We are exposed to the risk of employee or third party service provider fraud or other misconduct. Misconduct by employees or third party service providers could include intentional failures to comply with the regulations of the FDA or foreign regulators, to provide accurate information to the FDA or foreign regulators, to comply with healthcare fraud and abuse laws and regulations in the United States and abroad, to report financial information or data accurately or to disclose unauthorized activities to us. In particular, sales, marketing and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing and other abusive practices. Employee or third party service provider misconduct could also involve the improper use of information obtained in the course of clinical trials, which could result in regulatory sanctions and cause serious harm to our reputation. If any actions alleging such conduct are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant effect on our business, including the imposition of significant fines or other sanctions.
We face risks of potential liability related to the privacy of personal information, including health information we utilize in the development of our products, as well as information we obtain from clinical trials sponsored by us from research institutions and directly from individuals.
We and our partners and vendors may be subject to various federal, state, and foreign data protection laws and regulations (i.e., laws and regulations that address privacy and data security). In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators, including the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) and privacy and security requirements under HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH). Depending on the facts and circumstances, we could be subject to civil, criminal, and administrative penalties if we knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. There is no certainty that all of our employees, agents, suppliers, manufacturers, contractors, or collaborators, or those of our affiliates, will comply with all applicable laws and regulations, particularly given the high level of complexity of these laws. Even when HIPAA does not apply, failing to take appropriate steps to keep consumers' personal information secure may constitute a violation of the Federal Trade Commission Act. In addition, certain of the materials we use as starting material in our iPSC-derived product candidates are derived from human sources, which potentially contain sensitive identifiable personal information regarding the donor. In addition, in conducting our clinical trials, we may maintain sensitive identifiable personal information, including health information, that we receive throughout the clinical trial process, in the course of our research collaborations, and directly from individuals (or their healthcare providers) who enroll in our clinical trials. As such, we may become subject to further obligations under HIPAA. Our collection of personal information generally (e.g., of employees currently and/or of patients in the future) may subject us to state data privacy laws governing the processing of personal information and requiring notification of affected individuals and state regulators in the event of a breach of such personal information. These state laws include the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the CCPA), which establishes data privacy rights for residents of the State of California, with corresponding obligations on businesses related to transparency, deletion rights, and opt-out of the selling or sharing of personal information, and grants a private right of action for individuals in the event of certain security breaches. Similar laws relating to data privacy and security have passed in numerous other states, which may have potentially conflicting requirements that would make compliance challenging, require us to expend significant resources to come into compliance, and restrict our ability to process certain personal information. Moreover, some states have advanced privacy laws focused on protecting consumer health information, such as Washington's My Health My Data Act, and this remains a rapidly changing legislative and regulatory environment.
Certain state laws may be more stringent or broader in scope than the CCPA, or offer greater individual rights, with respect to confidential, sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts.
An increasing number of foreign data protection laws, regulations and industry standards may also apply to personal information we obtain from individuals outside of the United States. For example, the European Union's General Data Protection Regulation (EU GDPR) and the United Kingdom's General Data Protection Regulation (UK GDPR) impose strict requirements for processing the personal data of individuals within the EEA and UK, including health-related data, and on the transfer of personal data out of the European Economic Area (EEA) and United Kingdom (UK) to non-adequate territories such as the United States; any inability to transfer personal data from the EEA and UK to the United States in compliance with data protection laws may impede our ability to conduct trials and may adversely affect our business and financial position. Failure to comply with the requirements of the EU GDPR may result in potential fines for companies of up to the greater of €20 million (£17.5 million for the UK GDPR) or 4% of annual global revenue and other administrative penalties. In addition, under the EU GDPR and UK GDPR, companies may face private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to protect their interests. Although the EU GDPR and the UK GDPR currently impose substantially similar obligations, it is possible that over time the UK GDPR could become less aligned with the EU GDPR, particularly with the introduction of the new Data Reform Bill into the UK legislative process. In addition, EEA Member States have adopted national laws to supplement the EU GDPR, which may partially deviate from the EU GDPR, and the competent authorities in the EEA Member States may interpret EU GDPR obligations slightly differently from country to country, such that we do not expect to operate in a uniform legal landscape in the EEA and UK with respect to data protection regulations. The potential of the respective provisions and enforcement of the EU GDPR and UK GDPR further diverging in the future creates additional regulatory challenges and uncertainties for us. The lack of clarity on future UK laws and regulations and their interaction with EU laws and regulations could add legal risk, uncertainty, complexity and compliance cost to the handling of European personal data and our privacy and data security compliance, and could require us to amend our processes and procedures to implement different compliance measures for the UK and the EEA.
