We are required to comply with stringent, complex and frequently evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to data privacy and security. Ensuring that our collection, use, transfer, storage and other processing of personal information complies with such requirements can increase operating costs, impact the development of new products or services, and reduce operational efficiency.
Internationally, virtually every jurisdiction in which we operate has established its own data privacy and security legal framework with which we must comply. For example, we are required to comply with the European Union (EU) General Data Protection Regulation (GDPR), which became effective on May 25, 2018. The EU GDPR imposes stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data of individuals within the EU and European Economic Area (EEA). EU member states may also impose additional requirements in relation to personal data through their national implementing legislation.
The EU GDPR also imposes specific restrictions on the transfer of personal data to countries outside of the EU and EEA, including the use of appropriate safeguards to enable such transfers, such as Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF). The EU-US DPF was adopted in July 2023 and provides US-based organizations who self-certify with a reliable mechanism for personal data transfers from the EU, United Kingdom, and Switzerland. Although these mechanisms are currently valid for purposes of transferring personal data, they could be subject to legal challenges and there is no assurance that we could satisfy or rely on these measures to lawfully transfer personal data. If we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. While we have implemented controls and procedures to comply with the requirements of the EU GDPR, such procedures and controls may not be effective in ensuring compliance or preventing unauthorized transfers of personal data. Additionally, we are subject to the privacy and data protection laws of the UK, including the UK Data Protection Act of 2018 (UK GDPR). Similar to the EU GDPR, the UK GDPR imposes restrictions on the processing of personal data, as well as transfers of personal data from the UK to other countries. Failure to comply with the EU and/or the UK GDPR can result in significant fines and other liability.
Moreover, China adopted the Personal Information Protection Law (PIPL) and Data Security Law (DSL) in 2021, which promulgated national privacy and security requirements relating to the collection, processing, transfer and security of personal information in or from China. Violations of the PIPL or DSL could result in fines and penalties, suspension of data transfers, cancellation of business authorizations, personal liability for responsible company officers, as well as criminal and civil liability. In the event that the PIPL requires us to store data in China, or limits our ability to transfer data across borders, we may experience increased costs and business inefficiencies. Fines, corrective actions, or other penalties asserted due to alleged noncompliance may impose additional financial or operational costs, limit our ability to attract and retain local talent, or limit our ability to do business in China.
In the US, there are numerous federal and state data privacy and security laws, rules, and regulations governing the collection, use, disclosure, retention, security, transfer, storage and other processing of personal information, including federal and state data privacy laws, data breach notification laws, and data disposal laws. For example, at the federal level, we are subject the regulations of the Federal Trade Commission, which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to data privacy and security. If our public statements about our use, collection, disclosure and other processing of personal information are alleged to be deceptive, unfair or misrepresentative of our actual practices, we may be subject to potential government or legal investigation or action. If we are found to have violated applicable laws or regulations, we may also be subject to penalties, fines, damages, injunctions or other outcomes that may adversely affect our operations and financial results. The United States Congress also has considered, and may in the future consider, various proposals from time to time for comprehensive federal data privacy legislation to which we may become subject if passed and which may adversely affect our operations and financial results.
At the state level, we are subject to laws and regulations like the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). The CCPA and CPRA create transparency requirements for companies, grant California residents various rights with regard to their personal information, and impose additional data protection obligations on companies doing business in California. Failure to comply with the CCPA and CPRA may result in, among other things, significant civil penalties and injunctive relief, or potential statutory or actual damages. The CCPA and CPRA also provide a private right of action for data breaches that result in the loss of personal information. The CCPA and CPRA may impact our business activities and require compliance costs that adversely affect business, operating results, prospects and financial condition. These state statutes, and other similar state or federal laws that may be enacted in the future may require us to modify our data processing practices and policies, incur substantial compliance-related costs and expenses, and otherwise suffer adverse impacts on our business.
Additionally, while collecting research products from donors, we may collect, use, disclose, maintain and transmit donor information in ways that will be subject to many of the numerous state, federal and international laws and regulations governing the collection, use, disclosure, storage, transmission or confidentiality of patient-identifiable health information.
We have made changes to, and investments in, our business practices and will continue to monitor developments and make appropriate changes to help attain compliance with these evolving and complex laws, rules, regulations and standards. Any actual or perceived failure to comply with any such laws, rules, regulations, standards or contractual obligations could subject us to denial of the right to conduct business, significant fines, civil or criminal penalties, costly litigation (including class actions), government investigation or inquiries, enforcement actions, claims, proceedings, judgements, awards, penalties, sanctions or other adverse impacts that could have a material adverse effect on our business.