In the ordinary course of business, we collect, receive, access, generate, transfer, store, disclose, share, make accessible, protect, secure, dispose of, use, share and otherwise process personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data about employees, contractors, customers, suppliers, and others. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, codes, regulations, industry standards, external and internal privacy and security policies, contracts, and other obligations that govern the processing of personal data by us and on our behalf.
In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, and consumer protection laws. The CCPA imposes obligations on covered businesses. These obligations include, but are not limited to, providing specific disclosure in privacy notices and affording California residents certain rights related to their personal data. The CCPA allows for statutory fines for noncompliance (up to $7,500 per violation). In addition, the California Privacy Rights Act of 2020, or CPRA, which goes into effect on January 1, 2023 will expands the CCPA. Additionally, the CPRA establishes new California Privacy Protection Agency to implement and enforce the law. In addition, data privacy and security laws have been proposed at the federal, state, and local levels in recent years, which could further complicate compliance efforts. For example, Virginia and Colorado have similarly enacted comprehensive privacy laws, the Virginia Consumer Data Protection Act and Colorado Privacy Act, respectively, which emulate the CCPA and CPRA in many respects. The Virginia Consumer Data Protection Act takes effect on January 1, 2023, and the Colorado Privacy Act takes effect on July 1, 2023.
Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, under the EU GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater. Further, individuals may initiate litigation related to processing of their personal data. Furthermore, in Europe, there is a proposed regulation related to artificial intelligence ("AI") that, if adopted, could impose onerous obligations related to the use of AI-related systems. We may have to change our business practices to comply with such obligations. In Canada, the PIPEDA and various related provincial laws, as well as Canada's Anti-Spam Legislation ("CASL"), applies to our operations. As another example, the LGPD applies to our operations. The LGPD broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU GDPR. We also target customers in Asia and have operations in Japan, Singapore, India, Hong Kong, and Australia and are subject to new and emerging data privacy regimes in Asia, including China's Personal Information Protection Law, Japan's Act on the Protection of Personal Information, and Singapore's Personal Data Protection Act. In addition, privacy advocates and industry groups have proposed, and may propose, standards with which we are legally or contractually bound to comply.
Certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws, which could make it more difficult to transfer information across jurisdictions (such as transferring or receiving personal data that originates in the EU or in other foreign jurisdictions). Existing mechanisms that facilitate cross-border personal data transfers may change or be invalidated. For example, absent appropriate safeguards or other circumstances, the EU GDPR generally restricts the transfer of personal data to countries outside of the European Economic Area ("EEA") that the European Commission does not consider to provide an adequate level of data privacy and security, such as the United States. The European Commission released a set of "Standard Contractual Clauses" ("SCCs") that are designed to be a valid mechanism to facilitate personal data transfers out of the EEA to these jurisdictions. Currently, these SCCs are a valid mechanism to transfer personal data outside of the EEA, but there exists some uncertainty regarding whether the SCCs will remain a valid mechanism. Additionally, the SCCs impose additional compliance burdens, such as conducting transfer impact assessments to determine whether additional security measures are necessary to protect the at-issue personal data.
In addition, Switzerland and the UK similarly restrict personal data transfers outside of those jurisdictions to countries such as the United States that do not provide an adequate level of personal data protection, and certain countries outside Europe (e.g. Russia, China, Brazil) have also passed or are considering laws requiring local data residency, or otherwise impeding the transfer of personal data across borders, any of which could increase the cost and complexity of doing business. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations, including by limiting our ability to conduct clinical trial activities in Europe and elsewhere; limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense.
Our obligations related to data privacy and security are quickly changing in an increasingly stringent fashion, creating some uncertainty as to the effective future legal framework. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model.
Our business model materially depends on our ability to process personal data, so we are particularly exposed to the risks associated with the rapidly changing legal landscape. For example, we may be at heightened risk of regulatory scrutiny, and any changes in the regulatory framework could require us to fundamentally change our business model. Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse effects, including inability to or interruption in our ability to operate our business and proceedings against us by governmental entities or others.
If we fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class- related claims); additional reporting requirements and/or oversight; bans on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations (including, interruptions or stoppages of data collection needed to train our algorithms); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or revision or restructuring of our operations.
Additionally, we publish privacy policies and other documentation regarding our processing of personal data. Although we endeavor to comply with our privacy policies and other data protection obligations, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, contractors, service providers, or vendors fail to comply with our published policies and documentation. Such failures can subject us to potential foreign, federal, state, and local action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Claims that we have violated individuals' privacy rights or failed to comply with privacy policies and other data protection obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.
We have in the past and may in the future receive inquiries or be subject to investigations by international government entities regarding, among other things, our privacy, data protection, and information security practices. We have been subject to investigations by regulators in Romania and Turkey in connection with a security incident affecting our information technology systems in 2020; however, we have remediated the incident and notified all affected individuals and relevant government authorities as required under applicable privacy laws. The result of these investigations could impact our brand reputation, subject us to monetary remedies and costs, interrupt or require us to change our business practices, divert resources and the attention of management from our business, or subject us to other remedies that adversely affect our business.