In many activities, including the conduct of clinical trials, we are subject to domestic and international laws and regulations governing data privacy, data security, and the protection of health-related and other personal information. The regulatory framework for collecting, using, safeguarding, sharing, transferring and other processing of personal information worldwide is rapidly evolving and in recent years there has been an increasing focus on privacy and data security issues with the potential to affect our business.
In the U.S., numerous federal and state laws and regulations, including state data breach notification laws, and federal and state consumer protection laws govern the collection, use, disclosure and protection of health-related and other personal information. Failure to comply with data protection laws and regulations, where applicable, could result in government enforcement actions, which could include civil or criminal penalties, private litigation and/or adverse publicity and could negatively affect our operating results and business. For example, California enacted the California Consumer Privacy Act (the CCPA), which took effect on January 1, 2020, and gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, in 2020, California voters passed the California Privacy Rights Act (the CPRA), which became effective as of January 1, 2023. The CPRA significantly amends the CCPA and imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also creates a new regulatory entity, the California Privacy Protection Agency, which is authorized to issue substantive regulations under the CPRA and could result in increased privacy and information security enforcement. Although the CCPA currently exempts certain health-related information, including clinical trial data, the CCPA and the CPRA may increase our compliance costs and potential liability. In addition to California, more U.S. states are enacting similar legislation, increasing compliance complexity and increasing risks of failures to comply. In 2023, comprehensive privacy laws in Virginia, Colorado, Connecticut, and Utah all took effect, and laws in Montana, Oregon, and Texas will take effect in 2024. In addition, laws in other U.S. states are set to take effect beyond 2024, and additional U.S. states have proposals under consideration, all of which are likely to increase our regulatory compliance costs and risks, exposure to regulatory enforcement action and other liabilities.
Additionally, the collection, use, disclosure, transfer, or other processing of personal data in the European Union, including personal health data, is subject to the General Data Protection Regulation, or GDPR, which took effect in 2018 and applies to companies within and outside of the European Union. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification and the use of third-party processors in connection with the processing of the personal data. The GDPR also enhances enforcement authority and imposes large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the infringer, whichever is greater. Additionally, the GDPR confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In addition, the withdrawal of the United Kingdom from the European Union and the subsequent separation of the data protection regimes of these territories mean we are required to also comply with similar data protection laws in the United Kingdom, which may lead to additional compliance costs and could increase our overall risk.
Laws in the European Economic Area (EEA), Switzerland, and the UK on data export are also evolving. For example, the GDPR only permits exports of data outside the EU where there is a suitable data transfer solution in place to safeguard personal data (e.g. the EU Commission approved Standard Contractual Clauses or certification under the recently-adopted Data Privacy Framework). If we have to rely on third parties to carry out services for us, including processing personal data on our behalf, we are required under GDPR and similar laws in Switzerland and the UK to enter into contractual arrangements to help ensure that these third parties only process such data according to our instructions and have sufficient security measures in place. Any security breach or non-compliance with our contractual terms or breach of applicable law by such third parties could result in enforcement actions, litigation, fines and penalties or adverse publicity and could cause customers to lose trust in us, which would have an adverse impact on our reputation and business. Future actions of EU, Swiss, and UK data protection authorities are difficult to predict. Some customers or other may respond to these evolving laws and regulations by asking us to make certain privacy or data-related contractual commitments that we are unable or unwilling to make. This could lead to the loss of current or prospective customers or other business relationships.
Numerous international, federal and state laws and regulations govern collection, dissemination, use and confidentiality of personally identifiable health information, including state privacy and confidentiality laws (including state laws requiring disclosure of breaches); federal and state consumer protection and employment laws; HIPAA; and European and other international data protection laws. These laws and regulations are increasing in complexity and number, may change frequently and sometimes conflict.
HIPAA establishes a set of national privacy and security standards for the protection of individually identifiable health information, including protected health information, or PHI, by health plans, certain healthcare clearinghouses and healthcare providers that submit certain covered transactions electronically, or covered entities, and their ‘‘business associates,'' which are persons or entities that perform certain services for, or on behalf of, a covered entity that involve creating, receiving, maintaining or transmitting PHI. While we are not currently a covered entity or business associate under HIPAA, we may receive identifiable information from these entities. Failure to receive this information properly could subject us to HIPAA's criminal penalties, which may include fines up to $50,000 per violation and/or imprisonment. In addition, responding to government investigations regarding alleged violations of these and other laws and regulations, even if ultimately concluded with no findings of violations or no penalties imposed, can consume company resources and impact our business and, if public, harm our reputation.
In addition, various states, such as California and Massachusetts, have implemented similar privacy laws and regulations, such as the California Confidentiality of Medical Information Act, that impose restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. California's patient privacy laws, for example, provide for penalties of up to $250,000 and permit injured parties to sue for damages.
Other states have implemented similar laws protecting identifiable health and personal information, and most such laws differ from each other in significant ways and may not be preempted by HIPAA, thus complicating compliance efforts.
The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our clients and potentially exposing us to additional expense, adverse publicity and liability. Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify.
In addition, the interpretation and application of consumer, health-related, and data protection laws are often uncertain, contradictory, and in flux.
The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues which may affect our business. Despite our efforts, we may not have fully complied in the past and may not in the future. Failure to comply with current and future laws and regulations could result in government enforcement actions (including the imposition of significant penalties), criminal and civil liability for us and our officers and directors, private litigation and/or adverse publicity that negatively affects our business.