In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, "process") personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials and sensitive third-party data. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties upon whom we rely. We are also subject to new laws governing the privacy of consumer health data. For example, Washington's My Health My Data Act, or "MHMD," broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws.
Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union's General Data Protection Regulation, or "EU GDPR," the United Kingdom's GDPR, or "UK GDPR,", and China's Personal Information Protection Law, or "PIPL," impose strict requirements for processing personal data. Additionally, in Canada, the Personal Information Protection and Electronic Documents Act, or "PIPEDA," and various related provincial laws, as well as Canada's Anti-Spam Legislation, or "CASL,", may apply to our operations.
We anticipate seeking regulatory approval for, and commercializing, etripamil for the treatment of PSVT in Europe. We may also elect to do so for future product candidates. We are conducting clinical trial activities in Europe, which subject us to European data protection laws, including the EU GDPR and the UK GDPR. The GDPR establishes requirements applicable to the processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable). The GDPR creates significant and complex compliance burdens for companies such as: limiting permitted processing of personal data to only that which is necessary for specified, explicit and legitimate purposes; requiring the establishment a legal basis for processing personal data; expressly confirming that ‘pseudonymized' or key-coded data constitutes personal data to which the GDPR applies; creating obligations for controllers and processors to appoint data protection officers in certain circumstances; increasing transparency obligations to data subjects for controllers (including presentation of certain information in a concise, intelligible and easily accessible form about how their personal data is used and their rights vis-à-vis that data and its use); introducing the obligation to carry out so-called data protection impact assessments in certain circumstances; establishing limitations on collection and retention of personal data through ‘data minimization' and ‘storage limitation' principles; establishing obligations to implement ‘privacy by design'; introducing obligations to honor increased rights for data subjects (such as rights for individuals to be ‘forgotten,' rights to data portability, rights to object etc. in certain circumstances); formalizing a heightened and codified standard of data subject consent; establishing obligations to implement certain technical and organizational safeguards to protect the security and confidentiality of personal data; introducing obligations to agree to certain specific contractual terms and to take certain measures when engaging third-party processors and joint controllers; introducing the obligation to provide notice of certain significant personal data breaches to the relevant supervisory authority(ies) and affected individuals; and mandating the appointment of representatives in the United Kingdom and/or European Union in certain circumstances. The processing of "special category personal data", such as health information, may also impose heightened compliance burdens under the GDPR. The GDPR has robust regulatory enforcement and penalties for noncompliance, including fines of up to €20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR, or, in each case 4% of global annual revenue of any noncompliant company for the preceding financial year, whichever is higher or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In addition to administrative fines, a wide variety of other potential enforcement powers are available to competent supervisory authorities in respect of potential and suspected violations of the GDPR, including extensive audit and inspection rights, and powers to order temporary or permanent bans on all or some processing of personal data carried out by noncompliant actors. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. There may be circumstances under which a failure to comply with GDPR, or the exercise of individual rights under the GDPR, would limit our ability to utilize clinical trial data collected on certain subjects. The GDPR will likely impose additional responsibility and liability in relation to our processing of personal data. This may be onerous and materially adversely affect our business, financial condition, results of operations and prospects. Regulators in the United States such as the Department of Justice are also increasingly scrutinizing certain personal data transfers and have proposed and enacted certain data localization requirements, for example, the Biden Administration's executive order Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.
A particular issue presented by the GDPR is the restriction on transfers of personal data from Europe to the United States and most other countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. One of the primary safeguards allowing U.S. companies to import personal data from Europe is the European Commission's Standard Contractual Clauses and we have relied on Standard Contractual Clauses to comply with the GDPR's restrictions on transfer of personal data out of Europe. However, in July 2020 the Court of Justice of the European Union, or "CJEU," in a case known colloquially as "Schrems II" raised questions about whether the Standard Contractual Clauses can lawfully be used for personal data transfers from Europe to the United States or other third countries that are not the subject of an adequacy decision of the European Commission. At present, there are few, viable alternatives to the Standard Contractual Clauses including the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework). However, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. As such, if we are unable to implement a valid solution for personal data transfers from Europe, including, we will face increased exposure to regulatory actions, substantial fines and injunctions against processing personal data from Europe. Inability to import personal data from Europe may also: restrict our activities in Europe; limit our ability to collaborate with partners as well as other service providers, contractors and other companies subject to European data protection laws; and require us to increase our data processing capabilities in Europe at significant expense. Restrictions on our ability to import personal data from Europe could therefore impact our clinical trial activities in Europe and limit our ability to collaborate with CROs and other third parties subject to European data protection laws. Additionally, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of delivering our services and operating our business. The type of challenges we face in Europe will likely also arise in other jurisdictions that adopt laws similar in construction to the GDPR or regulatory frameworks of equivalent complexity.
In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups, and we are and may become in the future, subject to such obligations. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful.
We publish privacy policies, marketing materials, whitepapers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy, security and AI. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.
Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations including, as relevant, clinical trials; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations. We use AI/ML to assist us in making certain decisions, which is regulated by certain privacy laws. Due to inaccuracies or flaws in the inputs, outputs, or logic of the AI/ML, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits. The development and use of AI/ML present various privacy and security risks that may impact our business. AI/ML are subject to privacy and data security laws, as well as increasing regulation and scrutiny.
?
Our employees and personnel use AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.