Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union, and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, "process") personal information and other sensitive information, including, but not limited to, health information, individuals' financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, "sensitive data"). The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements.
In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy laws, consumer protection laws, and other similar laws. Notably, HIPAA, as amended by HITECH, imposes requirements on covered entities, as well as their business associates regarding the privacy, security, and transmission of individually identifiable health information. Further, states continue to adopt new laws or amend existing laws related to data privacy, requiring attention to frequently changing regulatory requirements. For example, and the California Consumer Privacy Act of 2018 ("CCPA") requires businesses to provide specific disclosures in their privacy notices and honor residents' privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA does not apply to certain data that we process in the context of clinical trials, efforts to comply with the CCPA may increase our annual compliance costs and subject us to potential liability with respect to other personal information we may maintain about California residents. In addition, the California Privacy Rights Act of 2020 ("CPRA"), which came into effect on January 1, 2023, expanded the CCPA's requirements, extending it to cover personal information of business representatives and employees and the CPRA established a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Nevada, Connecticut, Utah, Texas, and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels, which impose similar obligations to those in the CCPA. Further, other states, such as Nevada and Washington, have enacted privacy laws specifically governing consumer health information, with Washington providing for a private right of action. Although many of these laws currently exempt certain health-related information, the laws may increase our potential liability related to our data processing activities, complicate our compliance efforts, and increase both legal risk and compliance costs for us and the third parties upon whom we rely.
Outside of the United States, there are an increasing number of laws, regulations, and industry standards regarding privacy and data security. For example, the EU General Data Protection Regulation ("GDPR") and UK GDPR impose strict requirements for processing personal information, and companies that violate the GDPR may face temporary or permanent bans on certain data processing activities and they may be subject to other penalties such as fines of up to 20 million Euros under the EU GDPR / 17.5 million pounds sterling under the UK GDPR or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized to represent data subjects' interests.
In some circumstances, we may be unable to transfer personal information between certain jurisdictions due to data localization requirements or other limitations on cross-border data flows. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the European Economic Area ("EEA") and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws they consider inadequate. Although there are various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with the law, such as the EEA and UK's standard contractual clauses, these mechanisms are subject to legal challenges, and we may be unable to rely on these measures to lawfully transfer personal information to the United States in all cases. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information to recipients outside Europe for allegedly violating the EU GDPR's cross-border data transfer limitations. Additionally, companies that transfer personal information to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.
Compliance with applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with new data protection rules. Failure to comply with any such laws or regulations puts us at risk of facing significant fines and penalties that could adversely affect our business, financial condition, reputation, and results of our operations. Furthermore, conflicting requirements across applicable privacy and data security laws would complicate our compliance efforts and increase both legal risk and compliance costs for us and the third parties upon whom we rely.
In addition to any applicable privacy and data security laws and regulations, we may be subject to industry standards adopted by industry groups or bound by other contractual obligations related to privacy and data security. We may publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials, or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to regulatory inquiries, regulatory enforcement actions, and other adverse consequences.
Our obligations related to privacy and data security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent between jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal information or other sensitive data on our behalf.
We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy and data security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely on may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties that process personal information or other sensitive data our behalf fail, or are perceived to have failed, to address or comply with applicable privacy and data security obligations, we could face significant consequences, including but not limited to government enforcement actions (e.g., investigations, fines, penalties, audits, and inspections), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal information, and orders to destroy or not use personal information. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to loss of customers, significant reputational harm, an inability to process personal information or to operate in certain jurisdictions, limited ability to commercialize VYJUVEK or develop and commercialize our product candidates, expenditures of time and resources to defend ourselves against claims or inquiries, adverse publicity, or substantial changes to our business model or operations.