In December 2024, the U.S. Department of Justice issued regulations implementing Executive Order ("EO") 14117, "Preventing Access to Americans' Bulk Sensitive Personal Data and United Stated Government-Related Data by Countries of Concern," which are expected to become effective in April 2025. These regulations prohibit transactions involving access to bulk sensitive data by countries of concern, such as China (including Hong Kong). In the life sciences sector, the regulations prohibit investment agreements, employment agreements, vendor agreements, and other transactions involving human genomic data and biospecimens, except where necessary for specified exempt activities. Tracking and complying with these regulations may require significant time and expense.
We are likely to be required to expend significant capital and other resources to ensure ongoing compliance with applicable data privacy and security laws. Claims that we have violated individuals' privacy rights or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend, and could result in adverse publicity that could harm our business. Moreover, even if we take all necessary action to comply with legal and regulatory requirements, we could be subject to a data breach or other unauthorized access of personal information, which could subject us to fines and penalties, as well as litigation and reputational damage. If we fail to keep apprised of and comply with applicable international, federal, state, or local regulatory requirements, we could be subject to a range of regulatory actions that could affect our or any collaborators' ability to seek to commercialize our clinical candidates. Any threatened or actual government enforcement action or litigation could also generate adverse publicity, damage our reputation, result in liabilities, fines and loss of business, and require that we devote substantial resources that could otherwise be used in other aspects of our business.
We make public statements about our use and disclosure of personal information through our privacy policy information provided on our internet platform and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or contractual partners fail to comply with our published policies, certifications and documentation. The publication of our privacy policy and other statements that provide promises and assurances about data privacy and security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices. Any failure, real or perceived, by us to comply with our posted privacy policies or with any legal or regulatory requirements, standards, certifications or orders or other privacy or consumer protection-related laws and regulations applicable to us could cause our prospective customers to reduce their use of our products and could materially and adversely affect our business, financial condition and results of operations. In many jurisdictions, enforcement actions and consequences for non-compliance can be significant and are rising. In addition, from time to time, concerns may be expressed about whether our products or processes compromise the privacy of customers and others. Concerns about our practices with regard to the collection, use, retention, security, disclosure, transfer and other processing of personal information or other privacy-related matters, even if unfounded, could damage our reputation and materially and adversely affect our business, financial condition and results of operations.
Many statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our third-party service providers. For example, laws in all 50 U.S. states and the District of Columbia require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly. We also may be contractually required to notify customers or other counterparties of a security breach. Although we may have contractual protections with our third-party service providers, contractors and consultants, any actual or perceived security breach could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach or security incident. Any contractual protections we may have from our third-party service providers, contractors or consultants may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable to enforce any such contractual protections.
In addition to the possibility of fines, lawsuits, regulatory investigations, public censure, other claims and penalties, and significant costs for remediation and damage to our reputation, we could be materially and adversely affected if legislation or regulations are expanded in a manner that requires changes in our data processing practices and policies or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively impact our business. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business. Any inability to adequately address data privacy or security-related concerns, even if unfounded, or to comply with applicable laws, regulations, standards and other obligations relating to data privacy and security, could result in additional cost and liability to us, harm our reputation and brand, damage our relationships with contract partners and the physician and patient community and have a material and adverse impact on our business.