We are subject to stringent privacy and information security laws, regulations, policies and contractual obligations, and changes in such laws, regulations, policies, contractual obligations and failure to comply with such requirements could subject us to significant fines and penalties, which may have a material adverse effect on our business, financial condition, results of operations or prospects.*
We are subject to, or affected by, numerous federal, state and foreign laws and regulations, as well as regulatory guidance, policies and contractual obligations governing the collection, use, disclosure, retention, and security of personal information. The global data protection landscape is rapidly evolving, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. This evolution may create uncertainty in our business, affect our or our collaborators’, service providers’ and contractors’ ability to operate in certain jurisdictions or to collect, store, transfer, use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us or our collaborators, service providers and contractors to comply with federal, state or foreign laws or regulation, our internal policies and procedures or our contracts governing processing of personal information could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others. In many jurisdictions, enforcement actions and consequences for noncompliance are rising.
In the U.S., California adopted the California Consumer Privacy Act, or CCPA, which became effective in January 2020. The CCPA establishes a privacy framework for covered businesses, including an expansive definition of personal information and data privacy rights for California residents. The CCPA authorizes the imposition of potentially severe statutory damages and created a private right of action for data security breaches. The CCPA requires covered businesses to provide new disclosures to California residents and to provide them new ways to opt-out of certain disclosures of personal information. Although there are limited exemptions for clinical trial and other research-related data under the CCPA, the CCPA and other similar laws could impact our business depending on how the CCPA will be interpreted and exemplifies the vulnerability of our business to the evolving regulatory environment related to personal information. As we expand our operations, the CCPA may increase our compliance costs and potential liability. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the U.S. Other states are beginning to propose similar laws.
Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms to ensure compliance with the new data protection rules. If we fail to comply with any such laws or regulations, we may face significant fines and penalties that could adversely affect our business, financial condition and results of operations. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly.
Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. Many countries in these regions have established or are in the process of establishing privacy and data security legal frameworks with which we, our collaborators, service providers, including our CROs, and contractors must comply. For example, the European Union has adopted the GDPR, which went into effect in May 2018 and imposes strict requirements for processing the personal information of individuals in the EU, including clinical trial data. The GDPR has and will continue to increase compliance burdens on us, including by mandating potentially burdensome documentation requirements and granting certain rights to individuals to control how we collect, use, disclose, retain and process information about them. The processing of sensitive personal information, such as health information, may impose heightened compliance burdens under the GDPR and is a topic of active interest among foreign regulators. In addition, the GDPR provides for robust regulatory enforcement and fines of up to €20 million or 4% of the annual global revenue of the noncompliant company, whichever is greater. Further, the United Kingdom’s decision to leave the EU, often referred to as Brexit, has created uncertainty with regard to data protection regulation in the UK. In particular, while the Data Protection Act of 2018, that “implements” and complements the GDPR achieved Royal Assent on May 23, 2018 and is now effective in the United Kingdom, it is still unclear whether transfer of data from the EEA to the United Kingdom will remain lawful under GDPR. During the period of “transition” (i.e., until December 31, 2020), EU law will continue to apply in the UK, including the GDPR, after which the GDPR will be converted into UK