We maintain a large quantity of sensitive information, including confidential business and patient health information in connection with our preclinical studies, and are subject to laws and regulations governing the privacy and security of such information. The global data protection landscape is rapidly evolving, and we may be affected by or subject to new, amended or existing laws and regulations in the future, including as our operations continue to expand or if we operate in foreign jurisdictions. These laws and regulations may be subject to differing interpretations, which adds to the complexity of processing personal information. Guidance on implementation standards and compliance practices are often updated or otherwise revised and we cannot yet determine the impact of future laws, regulations, standards, or the perception of their requirements may have on our business.
In the United States, there are numerous federal and state data privacy and security laws and regulations governing the collection, use, disclosure and protection of personal information, including federal and state health information privacy laws, security breach notification laws and consumer protection laws. Each of these laws is subject to varying interpretations and constantly evolving. By way of example, the regulations promulgated under HIPAA and the Health Information Technology for Economic and Clinical Health Act impose privacy and security requirements and breach reporting obligations with respect to individually identifiable health information upon "covered entities" (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity. The HIPAA breach notification rule mandates the reporting of certain breaches of unsecured, protected health information to the U.S. Department of Health and Human Services, or HHS, affected individuals and if the breach is large enough, the media. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured protected health information, a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Even when HIPAA does not apply, according to the FTC failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards.
In addition, certain state laws govern the privacy and security of health-related and other personal information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. By way of example, the CCPA, which went into effect on January 1, 2020, gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability, and adversely affect our business. Further, the CPRA, which went into effect on January 1, 2023, significantly expands the rights granted to consumers under the CCPA and imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Additional compliance investment and potential business process changes may be required. Similar laws have been passed in other states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.
In Europe, the GDPR took effect in May 2018. The GDPR governs the collection, use, disclosure, transfer or other processing of personal data of individuals within the EEA or in the context of our activities within the EEA. In addition, some of the personal data we process in respect of clinical trial participants is special category or sensitive personal data under the GDPR, and subject to additional compliance obligations and to local law derogations. Among other things, the GDPR imposes requirements regarding the security of personal data and notification of data processing obligations to the competent national data processing authorities, changes the lawful bases on which personal data can be processed, expands the definition of personal data and requires changes to informed consent practices, as well as detailed notices for clinical trial subjects and investigators. In addition, the GDPR regulates the transfer of personal data subject to the GDPR to the United States and other jurisdictions that the European Commission does not recognize as having "adequate" data protection laws, and the efficacy and longevity of current transfer mechanisms between the EEA and the United States remains uncertain. Case law from the Court of Justice of the European Union, or CJEU, states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On October 7, 2022, President Biden signed an Executive Order on ‘Enhancing Safeguards for United States Intelligence Activities' which introduced new redress mechanisms and binding safeguards to address the concerns raised by the CJEU in relation to data transfers from the EEA to the United States and which formed the basis of the new EU-US Data Privacy Framework, or DPF, as released on December 13, 2022. The European Commission adopted its Adequacy Decision in relation to the DPF on July 10, 2023, rendering the DPF effective as a GDPR transfer mechanism to United States entities self-certified under the DPF. The DPF also introduced a new redress mechanism for EU citizens which addresses a key concern in the previous CJEU judgments and may mean transfers under standard contractual clauses are less likely to be challenged in the future. We currently rely on a Data Processing Agreement, the EU standard contractual clauses, and the UK Addendum to the EU standard contractual clauses, as applicable, to transfer personal data outside the EEA and the UK, including to the United States, with respect to both intragroup and third party transfers.
The GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of our consolidated annual worldwide gross revenue). In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease or change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/or civil claims, including class actions. For example, in 2016, the EU and United States agreed to a transfer framework for data transferred from the EU to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR. Further, from January 1, 2021, companies must also comply with the United Kingdom GDPR and the amended UK Data Protection Act 2018, or, together, the UK GDPR. The UK GDPR retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, for instance, fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a UK GDPR data transfer mechanism to United States entities self-certified under the UK Extension to the DPF. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. On June 28, 2021, the EU Commission published its adequacy decision to designate the United Kingdom as adequate. This adequacy decision is expected to last until June 27, 2025, although the
Commission will begin an assessment in late 2024 to decide whether to extend the adequacy decision for a further period up to a maximum of another four years. If the Commission does not extend the decision, the UK's adequacy decision will expire on June 27, 2025.
We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. These changes may lead to additional costs and increase our overall risk exposure and as a result, we may have to make certain operational changes. Compliance with these and any other applicable data privacy and security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with the new data protection rules within required time frames. If we fail to comply with any such laws or regulations, we may face significant fines and penalties that could adversely affect our business, financial condition and results of operations.