We, and our partners and vendors, including CROs, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit and share (collectively, process) personal de-identified data and other sensitive information (collectively, sensitive data) in connection with the operations of our business, such as storage or otherwise processing sensitive data to support the conduct of our clinical trials. These processing activities subject us, and our partners and vendors, to various federal, state, local and foreign data privacy and security laws, regulations, guidance and industry standards and we (or the partners and vendors with whom we work) are or may become subject to external and internal privacy and security policies, contractual requirements and other obligations relating to data privacy and security. If we fail to comply with applicable requirements for processing sensitive data, including in connection with the development of our product candidates or otherwise, or if a partner or vendor fails to comply with the same or misuses sensitive data we provide to it, we may be subject to litigation, regulatory investigations, enforcement actions, fines and criminal or civil penalties, mass arbitration demands, additional reporting requirements and/or oversight, bans on processing personal data and orders to destroy or not use personal data, as well as negative publicity, reputational harm and other adverse business consequences.
In the United States, our and our partners' and vendors' operations are subject to numerous federal and state laws and regulations, including state data breach notification laws and federal and state data privacy laws and regulations that govern the collection, use, disclosure and protection of health information and other personal data, including information of our employees. For example, HIPAA imposes specific requirements relating to the privacy, security and transmission of individually identifiable protected health information, and we could potentially face substantial criminal or civil penalties if we knowingly receive protected health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA's requirements for disclosure of such health information, or otherwise violate applicable HIPAA requirements related to the protection of such information. Even when HIPAA does not apply, failure to take appropriate steps to keep consumers' personal data secure may constitute a violation of the Federal Trade Commission Act and other similar laws (e.g., wiretapping laws).
Numerous U.S. states have enacted comprehensive data privacy and security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights include the right to access, correct or delete certain personal data and to opt-out of certain data processing activities, such as targeted advertising, profiling and automated decision-making. The exercise of these rights may impact our business and ability to advance our product candidates effectively. Certain states also impose more stringent requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA) applies to personal data of consumers,business representatives and employees who are California residents and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability.
Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. These state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to confidential, sensitive and personal data than federal, international or other state laws, and such laws may differ from each other and have potentially conflicting requirements that would make compliance challenging, require us to expend significant resources to achieve compliance and restrict our ability to process certain sensitive and personal data. Additionally, the U.S. Department of Justice issued a rule entitled Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restrictions on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, employment of certain individuals and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted.
Outside the United States, an increasing number of laws, regulations and industry standards may govern data privacy and security. For example, the EU GDPR and the UK GDPR impose strict requirements for processing personal data.
Any clinical trial programs, including related regulatory filings, and research collaborations that we engage in outside the United States in the future may implicate international laws and regulations concerning data privacy and security, including those governing various aspects of clinical research in the EU and the UK.
In addition to data privacy and security laws, we are or may become contractually subject to industry standards adopted by industry groups. We are also bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. Our employees and personnel use AI technologies to perform their work, and the disclosure and use of personal data in AI technologies is subject to various data privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions and lawsuits. If we are unable to use AI, it could make our business less efficient and result in competitive disadvantages. We may use AI outputs to inform certain decisions. If the recommendations, forecasts or analyses that AI applications, including AI agents, produce or assist in producing are deficient, or inaccurate, offensive, illegal, biased or discriminatory, or otherwise harmful, we could be subject to competitive harm and potential legal liability under existing and/or future legislation or regulations, including in the United States and the EU. For example, the model could be biased and could result in decisions, or lead us to make decisions, that could bias certain individuals (or classes of individuals) and adversely impact them, such as adversely impacting their ability to obtain certain pricing, products, services or benefits.
Data privacy and security laws are quickly evolving, becoming increasingly stringent, and creating uncertainty. Additionally, these laws may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. We expect that we will need to expend significant capital and other resources to ensure ongoing compliance with applicable data privacy and security laws. Claims that we have violated individuals' privacy rights or breached our contractual obligations related to data privacy and security, even if we are not found liable, could be expensive and time-consuming to defend and could result in negative publicity that could harm our business. Moreover, even if we take all necessary action to comply with legal and regulatory requirements, we or our partners or vendors could fail or be perceived to have failed to comply with such obligations, which could subject us to fines and penalties, as well as litigation and reputational damage. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class action claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business or financial condition, including but not limited to delays in the development of our product candidates due to inability to process personal data or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry, adverse publicity or substantial changes to our planned candidate pipeline development and business operations. If we fail to keep apprised of and comply with applicable foreign, federal, state or local regulatory requirements and changes thereto, we could be subject to a range of regulatory actions that could affect our or any vendors' or partners' ability to seek to commercialize our product candidates. Any threatened or actual government enforcement action, or litigation when private rights of action are available, could also generate negative publicity, damage our reputation, result in liabilities, fines and adverse business consequences and require that we devote substantial resources that could otherwise be used in support of other aspects of our business.