The regulatory framework for the collection, use, safeguarding, sharing, transfer and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. Globally, virtually every jurisdiction in which we operate has established its own data security and privacy frameworks with which we must comply. For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the European Union, including personal health data, is subject to the EU General Data Protection Regulation, or the GDPR, which took effect across all member states of the European Economic Area, or EEA, in May 2018. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR increases our obligations with respect to clinical trials conducted in the EEA by expanding the definition of personal data to include coded data and requiring changes to informed consent practices and more detailed notices for clinical trial subjects and investigators.
In addition, the GDPR also imposes strict rules on the transfer of personal data to countries outside the European Union, including the United States and, as a result, increases the scrutiny that clinical trial sites located in the EEA should apply to transfers of personal data from such sites to countries that are considered to lack an adequate level of data protection, such as the United States. The GDPR also permits data protection authorities to require destruction of improperly gathered or used personal information and/or impose substantial fines for violations of the GDPR, which can be up to four percent of global revenues or 20 million Euros, whichever is greater, and it also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In addition, the GDPR provides that EU Member States may make their own further laws and regulations limiting the processing of personal data, including genetic, biometric or health data. Similar laws and regulations have been approved, or are expected to be approved, in several jurisdictions beyond the European Union.
There are ongoing concerns about the ability of companies to transfer personal data from the European Union to other countries. In July 2020, the Court of Justice of the European Union, or the CJEU, invalidated the EU-U.S. Privacy Shield framework, or Privacy Shield, one of the mechanisms used to legitimize the transfer of personal data from the EEA to the U.S. While we were not self-certified under the Privacy Shield, this CJEU decision has led to increased scrutiny on data transfers from the European Union to the United States generally and increase our costs of compliance with data privacy legislation as well as our costs of negotiating appropriate privacy and security agreements with our vendors and business partners.
Following the CJEU decision, in October 2022, President Biden signed an executive order to implement the EU-U.S. Data Privacy Framework, which would serve as a replacement to the EU-U.S. Privacy Shield. The European Commission initiated the process to adopt an adequacy decision for the EU-U.S. Data Privacy Framework , or DPF in December 2022, and has now adopted an adequacy decision to permit data transfers from the European Union to the United States going forward. This development permits data transfers at this point under this framework and more broadly has made international data transfers more straightforward, but these provisions are being challenged in court. The recent election in the United States and the new administration may also impact whether the DPF remains an adequate data transfer framework. The continuing uncertainty around this issue may further impact our business operations in the European Union.
On June 23, 2016, the electorate in the United Kingdom. voted in favor of leaving the European Union, commonly referred to as Brexit. As with other issues related to Brexit, there are open questions about how personal data will be protected in the United Kingdom and whether personal information can transfer from the European Union to the U.K. Following the withdrawal of the U.K. from the European Union, the U.K. Data Protection Act 2018 applies to the processing of personal data that takes place in the United Kingdom and includes parallel obligations to those set forth by GDPR. While the Data Protection Act of 2018 in the United Kingdom that "implements" and complements the GDPR has achieved Royal Assent on May 23, 2018 and is now effective in the United Kingdom, it is unclear whether transfer of data from the EEA to the United Kingdom will remain lawful under the GDPR. The U.K. government has already determined that it considers all 27 EU Member States and EEA member states to be adequate for the purposes of data protection, ensuring that data flows from the United Kingdom to the EU/EEA remain unaffected. In addition, a recent decision from the European Commission appears to deem the United Kingdom as being "essentially adequate" for purposes of data transfer from the European Union to the United Kingdom, although this decision may be re-evaluated in the future. The United Kingdom and the United States also have agreed on a framework for personal data to be transferred between the United Kingdom and the United States, called the U.K.-U.S. Data Bridge. The U.K.-U.S. Data Bridge may be challenged in the future. Continuing uncertainty about these data transfers, including the possibility of future changes, may impact our business operations.
There are multiple privacy and data security laws that may impact our business activities in the United States. These laws are evolving and may increase both our obligations and our regulatory risks in the future. In the health care industry generally, under the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, HHS has issued regulations to protect the privacy and security of protected health information, or PHI, used or disclosed by covered entities including certain healthcare providers, health plans and healthcare clearinghouses. HIPAA also imposes certain obligations on the business associates of covered entities that obtain protected health information in providing services to or on behalf of covered entities. HIPAA may apply to us in certain circumstances and may also apply to our business partners in ways that may impact our relationships with them. Any clinical trials we conduct will be regulated by Subpart A of 45 CFR 46, also known as the Common Rule, which also includes specific privacy-related provisions. In addition to federal privacy regulations, there are a number of state laws governing confidentiality and security of health information that may be applicable to our business. In addition to possible federal civil and criminal penalties for HIPAA violations, state attorneys general are authorized to file civil actions for damages or injunctions in federal courts to enforce HIPAA and seek attorney's fees and costs associated with pursuing federal civil actions. In addition, state attorneys general (along with private plaintiffs) have brought civil actions seeking injunctions and damages resulting from alleged violations of HIPAA's privacy and security rules. State attorneys general also have authority to enforce state privacy and security laws. Moreover, new laws and regulations governing privacy and security may be adopted in the future as well.
