In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, processing) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about participants in connection with clinical trials, and sensitive third-party data (collectively, sensitive information). Our data processing activities subject us to numerous data privacy and security obligations, such as various state, federal and foreign laws, regulations, guidance, industry standards, external and internal privacy and security policies, contracts and other obligations governing the processing of personal data and other sensitive information, such as information that we collect in connection with clinical trials in the U.S. and abroad. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to process sensitive information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us or the third parties with whom we work to comply with federal, state or foreign laws or regulation, our internal policies and procedures or our contracts governing our processing of sensitive information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business.
As our operations and business grow, we become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations (i.e., Section 5 of the FTC Act), that govern the collection, use, disclosure, and protection of health-related and other personal data. In addition, we obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to data privacy and security requirements under the Federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, and regulations promulgated thereunder (collectively, "HIPAA"). Depending on the facts and circumstances, we could be subject to significant penalties if we violate HIPAA.
Certain states have also adopted comparable data privacy and security laws and regulations, some of which may be more stringent than HIPAA. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), imposes obligations on covered businesses regarding the personal data of consumers, business representatives, and employees who are California residents, and requires business to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights related to their personal data. The CCPA allows for statutory fines for noncompliance and a private right of action for certain data breaches. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA may increase compliance costs and potential liability with respect to other personal data we may maintain about California residents. Other states have enacted data privacy laws as well. Similar laws have been enacted or are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future, which could further complicate compliance efforts.
In addition, all 50 U.S. states and the District of Columbia have enacted breach notification laws that may require us to notify affected individuals or regulators in the event of unauthorized access to or disclosure of personal data experienced by us or our service providers. These laws are not consistent, and compliance in the event of a widespread data breach is difficult and can be costly. In addition to government regulation, privacy advocates and industry groups have and may in the future propose self-regulatory standards from time to time. We are, and may in the future become, subject to certain industry standards, or we may elect to comply with such standards.
Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the EU GDPR and the UK GDPR impose strict requirements for processing personal data. For example, under the EU GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater. Further, individuals may initiate litigation related to processing of their personal data. In Canada, the PIPEDA and various related provincial laws, may apply to our operations.
Certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws, which could make it more difficult to transfer information across jurisdictions (such as transferring or receiving personal data that originates in the EU or in other foreign jurisdictions). Existing mechanisms that facilitate cross-border personal data transfers may change or be invalidated. For example, absent appropriate safeguards or other circumstances, the EU GDPR generally restricts the transfer of personal data to countries outside of the EEA, that the European Commission does not consider to provide an adequate level of data privacy and security, such as the United States. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EU's standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States or other countries. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to transfer data in connection with certain transactions or agreements.
In addition, certain countries outside Europe have also passed or are considering laws requiring local data residency or otherwise impeding the transfer of personal data across borders, which increases the cost and complexity of doing business.
If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations, including by limiting our ability to conduct clinical trial activities in Europe and elsewhere; limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense.
In addition to data privacy and security laws, we are bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We also publish privacy policies, marketing materials, whitepapers, and other statements concerning data privacy and security. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials, or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.
Although we work to comply with applicable data privacy and security laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties with whom we work. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, CROs, collaborators, or other third parties with who we work to comply with such requirements or adequately address data privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage our reputation, or adversely affect our business and results of operations. For example, we may experience adverse consequences such as interruptions or stoppages in our business operations (including, as relevant, clinical trials); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or revision or restructuring of our operations; government enforcement actions (i.e., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-related claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials.