Existing regulatory policies may change, and additional government regulations may be enacted that could prevent, limit or delay regulatory approval of our product candidates. We cannot predict the likelihood, nature or extent of government regulation that may arise from future legislation or administrative action, either in the United States or abroad. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, we may lose any marketing approval that we may have obtained, and we may not achieve or sustain profitability.
For example, in March 2010, the Patient Protection and Affordable Care Act of 2010, as amended by the Health Care and Education Reconciliation Act of 2010 (collectively, the ACA), was passed, which substantially changed the way healthcare is financed by both the government and private insurers and continues to significantly impact the U.S. pharmaceutical industry. Since its enactment, there have been legislative and judicial efforts to repeal, replace, or change some or all of the ACA. In June 2021, the United States Supreme Court held that Texas and other challengers had no legal standing to challenge the ACA, dismissing the case without specifically ruling on the constitutionality of the ACA. It is unclear how future litigation and healthcare measures promulgated by the new Trump administration will impact the implementation of the ACA, our business, financial condition and results of operations. Complying with any new legislation or reversing changes implemented under the ACA could be time-intensive and expensive, resulting in a material adverse effect on our business.
In addition, other legislative changes have been proposed and adopted in the United States since the ACA was enacted. These changes included aggregate reductions to Medicare payments to providers of up to 2% per fiscal year, effective April 1, 2013, which will stay in effect through 2032, unless Congress takes additional action. In January 2013, President Obama signed into law the American Taxpayer Relief Act of 2012, which, among other things, reduced Medicare payments to several providers, and increased the statute of limitations period for the government to recover overpayments to providers from three to five years. These new laws may result in additional reductions in Medicare and other healthcare funding, which could have a material adverse effect on customers for our drugs, if approved, and accordingly, our financial operations.
Moreover, there has been heightened governmental scrutiny recently over the manner in which drug manufacturers set prices for their marketed products, which has resulted in several Congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for drug products. For example, the American Rescue Plan Act of 2021 eliminated the statutory cap on Medicaid Drug Rebate Program rebates that manufacturers pay to state Medicaid programs. Elimination of this cap may require pharmaceutical manufacturers to pay more in rebates than it receives on the sale of products, which could have a material impact on our business. In August 2022, Congress passed the Inflation Reduction Act of 2022 (IRA), which includes prescription drug provisions that have significant implications for the pharmaceutical industry and Medicare beneficiaries, including allowing the federal government to negotiate a maximum fair price for certain high-priced single-source Medicare drugs, imposing penalties and excise tax for manufacturers that fail to comply with the drug price negotiation requirements, requiring inflation rebates for all Medicare Part B and Part D drugs, with limited exceptions, if their drug prices increase faster than inflation, and redesigning Medicare Part D to reduce out-of-pocket prescription drug costs for beneficiaries, among other changes. Various industry stakeholders, including pharmaceutical companies, the U.S. Chamber of Commerce, the National Infusion Center Association, the Global Colon Cancer Association, and the Pharmaceutical Research and Manufacturers of America have initiated lawsuits against the federal government asserting that the price negotiation provisions of the IRA are unconstitutional. The impact of these judicial challenges as well as other judicial challenges in view of the Supreme Court's overturn of the Chevron doctrine, future legislative, executive, and administrative actions and agency rules implemented by the government on us and the pharmaceutical industry as a whole is unclear. Further, uncertainties created by the IRA, including its long-term impact on drug pricing, may negatively impact investments, company valuation, royalty-based earnings, mergers, and acquisitions in the industry. The impact of these and future legislative, executive, and administrative actions and any future healthcare measures and agency rules implemented by the new Trump administration on us and the pharmaceutical industry as a whole is unclear. The implementation of cost containment measures or other healthcare reforms may prevent us from being able to generate revenue, attain profitability, or commercialize our product candidates if approved. Complying with any new legislation and regulatory changes could be time-intensive and expensive, resulting in a material adverse effect on our business, and expose us to greater liability.
At the state level, legislatures have increasingly passed legislation and implemented regulations designed to control pharmaceutical and biological product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, designed to encourage importation from other countries and bulk purchasing. A number of states are considering or have recently enacted state drug price transparency and reporting laws that could substantially increase our compliance burdens and expose us to greater liability under such state laws once we begin commercialization after obtaining regulatory approval for any of our products. In addition, the FDA has authorized the state of Florida to develop Section 804 Importation Programs to import certain prescription drugs from Canada for a limited time to help reduce drug costs, provided that Florida's Agency for Health Care Administration meets the requirements set forth by the FDA. Other states may follow Florida. We are unable to predict the future course of federal or state healthcare legislation in the United States directed at broadening the availability of healthcare and containing or lowering the cost of healthcare. These and any further changes in the law or regulatory framework that reduce our revenue or increase our costs could also have a material and adverse effect on our business, financial condition and results of operations.
Further, on May 30, 2018, the Trickett Wendler, Frank Mongiello, Jordan McLinn, and Matthew Bellina Right to Try Act of 2017 (Right to Try Act), was signed into law. The law, among other things, provides a federal framework for certain patients to access certain investigational new product candidates that have completed a Phase 1 clinical trial and that are undergoing investigation for FDA approval. Under certain circumstances, eligible patients can seek treatment without enrolling in clinical trials and without obtaining FDA permission under the FDA expanded access program. There is no obligation for a drug manufacturer to make its products available to eligible patients as a result of the Right to Try Act.
We expect that the ACA, the IRA, as well as other healthcare reform measures that may be adopted in the future, may result in more rigorous coverage criteria and in additional downward pressure on the price that we receive for any approved product. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms may prevent us from being able to generate revenue, attain profitability or commercialize our product candidates.
Legislative and regulatory proposals have been made to expand post-approval requirements and restrict sales and promotional activities for biotechnology products. We cannot be sure whether additional legislative changes will be enacted, or whether FDA regulations, guidance or interpretations will be changed, or what the impact of such changes on the marketing approvals of our product candidates, if any, may be. In addition, increased scrutiny by Congress of the FDA's approval process may significantly delay or prevent marketing approval, as well as subject us to more stringent product labeling and post-marketing testing and other requirements. In June 2024, the U.S. Supreme Court overruled the Chevron doctrine, which gives deference to regulatory agencies' statutory interpretations in litigation against federal government agencies, such as the FDA, where the law is ambiguous. This landmark Supreme Court decision may invite more companies and other stakeholders to bring lawsuits against the FDA and other federal agencies to challenge longstanding decisions and policies, which could undermine the FDA's authority, lead to uncertainties in the industry, and disrupt the FDA's normal operations, any of which could delay the FDA's review of our regulatory submissions. We cannot predict the full impact of this decision, future judicial challenges brought against the FDA, or the nature or extent of government regulation that may arise from future legislation or administrative action.
Additionally, the collection, use, and other processing of health data relating to individuals in the EU is governed by the General Data Protection Regulation (GDPR), which extends the geographical scope of EU data protection law to non-EU entities under certain conditions and imposes substantial obligations upon companies and new rights for individuals. Failure to comply with the GDPR and the applicable national data protection laws of EU Member States may result in fines up to €20,000,000 or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties and liabilities. The GDPR has increased our responsibility and liability in relation to personal data that we may process, and we may be required to put in place additional mechanisms in an effort to comply with the GDPR or other laws and regulations relating to privacy, data protection and cybersecurity. This may be onerous and if our efforts to comply with GDPR or other applicable laws and regulations are not successful, it could adversely affect our business. Further, the European Court of Justice (ECJ) in 2020 invalidated the EU-U.S. Privacy Shield and imposed additional requirements for companies making use of standard contractual clauses issued by the European Commission (SCCs), including requirements to make use of updated SCCs. The UK also has issued updated standard contractual clauses that are required to be implemented. Additionally, the U.S. Department of Justice recently issued a final rule that takes effect in April 2025, which places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to business partners located in China or with other specified links to China and other designated countries. These and other developments with respect to cross-border data transfer may impose additional obligations with respect to cross-border data transfer and may require us to modify our policies and practices and engage in additional contractual negotiations, each of which could increase our costs and obligations and impose limitations upon our ability to efficiently transfer personal data across borders.
Further, the UK has implemented legislation that implements and complements the GDPR, with penalties for noncompliance of up to the greater of £17.5 million or four percent of worldwide revenues. Aspects of data protection regulation in the UK, however, including with respect to cross-border data transfers, remain unclear in the medium to longer term following the exit of the UK from the EU. We may be required to incur significant costs and expenses in an effort to comply with distinct privacy and data protection requirements in the EU and UK. More generally, we may incur liabilities, expenses, costs, and other operational losses under the GDPR and the privacy and data protection laws of applicable EU Member States and the UK in connection with any measures we take to comply with them.
Finally, state and foreign laws may apply generally to the privacy and security of information we maintain, and may differ from each other in significant ways, thus complicating compliance efforts. For example, the California Consumer Privacy Act of 2018 (CCPA), which took effect on January 1, 2020, gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. In addition, the CCPA (a) allows enforcement by the California Attorney General or the California Privacy Protection Agency, with fines set at $2,500 per violation (i.e., per person) or $7,500 per intentional violation and (b) authorizes private lawsuits to recover statutory damages for certain data breaches. While it exempts some data regulated by HIPAA and certain clinical trials data, the CCPA may increase our compliance costs and potential liability with respect to other personal information we collect about California residents. Additionally, the California Privacy Rights Act (CPRA) became operative in most respects on January 1, 2023. The CPRA significantly modified the CCPA, which may require us to modify our practices and policies and may further increase our compliance costs and potential liability. Numerous other states' legislatures are considering or have enacted similar laws that will require ongoing compliance efforts and investment, and which may increase our potential liability and adversely affect our business. For example, Colorado, Connecticut, Utah, and Virginia have enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon and Texas have enacted similar legislation that became effective in 2024; Tennessee, Iowa, Delaware, Maryland, Minnesota, Nebraska, New Hampshire and New Jersey have enacted similar legislation that has or will become effective in 2025; and Indiana, Rhode Island and Kentucky have enacted similar legislation that will become effective in 2026. Further, other states have enacted laws that cover certain aspects of the collection, use, disclosure, and/or other processing of health information, such as Washington's My Health, My Data Act, which, among other things, provides for a private right of action.
The interpretation and application of laws and regulations relating to privacy, data protection, data security, and other matters in the United States, the EEA, and elsewhere are often uncertain, contradictory, and in flux. Any failure or perceived failure to comply with federal, state, or foreign laws or regulations, or contractual or other legal obligations, may result in claims, warnings, communications, requests, or investigations from individuals, supervisory authorities, or other legal or regulatory authorities, and regulatory investigations or other proceedings. It is possible that these laws, regulations, and other actual or asserted obligations may be interpreted and applied in a manner that is inconsistent with our practices. If so, this could result in claims, demands, and litigation or other proceedings initiated by regulatory authorities or others, and fines, penalties, damages, or other liabilities, as well as government-imposed orders requiring that we change our practices, which could adversely affect our business. Our efforts to comply with emerging and changing legal and regulatory requirements relating to privacy, data protection, data security, and other matters may cause us to incur costs or require us to change our business practices, which could harm our business, financial condition, and results of operations and prospects.