In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (commonly known as processing) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, and sensitive third-party data. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contracts, and other obligations that govern the processing of personal data by us and third parties on our behalf.
In the United States, numerous federal and state laws, rules and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commissions Act) that govern the collection, processing of personal information, including health-related personal information, apply to our operations and the operations of our collaborators. For example, HIPAA, as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. We obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we may be subject to civil, criminal, and administrative penalties if we knowingly obtain, use, or disclose individually identifiable health information in a manner that is not authorized or permitted by HIPAA.
Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act, or CCPA, applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA allows for statutory fines for noncompliance and includes a private right of action for certain data breaches. Although the CCPA and other state privacy laws exempt some data processed in the context of clinical trials, if we were to become subject to these laws, they may increase legal risk and compliance costs for us and the third parties with whom we work. Data privacy and security laws have been proposed at the federal, state, and local levels in recent years, which could further complicate compliance efforts.
Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the Swiss Federal Act on Data Protection, or FADP, applies to the collection and processing of personal data, including health-related information, by companies located in Switzerland, or in certain circumstances, by companies located outside of Switzerland. The Swiss Information Security Act also applies to certain companies and sets forth reporting obligations for certain cybersecurity incidents. The European Union's General Data Protection Regulation, or EU GDPR, and the United Kingdom's GDPR, or UK GDPR, impose strict requirements for processing personal data. For example, under the EU GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater. Further, companies may face private litigation related to processing of personal data brought not only by individuals but also by classes of data subjects or consumer protection organizations authorized at law to represent their interests. Additionally, EU member states are also able to legislate separately on health and genetic data, and we must comply with applicable local laws where we operate.
Certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws, which could make it more difficult to transfer information across jurisdictions (such as transferring or receiving personal data that originates in the EU or in other foreign jurisdictions). Existing mechanisms that facilitate cross-border personal data transfers may change or be invalidated. For example, Switzerland and the EU and UK GDPR impose strict rules on the transfer of personal data outside of Switzerland, the European Economic Area (EEA) or the United Kingdom respectively, to countries which are deemed to have inadequate levels of data protection safeguards in place, such as the United States. There are currently various mechanisms that may be used to transfer personal data from the EEA, UK, and Switzerland to other countries, including the United States, in compliance with law, such as the EEA Standard Contractual Clauses, or SCCs, the UK's International Data Transfer Agreement/Addendum and the EU-U.S. Data Privacy Framework and the UK and Swiss extensions thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework). Currently, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these or other mechanisms to lawfully transfer personal data to the United States. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Switzerland, Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations, including by limiting our ability to conduct clinical trial activities in Switzerland, Europe and elsewhere; limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense.
We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require our collaborators to impose specific contractual restrictions on their service providers. We publish privacy policies, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.
Our employees and personnel use generative artificial intelligence ("AI") technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.
Our obligations related to data privacy and security are quickly changing in an increasingly stringent fashion, creating some uncertainty as to the effective future legal framework. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources and has in the past and may in the future necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse effects, including inability to or interruption in our ability to operate our business and proceedings against us by governmental entities or others.
If we fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to government enforcement actions (which could include civil, criminal and administrative penalties), private litigation, and/or adverse publicity, additional reporting requirements and/or oversight, bans on processing personal data, orders to destroy or not use personal data, imprisonment of company officials. Moreover, clinical trial subjects, employees and other individuals about whom we or our potential collaborators obtain personal information, as well as the providers who share this information with us, may limit our ability to collect, use and disclose the information. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to interruptions or stoppages in our business operations (including, as relevant, clinical trials), inability to process personal data or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry, adverse publicity, or revision or restructuring of our operations.