In the ordinary course of business, we collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share, or collectively, Process (or Processing of), personal data and other sensitive and confidential information, including information we collect about patients in connection with clinical trials, sensitive third-party data or, as necessary to operate our business, for legal and marketing purposes, and for other business-related purposes.
Accordingly, we are, or may become, subject to numerous federal, state, local and international data privacy and security laws, regulations, guidance and industry standards as well as external and internal privacy and security policies, contracts and other obligations that apply to the Processing of personal data by us and on our behalf, collectively, Data Protection Requirements. The number and scope of Data Protection Requirements are changing, subject to differing applications and interpretations, and may be inconsistent between jurisdictions or in conflict with each other. If we fail, or are perceived to have failed, to address or comply with Data Protection Requirements, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions against us that could include investigations, fines, penalties, audits and inspections, additional reporting requirements and/or oversight, temporary or permanent bans on all or some Processing of personal data, orders to destroy or not use personal data. Further, individuals or other relevant stakeholders could bring a variety of claims against us for our actual or perceived failure to comply with the Data Protection Requirements. Any of these events could have a material adverse effect on our reputation, business, or financial condition, and could lead to a loss of actual or prospective customers, collaborators or partners; interrupt or stop clinical trials; result in an inability to Process personal data or to operate in certain jurisdictions; limit our ability to develop or commercialize our products; or require us to revise or restructure our operations, or each, a material adverse impact.
We are, or may become, subject to U.S. privacy laws. For example, in the U.S., there are a broad variety of data protection laws and regulations that may apply to our activities such as state data breach notification laws, state personal data privacy laws (for example, the CCPA), state health information privacy laws, and federal and state consumer protection laws.
A number of U.S. states have enacted data privacy laws. In particular, the CCPA, together with the CPRA, requires covered businesses that process personal data of California residents to disclose their data collection, use and sharing practices. Further, the CCPA provides California residents with new data privacy rights (including the ability to opt out of the sale of personal data), imposes new operational requirements for covered businesses, provides for civil penalties for violations (up to $7,500 per violation), as well as a private right of action for certain data breaches (that is expected to increase data breach class action litigation and result in significant exposure to costly legal judgements and settlements). The CPRA, among other things, gives California residents the ability to limit use of certain sensitive personal data, establishes restrictions on the retention of personal data, expands the types of data breaches subject to the CCPA's private right of action, and establishes a new California Privacy Protection Agency to implement and enforce the new law. Although there are limited exemptions for clinical trial data under the CCPA and the CPRA, the CCPA and the CPRA may increase compliance costs and potential liability with respect to other personal data we maintain about California residents. The federal government is also considering comprehensive privacy legislation.
The DSP preventing access to bulk U.S. sensitive personal data by certain countries or persons is new, complex and only recently enforceable, and as such, there is a risk that our interpretation of its applicability, scope, and requirements is incorrect, incomplete, or misapplied. Compliance with the DSP may now, or in the future, require us to invest heavily in data security and compliance measures, such as implementing and complying with the Cybersecurity and Infrastructure Security Agency's guidelines and other burdensome recordkeeping, reporting, and auditing requirements. It may also require us to implement new processes, stop or restrict certain data transfers, alter the geographic scope of our operations, cease doing business with certain third parties or using certain tools or vendors, or change how data flows throughout our business, any of which could materially impact our business operations or hinder our ability to grow our business. Finally, non-compliance with the DSP could result in significant civil or criminal penalties, which could materially adversely affect our business, results of operations, and financial condition.
Outside the U.S., an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union's General Data Protection Regulation, or EU GDPR, the United Kingdom's GDPR, or UK GDPR, Japan's Act on the Protection of Personal Information, or APPI, China's Personal Information Protection Law, or PIPL, and Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or LGPD) (Law No. 13,709/2018) impose strict requirements for processing personal data. Under the EU GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater. Further, individuals may initiate litigation related to processing of their personal data.
