business, financial condition and results of operations, and could result in negative publicity, government investigations and enforcement actions, claims by third-parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business.
As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. In the U.S., HIPAA imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Certain states have also adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA.
Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, California enacted the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business's collection, use, and disclosure of their personal information, (ii) receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt out of certain disclosures of their personal information, and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business's behalf. Additional compliance investment and potential business process changes may be required. Similar laws have passed in other states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected by HIPAA, the CCPA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.
Furthermore, the Federal Trade Commission ("FTC"), has authority to initiate enforcement actions against entities that make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information or engage in other unfair practices that harm customers or that may violate Section 5(a) of the FTC Act. Even when HIPAA or a state law does not apply, according to the FTC, violating consumers' privacy rights or failing to take appropriate steps to keep consumers' personal information secure may constitute unfair and/or deceptive acts or practices in violation of Section 5(a) of the FTC Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Additionally, federal and state consumer protection laws are increasingly being applied by FTC and states' attorneys general to regulate the collection, use, storage, and disclosure of personal or personally identifiable information, through websites or otherwise, and to regulate the presentation of website content.
In 2024, the National Security Division of the U.S. Department of Justice (the "DOJ") issued a new rule – referred to as the "Data Security Program" ("DSP") – to implement Executive Order 14117 aimed at preventing access to "bulk U.S. sensitive personal data" and "government-related data" by "countries of concern" (including China, Russia, Iran, North Korea, Cuba, and Venezuela) and "covered persons" (as all such terms are defined in the DSP). Effective as of April 8, 2025, and fully enforceable as of July 9, 2025, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts "covered data transactions" that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any amount of government-related data. The DSP is new, complex and has yet to be enforced, and as such, there is a risk that our interpretation of its applicability, scope, and requirements is incorrect, incomplete, or misapplied. Compliance with the DSP may require us to invest heavily in data security and compliance measures, such as implementing and complying with the Cybersecurity and Infrastructure Security Agency's guidelines and other burdensome recordkeeping, reporting, and auditing requirements. It may also require us to implement new processes, stop or restrict certain data transfers, alter the geographic scope of our operations, cease doing business with certain third parties or using certain tools or vendors, or change how data flows throughout our business, any of which could materially impact our business operations or hinder our ability to grow our business. Finally, non-compliance with the DSP could result in significant civil or criminal penalties, which could materially adversely affect our business, results of operations, and financial condition.
In Europe, the General Data Protection Regulation (the "EU GDPR") and in the United Kingdom the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (the "UK GDPR" and together with the EU GDPR, referred to as the "GDPR"), impose comprehensive data privacy compliance obligations in relation to our processing of personal data of individuals within the European Economic Area ("EEA"), including clinical trial data, or in the context of our activities within the EEA, including a principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit, as well as regulating cross-border transfers of personal data out of the EEA and the UK. If we do not comply with our obligations under the GDPR, we could be exposed to fines under both the EU GDPR and UK GDPR of up to the greater of €20 million/ GBP 17.5 million or up to 4% of our total global annual revenue in the event of a significant breach. In addition, we may be the subject of litigation and/or adverse publicity, which could adversely affect our business, results of operations and financial condition.
Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA, and the United States remains uncertain. Case law from the Court of Justice of the European Union ("CJEU"), states that reliance on the standard contractual clauses - a standard form of contract approved by the EC as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. In relation to such cross-border transfers of personal data, we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue, and international transfers to the United States, China, and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR and/or take additional compliance and operational measures; and/or it could otherwise affect the manner in which we operate our business, and could adversely affect our business, operations and financial condition.
Relatedly, from January 1, 2021, companies have had to comply with both the GDPR and the UK GDPR, the latter regime having the ability to separately fine up to the greater of £17.5 million or 4% of global turnover.
Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, collaborators or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage our reputation and adversely affect our business and results of operations. Further, we cannot assure you that our third-party service providers with access to our or our customers', suppliers', trial patients', and employees' personally identifiable and other sensitive or confidential information in relation to which we are responsible will not breach contractual obligations imposed by us, or that they will not experience data security breaches or attempts thereof, which could have a corresponding effect on our business including putting us in breach of our obligations under privacy laws and regulations and/or which could in turn adversely affect our business, results of operations and financial condition. In addition, if our practices are not consistent, or viewed as not consistent, with legal and regulatory requirements, including changes in laws, regulations and standards or new interpretations or applications of existing laws, regulations and standards, we may also become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, criminal or civil sanctions, all of which may harm our business, financial condition and results of operations.