We may collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect and share personal information, health information and other information to develop our products, to operate our business, for clinical trial purposes, for legal and marketing purposes, and for other business-related purposes.
We and any potential future collaborators, partners or service providers may be subject to federal, state and foreign data protection laws, regulations and regulatory guidance, the number and scope of which is changing, subject to differing applications and interpretations, and which may be inconsistent among jurisdictions, or in conflict with other rules, laws or contractual obligations. In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, such as Health Insurance Portability and Accountability Act, or HIPAA, state data breach notification laws, state health information privacy laws and federal and state consumer protection laws, that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of any future potential collaborators or service providers. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA, or other privacy and data security laws. Depending on the facts and circumstances, we could be subject to civil or criminal penalties if we knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA, or if we otherwise violate applicable privacy and data security laws.
International data protection laws, including the EU's General Data Protection Regulation, or GDPR, may also apply to health-related and other personal information obtained outside of the United States. The GDPR went into effect on May 25, 2018. The GDPR introduced new data protection requirements in the EU, as well as potential fines for noncompliant companies of up to the greater of €20 million or 4% of annual global revenue. The regulation imposes numerous requirements for the collection, use and disclosure of personal information, including stringent requirements relating to consent and the information that must be shared with data subjects about how their personal information is used, the obligation to notify regulators and affected individuals of personal data breaches, extensive internal privacy governance obligations and obligations to honor expanded rights of individuals in relation to their personal information.
In addition, the GDPR includes restrictions on cross-border data transfers. A recent decision by the Court of Justice of the European Union has invalidated the EU-U.S. Privacy Shield Framework, which was one of the primary mechanisms used by U.S. companies to import personal information from Europe in compliance with the GDPR's cross-border data transfer restrictions, and raised questions about whether the European Commission's Standard Contractual Clauses, or SCCs, one of the primary alternatives to the Privacy Shield, can lawfully be used for personal information transfers from Europe to the United States or most other countries. Similarly, the Swiss Federal Data Protection and Information Commissioner has opined that the Swiss-U.S. Privacy Shield is inadequate for transfers of data from Switzerland to the U.S. The United Kingdom, or UK, whose data protection laws are similar to those of the EU, may similarly determine that the EU-U.S. Privacy Shield is not a valid mechanism for lawfully transferring personal information from the UK to the U.S. The European Commission recently proposed updates to the SCCs, and additional regulatory guidance has been released that seeks to impose additional obligations on companies seeking to rely on the SCCs. Given that, at present, there are few, if any, viable alternatives to the EU-U.S. Privacy Shield and the SCCs, any transfers by us or our vendors of personal data from Europe may not comply with European data protection law, which may increase Our exposure to the GDPR's heightened sanctions for violations of its cross-border data transfer restrictions and may prohibit the transfer of EU personal data outside of the EU (including clinical trial data), and may adversely impact Our operations, product development, and ability to provide our products.
The GDPR has increased the responsibilities and potential liability in relation to personal data processed subject to the GDPR, and we may be required to put in place additional mechanisms to ensure compliance with the GDPR, including as implemented by individual countries. Further, the exit of the UK from the EU, often referred to as Brexit, has created uncertainty with regard to data protection regulation in the UK. The UK now is considered a "third country" under the GDPR and transfers of European personal data to the UK will, unless the UK is determined by the EU to provide adequate protection for personal data, require an adequacy mechanism to render such transfers lawful under the GDPR following the expiration or termination of a grace period that presently is scheduled to last for four months from January 1, 2021, with a potential additional two-month extension. Aspects of the relationship between the EU and the UK with respect to data protection, including with respect to cross-border data transfers, remain uncertain. Compliance with the GDPR and applicable laws and regulations relating to privacy and data protection of EU Member States and the UK will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change its business practices, and despite those efforts, there is a risk that We may be subject to fines and penalties, litigation, and reputational harm in connection with Our European activities. In addition, failure to comply with GDPR and applicable laws and regulations relating to privacy and data protection of EU Member States and the UK may result in regulators prohibiting Our processing of the personal information of EU data subjects, which could impact Our operations and ability to develop our products and provide its services, including interrupting or ending EU clinical trials.
In addition, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act, or the CCPA, on June 28, 2018, which took effect on January 1, 2020 and has been dubbed the first "GDPR-like" law in the United States. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined and can include any of Our current or future employees who may be California residents) and provide such residents new ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches and statutory damages ranging from $100 to $750 per violation, which is expected to increase data breach class action litigation and result in significant exposure to costly legal judgments and settlements. As we expand our operations and trials (both preclinical and clinical), the CCPA may increase compliance costs and potential liability. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the United States. In November 2020, California passed the California Privacy Rights Act, or the CPRA, which amends and expands the CCPA. The CPRA creates obligations relating to consumer data beginning on January 1, 2022, with implementing regulations expected on or before July 1, 2022, and enforcement beginning July 1, 2023. The CPRA has created additional uncertainty and may increase our cost of compliance. Other states are beginning to pass similar laws.
Compliance with U.S. and international data protection laws and regulations could require us to take on more onerous obligations in its contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. Laws and regulations worldwide relating to privacy, data protection and cybersecurity are, and are likely to remain, uncertain for the foreseeable future. While we strive to comply with applicable laws and regulations relating to privacy, data protection and cybersecurity, external and internal privacy and security policies and contractual obligations relating to privacy, data protection and cybersecurity to the extent possible, we may at times fail to do so, or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our personnel, collaborators, partners or vendors do not comply with applicable laws and regulations relating to privacy, data protection and cybersecurity, external and internal privacy and security policies and contractual obligations relating to privacy, data protection and cybersecurity. Actual or perceived failure to comply with any laws and regulations relating to privacy, data protection or cybersecurity in the U.S. or foreign jurisdictions could result in government enforcement actions (which could include civil or criminal penalties), private litigation or adverse publicity and could negatively affect Our operating results and business. Moreover, clinical trial subjects about whom we or our potential collaborators or service providers obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information. Claims that we have violated individuals' privacy rights, failed to comply with applicable laws or regulations, or breached its contractual obligations, even if We are not found liable, could be expensive and time consuming to defend, result in regulatory actions and proceedings, in addition to private claims and litigation, and could result in adverse publicity that could harm our business.
We also are, or may be asserted to be, subject to the terms of our external and internal privacy and security policies, representations, certifications, publications and frameworks and contractual obligations to third parties related to privacy, data protection, information security and processing. Failure to comply with any of these, or if any of these policies or any of our representations, certifications, publications or frameworks are, in whole or part, found or perceived to be inaccurate, incomplete, deceptive, unfair, or misrepresentative of its actual practices, could result in reputational harm; result in litigation; cause a material adverse impact to business operations or financial results; and otherwise result in other material harm to our business.