Privacy and data security have become significant issues in the U.S., E.U. and in many other jurisdictions where we may in the future conduct our operations. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues, which may affect our business and may increase our compliance costs and exposure to liability. As we receive, collect, process, use and store personal and confidential data, we are or may be subject to diverse laws and regulations relating to data privacy and security. Compliance with these privacy and data security requirements is rigorous and time-intensive and may increase our cost of doing business, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm, which could materially and adversely affect our business, financial condition and results of operations.
In the U.S., we may be subject to data privacy and security regulation by both the federal government and the states in which we conduct our business. HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, or collectively, HIPAA, impose, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information held by covered entities and their business associates. We may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA.
In addition, state laws govern the privacy and security of health-related and other personal information in certain circumstances, many of which differ from each other in significant ways and may not have the same requirements, thus complicating compliance efforts. By way of example, California enacted the California Consumer Privacy Act, or CCPA, effective January 1, 2020, which gives California residents expanded rights to access, correct, and delete their personal information, opt out of certain personal information sharing and disclosure, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with, data breach litigation. The CCPA may increase our compliance costs and potential liability. Further, the California Privacy Rights Act, or CPRA, generally went into effect on January 1, 2023, and significantly amends the CCPA. The CPRA imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also creates a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement, and additional compliance investment and potential business process changes may be required. Similar laws have passed in Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia, and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. Further states have also enacted consumer health date privacy laws, including states without comprehensive consumer privacy laws, such as Nevada and Washington state. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.
In the European Economic Area, or EEA, the General Data Protection Regulation, or GDPR, imposes stringent requirements for controllers and processors of personal data, including, for example, high standards for obtaining consent from individuals to process their personal data, robust disclosures to individuals and a strong individual data rights regime, short timelines for data breach notifications, limitations on retention and secondary use of information, significant requirements pertaining to health data and pseudonymized (i.e., key-coded) data and obligations when we contract third-party processors in connection with the processing of the personal data. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States; in July 2020, the Court of Justice of the European Union, or CJEU, invalidated the EU-US Privacy Shield Framework, or Privacy Shield, under which personal data could be transferred from the EEA to US entities who had self-certified under the Privacy Shield scheme and imposed further restrictions on the use of standard contractual clauses, or SCCs. In March 2022, the US and EU announced a new regulatory regime intended to replace the invalidated regulations with the Trans-Atlantic Data Privacy Framework, or EU-U.S. DPF. In July 2023, the European Commission adopted an adequacy decision in relation to the EU-U.S. DPF, allowing the EU-U.S. DPF to be utilized as a means of legitimizing EU-U.S. personal data transfers for participating entities. The EU-U.S. DPF may be subject to legal challenges from privacy advocacy groups or others, and the European Commission's adequacy decision regarding the EU-U.S. DPF provides that the EU-U.S. DPF will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/ or start taking enforcement action, we could suffer additional costs, complaints and/ or regulatory investigations or fines, and/ or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.
Additionally, from 1 January 2021, we have been subject to the GDPR and also the UK GDPR which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, e.g. fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. As we continue to expand into other foreign countries and jurisdictions, we may be subject to additional laws and regulations that may affect how we conduct business.
Compliance with U.S. and foreign data privacy and security laws, rules and regulations could require us to take on more onerous obligations in our contracts, require us to engage in costly compliance exercises, restrict our ability to collect, use and disclose data, or in some cases, impact our or our partners' or suppliers' ability to operate in certain jurisdictions. Each of these constantly evolving laws can be subject to varying interpretations. If we fail to comply with any such laws, rules or regulations, we may face government investigations and/or enforcement actions, fines, civil or criminal penalties, private litigation or adverse publicity that could adversely affect our business, financial condition and results of operations.