The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personal information. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our financial performance, business and operating results.
In the United States, numerous federal and state laws and regulations, including HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 and regulations implemented thereunder, collectively HIPAA, state data breach notification laws, state health information privacy laws and federal and state consumer protection laws, including Section 5 of the Federal Trade Commission Act, which govern the collection, use, disclosure and protection of health-related and other personal information, may apply to our operations and the operations of current and future collaborators. We may obtain health information from third parties, such as research institutions with which we collaborate, that are subject to privacy and security requirements under HIPAA. Although we are not directly subject to HIPAA, other than potentially with respect to providing certain employee benefits, we could be subject to criminal penalties if we knowingly obtain or disclose individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA. In addition, state laws govern the privacy and security of health, research and genetic information in specified circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Further, we may also be subject to other state laws governing the privacy, processing and protection of personal information. For example, the California Consumer Privacy Act of 2018, or CCPA, went into effect on January 1, 2020. The CCPA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that has increased the likelihood, and risks associated with data breach litigation. Further, the California Privacy Rights Act, or CPRA, generally went into effect on January 1, 2023, and significantly amends the CCPA. It imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also creates a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Additional compliance investment and potential business process changes may also be required. Similar laws have passed in Virginia, Utah, Connecticut and Colorado, and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In addition, some of our research activities involve minors, which may be subject to additional laws and can require specialized consent processes, privacy protections, and compliance procedures. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.
Furthermore, the Federal Trade Commission, or FTC, and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers' personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.
Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. For example, in Europe, the collection and use of personal data, including health and genetic data, is governed by the provisions of the GDPR. The GDPR became effective on May 25, 2018, and imposes strict requirements for the processing of the personal data of individuals within the European Economic Area, or EEA, or in the context of our activities in the EEA, including health data from clinical trials and AE reporting. In particular, these requirements include certain obligations concerning the consent of the individuals to whom the personal data relates, the information provided to the individuals, the transfer of personal data out of the EEA, security breach notifications, and security and confidentiality of the personal data, and violations of these requirements could result in substantial fines, up to the greater of 20 million Euros or 4% of total global annual turnover. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease/change our processing of our data, enforcement notices, and/or assessment notices for a compulsory audit. We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. Data protection authorities from the different EU and EEA member states may also interpret the GDPR and national laws differently and impose additional requirements, which adds to the complexity of processing personal data in the EU and the EEA.
Additionally, from January 1, 2021, we have had to comply with the GDPR and also the United Kingdom GDPR, or UK GDPR, which, together with the amended United Kingdom Data Protection Act 2018, retains the GDPR in United Kingdom national law following Brexit. The UK GDPR mirrors the fines under the GDPR, e.g., fines up to the greater of €20 million (£17.5 million) or 4% of global turnover.
Among other requirements, the GDPR and UK GDPR also regulate transfers of personal data subject to the GDPR or UK GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States. Case law from the Court of Justice of the European Union, or the CJEU, states that reliance on the standard contractual clauses - a standard form of contract approved by the EC as an adequate personal data transfer mechanism - alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On October 7, 2022, President Biden signed an Executive Order on ‘Enhancing Safeguards for United States Intelligence Activities' which introduced new redress mechanisms and binding safeguards to address the concerns raised by the CJEU in relation to data transfers from the EEA to the United States and which formed the basis of the new EU-US Data Privacy Framework ("DPF"), as released on December 13, 2022. The DPF also introduced a new redress mechanism for EU and UK citizens which addresses a key concern in the previous CJEU judgments and may mean transfers under standard contractual clauses are less likely to be challenged in the future. The EC adopted its Adequacy Decision in relation to the DPF on July 10, 2023, rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a UK GDPR data transfer mechanism to U.S. entities self-certified under the UK Extension to the DPF. We currently rely on the EU standard contractual clauses and the UK Addendum to the EU standard contractual clauses as relevant to transfer personal data outside the EEA and the UK, including to the United States, with respect to both intragroup and third-party transfers. Following a period of legal complexity and uncertainty regarding international personal data transfers, particularly to the United States, we expect the regulatory guidance and enforcement landscape to continue to develop, in relation to transfers to the United States and elsewhere. In particular, we expect the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As a result, we may have to make certain operational changes and implement revised standard contractual clauses and other relevant documentation for existing data transfers arrangements within required time frames.
Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Our failure to comply with our obligations under the GDPR or UK GDPR, including any failure to adopt measures to ensure that we can continue to conduct the data processing activities that we initiated in the EU before the GDPR entered into application, the UK GDPR, and other countries' privacy or data security-related laws could adversely impact our ability to use the data generated in our studies. And any actual or perceived failure to comply with these data protection laws or adequately address privacy and security concerns could lead to government enforcement actions and significant penalties against us, and adversely impact our operating results.