In addition to potential enforcement by the HHS, we could also be potentially subject to privacy enforcement from the Federal Trade Commission, or the FTC. The FTC has been particularly focused on the unpermitted processing of health and genetic data through its recent enforcement actions and is expanding the types of privacy violations that it interprets to be "unfair" under Section 5 of the FTC Act, as well as the types of activities it views to trigger the Health Breach Notification Rule (which the FTC also has the authority to enforce). The agency is also in the process of developing rules related to commercial surveillance and data security. We will need to account for the FTC's evolving rules and guidance for proper privacy and data security practices in order to mitigate risk for a potential enforcement action, which may be costly. Finally, both the FTC and HHS's enforcement priorities (as well as those of other federal regulators) may be impacted by the change in administration and new leadership. These shifts in enforcement priorities may also impact our business.
There are also increased restrictions at the federal level relating to transferring sensitive data (including certain kinds of clinical data) outside of the United States to certain foreign countries. The DOJ recently finalized a rule implementing Executive Order 14117, which creates restrictions related to the transfer of sensitive United States data to countries such as China. The "Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern" regulations establish a new regulatory regime that may have a significant impact in connection with the transfer of sensitive United States personal data to "countries of concern" (i.e., China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela). This rule prohibits (1) United States data brokers from licensing or otherwise transferring a wide variety of sensitive United States persons data to China (among other locations) and (2) all United States persons from knowingly engaging in any "covered data transaction" with "countries of concern" or "covered persons" involving access to bulk human genomic, epigenomic, proteomic, or transcriptomic data, or with human biospecimens from which such data can be derived. The rule defines six categories of "sensitive personal data": covered personal identifiers, precise geolocation data, biometric identifiers, human genomic data, personal health data, and personal financial data.
In addition, the Protecting Americans' Data from Foreign Adversaries Act, or PADFA, which came into effect in 2025, prohibits data brokers from selling, licensing, transferring, disclosing, trading, or providing access to "personally identifiable sensitive data" of Americans to foreign adversaries, namely China, Russia, Iran, and North Korea, or entities controlled by a foreign adversary. Although the DOJ's rule and the PADFA share a common purpose, the PADFA focuses more on categories of data rather than transactions. PADFA includes 16 categories of "sensitive data," including biometric information, precise geolocation information, and genetic information. Collectively, the DOJ's rule and PADFA, as well as other similar provisions that may be passed in the future, may create both operational challenges and legal risks for our business.
New laws also are being considered at the state level. For example, the California Consumer Privacy Act, or CCPA-which went into effect on January 1, 2020-is creating similar risks and obligations as those created by GDPR, though the CCPA does currently exempt certain information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, known as the Common Rule. The CCPA also has been amended through a recent referendum in California that creates additional obligations beginning in 2023. In addition to California, at least eighteen other states have passed comprehensive privacy laws similar to the CCPA. These laws are either in effect or will go into effect over the next few years. Like the CCPA, these laws create obligations related to the processing of personal information, as well as special obligations for the processing of "sensitive" data, which includes health data in some cases. Some of the provisions of these laws may apply to our business activities. There are also states that are strongly considering legislation that will go into effect in 2026 and beyond. Congress has also been debating passing a federal privacy law. There are also states that are specifically regulating health information that may affect our business. For example, Washington state passed a health privacy law in 2023 that regulates the collection and sharing of health information, and the law also has a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data, and more states are considering such legislation. These laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.
A broad range of legislative measures also have been introduced at the federal level. Accordingly, failure to comply with federal and state laws (both those currently in effect and future legislation) regarding privacy and security of personal information could expose us to fines and penalties under such laws. There also is the threat of consumer class actions related to these laws and the overall protection of personal data. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.
Given the breadth and depth of changes in data protection obligations, preparing for and complying with these requirements is rigorous and time intensive and requires significant resources and a review of our technologies, systems and practices, as well as those of any third-party collaborators, service providers, contractors or consultants that process or transfer personal data collected in applicable jurisdictions. These changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personal information from our clinical trials, could require us to change our business practices and put in place additional compliance mechanisms, may interrupt or delay our development, regulatory and commercialization activities and increase our cost of doing business, and could lead to government enforcement actions, private litigation and significant fines and penalties against us and could have a material adverse effect on our business, financial condition or results of operations.