In the course of our operations, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share sensitive, confidential, and proprietary information, including personal information, business data, trade secrets, intellectual property, and sensitive third-party data. Accordingly, we are, and may increasingly become, subject to various data privacy and security laws, the number and scope of which are changing, subject to differing applications and interpretations, may be inconsistent among jurisdictions, and may conflict with each other.
In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy and security laws, and consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information. As applicable, such rights may include the right to access, correct, or delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal information, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (the "CCPA") applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain rights related to their personal information. The CCPA allows for statutory fines for noncompliance (up to $7,988 per intentional violation) and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other U.S. comprehensive privacy laws exempt some data processed in the context of clinical trials, but these developments increase compliance costs and potential liability with respect to other personal information we maintain about residents in these states.
Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more jurisdictions to pass similar laws in the future. If we become subject to new data privacy and security laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase (including individuals via a private right of action and state actors), increasing legal risk and compliance costs for us and the third parties with whom we work.
Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union's General Data Protection Regulation ("EU GDPR") and the United Kingdom's General Data Protection Regulation ("UK GDPR") (collectively, "GDPR") impose strict requirements for processing the personal information of individuals located, respectively, within the European Economic Area ("EEA") and the United Kingdom ("UK"). For example, violations of the GDPR can result in temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros (£17.5 million for the UK GDPR) or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In Europe, the Network and Information Security Directive ("NIS2") regulates resilience and incident response capabilities of entities operating in a number of sectors, including the health sector. Non-compliance with NIS2 may lead up to administrative fines of a maximum of 10 million Euros or up to 2% of the total worldwide revenue of the preceding fiscal year. Other countries outside of Europe have enacted or are considering enacting similar comprehensive data privacy and security laws and regulations, which could increase the cost and complexity of delivering our services and operating our business. For example, China's Personal Information Protection Law ("PIPL") broadly regulates data privacy and security practices and imposes strict requirements for processing personal information. As another example, Canada has enacted the Personal Information Protection and Electronic Documents Act and Canada's Anti-Spam Legislation, which broadly regulate the processing of personal information and impose compliance obligations and penalties comparable to those of European data privacy and security laws. Complying with these and other similar laws and regulations (to the extent applicable) causes us to incur substantial operational costs and may require us to change our business practices, and could lead to material fines, penalties and liability.
In addition, many jurisdictions have enacted data localization laws and cross-border persona information transfer laws. These laws may make it more difficult for us to transfer personal information across jurisdictions, which could impede our business. For example, absent appropriate safeguards or other circumstances, the GDPR generally restricts the transfer of personal information to the United States and other countries that are viewed by some regulators to not generally provide an adequate level of data privacy and security. Although there are currently various mechanisms that can be used to transfer personal information from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework (the "Framework") and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States or other countries. In addition to European restrictions on cross-border transfers of personal information, other jurisdictions have enacted or are considering similar cross-border personal information transfer laws and local personal information residency laws, any of which could increase the cost and complexity of doing business. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal information from Europe or elsewhere. The inability to import personal information to the United States could significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties that are subject to European and other data privacy and security laws, requiring us to increase our personal information processing capabilities in Europe and/or elsewhere at significant expense; increased exposure to regulatory actions; and substantial fines and penalties. Additionally, companies that transfer personal information out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR's cross-border data transfer limitations.
The U.S. Department of Justice has issued a rule titled "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons," which places additional restrictions on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to transfer data in connection with certain transactions or agreements.
Our employees and personnel use generative AI and/or automated decision-making technologies to perform their work, and the disclosure and use of personal information in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI and/or automated decision-making technologies. Our use of such technologies could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. If we are unable to use AI and/or automated decision-making technologies, it could make our business less efficient and result in competitive disadvantages. We also use AI and machine learning ("ML") to assist us in making certain decisions, which is regulated by certain privacy laws. Due to inaccuracies or flaws in the inputs, outputs, or logic of the AI/ML, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.
In addition to data privacy and security laws, privacy advocates and industry groups have proposed, and may propose in the future, standards with which we are legally or contractually bound to comply. For example, we may also be subject to the Payment Card Industry Data Security Standard ("PCI DSS"). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. We may also rely on vendors to process payment card data, who may be subject to PCI DSS, and our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain data privacy and security laws, such as the EU/UK GDPR and the CCPA, require us to impose specific contractual restrictions on our service providers. We also publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.
Our obligations related to data privacy and security (and consumers' data privacy and security expectations) are quickly changing in an increasingly stringent fashion and creating regulatory uncertainty. These obligations may be subject to differing applications and interpretations, which may be inconsistent or in conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources (including, without limitation, financial and time-related resources), which may necessitate changes to our information technologies, systems, and practices and to those of any third parties with whom we work. In addition, these obligations may require us to change our business model. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could impact our compliance posture and business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-related claims) and mass arbitration demands; additional reporting requirements and/or oversight, bans on processing personal information; orders to destroy or not use personal information; and imprisonment of company officials. In particular, plaintiffs have become increasingly active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers, interruptions or stoppages in our business operations, inability to process personal information or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry, adverse publicity, or revision or restructuring of our business model or operations.