European data protection laws (including the EU GDPR and UK GDRP) are wide-ranging in scope and impose numerous, significant and complex compliance burdens in relation to the Processing of personal data, such as: limiting permitted Processing of personal data to only that which is necessary for specified, explicit and legitimate purposes; requiring the establishment of a legal basis for Processing personal data; broadening the definition of personal data; creating obligations for controllers and processors to appoint data protection officers in certain circumstances; increasing transparency obligations to data subjects; requiring data protection impact assessments in certain circumstances; establishing limitations on the collection and retention of personal data through "data minimization" and "storage limitation" principles; honoring data subject rights; formalizing a heightened standard to obtain data subject consent; establishing obligations to implement certain technical and organizational safeguards to protect the security and confidentiality of personal data; introducing the obligation to provide notice of certain significant personal data breaches to the relevant supervisory authority(ies) and affected individuals; and mandating the appointment of representatives in the UK and/or EU in certain circumstances. In particular, the Processing of "special categor[ies] [of] personal data" (such as personal data related to health and genetic information), which could be relevant to our operations in the context of our clinical trials, imposes heightened compliance burdens under European data protection laws and is a topic of active interest among relevant regulators.
Certain jurisdictions have enacted data localization laws and cross-border personal data transfer laws, which could make it more difficult to transfer information across jurisdictions (such as transferring or receiving personal data that originates in the EU or in other foreign jurisdictions). Existing mechanisms that facilitate cross-border personal data transfers may change or be invalidated. For example, absent appropriate safeguards or other circumstances, the EU GDPR generally restricts the transfer of personal data to countries outside of the European Economic Area, or EEA, that the European Commission does not consider to provide an adequate level of data privacy and security, such as the U.S. The European Commission released a set of "Standard Contractual Clauses," or SCCs, that are designed to be a valid mechanism to facilitate personal data transfers out of the EEA to these jurisdictions. Currently, these SCCs are a valid mechanism to transfer personal data outside of the EEA, but there exists a possibility that the validity of SCCs will be challenged in European courts. Additionally, the SCCs impose additional compliance burdens, such as conducting transfer impact assessments to determine whether additional security measures are necessary to protect the at-issue personal data.
In addition, Switzerland and the UK similarly restrict personal data transfers outside of those jurisdictions to countries that they do not consider to provide an adequate level of personal data protection, such as the U.S., and certain countries outside Europe (e.g., Brazil) have also passed or are considering laws requiring local data residency or otherwise impeding the transfer of personal data across borders, any of which could increase the cost and complexity of doing business.
While we use SCCs for transfers of personal data from the EEA, UK and Switzerland to recipients in non-adequate countries, in the event we are unable to implement a valid compliance mechanism for cross-border data transfers (e.g., SCCs are invalidated), we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. Inability to import personal data to the U.S. may significantly and negatively impact our business operations, including by limiting our ability to conduct clinical trial activities in Europe and elsewhere; limiting our ability to collaborate with parties subject to European and other data protection laws or requiring us to increase our personal data processing capabilities in Europe and/or elsewhere at significant expense.
These laws exemplify the vulnerability of our business to the evolving regulatory environment related to personal data and may require us to modify our Processing practices at substantial costs and expenses in an effort to comply. Given the breadth and evolving nature of Data Protection Requirements, preparing for and complying with these requirements is rigorous, time-intensive and requires significant resources and a review of our technologies, systems and practices, as well as those of any third-party collaborators, service providers, contractors or consultants that Process personal data on our behalf.
We may publish privacy policies and other documentation regarding our Processing of personal data and/or other confidential, proprietary or sensitive information. Although we endeavor to comply with our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, third-party collaborators, service providers, contractors or consultants fail to comply with our policies and documentation. Such failures can subject us to potential regulatory action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Moreover, subjects about whom we or our partners obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information. Claims that we have violated individuals' privacy rights or failed to comply with data protection laws or applicable privacy notices even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business or have other material adverse impacts.