In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, "process") personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials and sensitive third-party data. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). In the past few years, numerous U.S. states-including California, Virginia, Colorado, Connecticut, and Utah-have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 ("CPRA"), (collectively, "CCPA") applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability with respect to other personal data we maintain about California residents. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties upon whom we rely.
Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union's General Data Protection Regulation ("EU GDPR"), the United Kingdom's GDPR ("UK GDPR"), and China's Personal Information Protection Law ("PIPL") impose strict requirements for processing personal data. Additionally, in Canada, the Personal Information Protection and Electronic Documents Act ("PIPEDA") and various related provincial laws, as well as Canada's Anti-Spam Legislation ("CASL"), may apply to our operations.
We anticipate seeking regulatory approval for, and commercialize, etripamil for the treatment of PSVT in Europe. We may also elect to do so for future product candidates. We are conducting clinical trial activities in Europe, which subjects us to European data protection laws, including the EU GDPR and the UK GDPR. The GDPR establishes requirements applicable to the processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable). The GDPR creates significant and complex compliance burdens for companies such as: limiting permitted processing of personal data to only that which is necessary for specified, explicit and legitimate purposes; requiring the establishment a legal basis for processing personal data; expressly confirming that ‘pseudonymized' or key-coded data constitutes personal data to which the GDPR applies; creating obligations for controllers and processors to appoint data protection officers in certain circumstances; increasing transparency obligations to data subjects for controllers (including presentation of certain information in a concise, intelligible and easily accessible form about how their personal data is used and their rights vis-à-vis that data and its use); introducing the obligation to carry out so-called data protection impact assessments in certain circumstances; establishing limitations on collection and retention of personal data through ‘data minimization' and ‘storage limitation' principles; establishing obligations to implement ‘privacy by design'; introducing obligations to honor increased rights for data subjects (such as rights for individuals to be ‘forgotten,' rights to data portability, rights to object etc. in certain circumstances); formalizing a heightened and codified standard of data subject consent; establishing obligations to implement certain technical and organizational safeguards to protect the security and confidentiality of personal data; introducing obligations to agree to certain specific contractual terms and to take certain measures when engaging third-party processors and joint controllers; introducing the obligation to provide notice of certain significant personal data breaches to the relevant supervisory authority(ies) and affected individuals; and mandating the appointment of representatives in the United Kingdom and/or European Union in certain circumstances. The processing of "special category personal data", such as health information, may also impose heightened compliance burdens under the GDPR. The GDPR has robust regulatory enforcement and penalties for noncompliance, including fines of up to €20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR, or, in each case 4% of global annual revenue of any noncompliant company for the preceding financial year, whichever is higher or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In addition to administrative fines, a wide variety of other potential enforcement powers are available to competent supervisory authorities in respect of potential and suspected violations of the GDPR, including extensive audit and inspection rights, and powers to order temporary or permanent bans on all or some processing of personal data carried out by noncompliant actors. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. There may be circumstances under which a failure to comply with GDPR, or the exercise of individual rights under the GDPR, would limit our ability to utilize clinical trial data collected on certain subjects. The GDPR will likely impose additional responsibility and liability in relation to our processing of personal data. This may be onerous and materially adversely affect our business, financial condition, results of operations and prospects.
A particular issue presented by the GDPR is the restriction on transfers of personal data from Europe to the United States and most other countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. One of the primary safeguards allowing U.S. companies to import personal data from Europe is the European Commission's Standard Contractual Clauses and we have relied on Standard Contractual Clauses to comply with the GDPR's restrictions on transfer of personal data out of Europe. However, in July 2020 the Court of Justice of the European Union, or CJEU, in a case known colloquially as "Schrems II" raised questions about whether the Standard Contractual Clauses can lawfully be used for personal data transfers from Europe to the United States or other third countries that are not the subject of an adequacy decision of the European Commission. While the CJEU upheld the adequacy of the Standard Contractual Clauses in principle in Schrems II, it made clear that reliance on those Clauses alone may not necessarily be sufficient in all circumstances. Use of the Standard Contractual Clauses must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular regarding applicable surveillance laws and relevant rights of individuals with respect to the transferred data. In the context of any given transfer, where the legal regime applicable in the destination country may or does conflict with the intended operation of the Standard Contractual Clauses and/or applicable European law, the decision in Schrems II and subsequent draft guidance from the European Data Protection Board, or EDPB, would require the parties to that transfer to implement certain supplementary technical, organizational and/or contractual measures to rely on the Standard Contractual Clauses as a compliant ‘transfer mechanism.' However, the aforementioned draft guidance from the EDPB on such supplementary technical, organizational and/or contractual measures appears to conclude that no combination of such measures could be sufficient to allow effective reliance on the Standard Contractual Clauses in the context of transfers of personal data ‘in the clear' to recipients in countries where the power granted to public authorities to access the transferred data goes beyond that which is ‘necessary and proportionate in a democratic society' – which may, following the CJEU's conclusions in Schrems II on relevant powers of United States public authorities and commentary in that draft EDPB guidance, include the United States in certain circumstances (e.g., where Section 702 of the US Foreign Intelligence Surveillance Act applies). At present, there are few, viable alternatives to the Standard Contractual Clauses including the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework). These mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. As such, if we are unable to implement a valid solution for personal data transfers from Europe, including, we will face increased exposure to regulatory actions, substantial fines and injunctions against processing personal data from Europe. Inability to import personal data from Europe may also: restrict our activities in Europe; limit our ability to collaborate with partners as well as other service providers, contractors and other companies subject to European data protection laws; and require us to increase our data processing capabilities in Europe at significant expense. Restrictions on our ability to import personal data from Europe could therefore impact our clinical trial activities in Europe and limit our ability to collaborate with CROs and other third parties subject to European data protection laws. Additionally, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of delivering our services and operating our business. The type of challenges we face in Europe will likely also arise in other jurisdictions that adopt laws similar in construction to the GDPR or regulatory frameworks of equivalent complexity.
In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and we are, or may become subject to such obligations in the future. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful.
We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.
Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations including, as relevant, clinical trials; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.
Our employees and personnel may use generative artificial intelligence ("AI") technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.