The global data protection landscape is rapidly evolving, and our data processing activities subject us to numerous data privacy and security obligations, such as U.S. and foreign laws, regulations, industry standards, external and internal privacy and security policies, contractual requirements, and other requirements governing the processing of personal information, including information that we collect about trial participants in connection with clinical trials in the United States and abroad. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards or requirements may have on our business. This evolution may create uncertainty in our business, affect our ability or that of third parties with whom we work to operate in certain jurisdictions or to collect, store, transfer, use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. Any failure or perceived failure by us or a third party with whom we work to comply with applicable obligations related to data privacy and security could result in negative publicity, government investigations, enforcement actions, and claims by third parties, any of which could have a material adverse effect on our business, results of operations and financial condition.
In the United States, numerous federal and state laws and regulations, including data breach notification laws, health information privacy laws, and consumer protection laws and regulations that govern the collection, processing, use, disclosure, and protection of health-related and other personal information apply to our operations or the operations of the third parties with whom we work. For example, in the United States, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), imposes among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Entities that are found to be in violation of HIPAA, whether as the result of a breach of unsecured PHI, a complaint about privacy practices, or an audit by the
U.S. Department of Health and Human Services ("HHS"), may be subject to significant civil, criminal, and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Depending on the facts and circumstances, we could be subject to penalties if we violate HIPAA.
Even when HIPAA does not apply, according to the Federal Trade Commission (the "FTC") failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards.
In addition, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, some of which may be more stringent, broader in scope or offer greater individual rights with respect to protected health information than HIPAA, many of which may differ from each other, thus, complicating compliance efforts. Certain states also impose stricter requirements for processing certain personal information, including sensitive personal information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 ("CCPA") applies to the personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other comprehensive U.S. state privacy laws exempt some data processed in the context of clinical trials and PHI, but these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties with whom we work. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.
Further, we are subject to international data protection laws and regulations, including the European Union's General Data Protection Regulation ("EU GDPR") and the United Kingdom's GDPR ("UK GDPR") (collectively, "GDPR"), which applies to health-related and other personal data obtained outside of the United States and imposes strict requirements for collection, control, sharing, disclosure, transfer, use and other processing of the personal data of individuals located in the European Economic Area ("EEA") and United Kingdom ("UK"), including clinical trial data, as well as potential fines for noncompliant companies. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.
The GDPR also imposes strict requirements relating to obtaining consent, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, taking certain measures when engaging third-party processors. Compliance with the GDPR may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our activities carried out in the context of our EEA operations.
In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the EEA and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. On June 28, 2021, the European Commission adopted an adequacy decision permitting flows of personal data between the EU and the UK to continue without additional requirements. However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews or extends that decision and remains under review by the European Commission during this period. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EU standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.
If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR's cross-border data transfer limitations. Regulators in the United States such as the Department of Justice are also increasingly scrutinizing certain personal data transfers and have proposed and may enact certain data localization requirements, for example, the Biden Administration's executive order Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.
EU data protection laws also require opt-in consent to send marketing emails or use cookies and similar technologies for advertising, analytics and other purposes – activities on which our marketing strategies may rely. Enforcement of these requirements has increased and a new regulation that has been proposed in the EU, known as the Privacy Regulation, may make these requirements more stringent and increase the penalties for violating them. Such restrictions could increase our exposure to regulatory enforcement action, increase our compliance costs, and adversely affect our business. The relationship between the UK and the EU in relation to certain aspects of data protection law remains unclear, and it is unclear how UK data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the UK will be regulated in the long term. These changes will lead to additional costs and increase our overall risk exposure.
The Network and Information Security Directive ("NIS2") regulates resilience and incident response capabilities of entities operating in a number of sectors, including the health sector. Non-compliance with NIS2 may lead up to administrative fines of a maximum of 10 million Euros or up to 2% of the total worldwide revenue of the preceding fiscal year.
The Swiss Federal Act on Data Protection ("DPA") also applies to the collection and processing of personal data by companies located in Switzerland, or in certain circumstances, by companies located outside of Switzerland. The DPA, which was revised along with its ordinances, with effect per September 1, 2023 may lead to an increase in our costs of compliance, risk of noncompliance and penalties for noncompliance.
In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and, we are, and may become in the future, subject to such obligations. We are also bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful.
We publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, concerning data privacy and security. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.
Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Compliance with applicable United States and foreign data protection, privacy and security laws, regulations and standards could require us to take on more onerous obligations in our contracts, require us to engage in costly compliance exercises, restrict our ability to collect, use and disclose data, or in some cases, impact our ability, or our that of third parties with whom we work, to operate in certain jurisdictions. Each of these constantly evolving laws can also be subject to varying applications and interpretations, which may be inconsistent or conflict among jurisdictions. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations.
If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government investigations and enforcement actions (which could include civil or criminal penalties), fines, private litigation (including class-action claims) and mass arbitration demands, additional reporting requirements and/or oversight, bans or restrictions on processing personal information, orders to destroy or not use personal information, imprisonment of company officials, and/or adverse publicity, and could negatively affect our operating results and business. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Moreover, patients about whom we or our partners obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information. Claims that we have violated individuals' privacy rights, failed to comply with applicable data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend, interrupt or stop our business operations (including, as relevant, our clinical trials), limit our ability to develop or commercialize our products, and result in adverse publicity that could materially harm our business.