some countries are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our services and research activities. These laws and regulations, as well as any associated claims, inquiries, or investigations or any other government actions may lead to unfavorable outcomes including increased compliance costs, delays or impediments in the development of new products, negative publicity, increased operating costs, diversion of management time and attention, and remedies that harm our business, including fines or demands or orders that we modify or cease existing business practices.
If we, our agents, or our third party partners fail to comply or are alleged to have failed to comply with these or other applicable data protection and privacy laws and regulations, or if we were to experience a data breach involving personal information, we could be subject to government enforcement actions or private lawsuits. Any associated claims, inquiries, or investigations or other government actions could lead to unfavorable outcomes that have a material impact on our business including through significant penalties or fines, monetary judgments or settlements including criminal and civil liability for us and our officers and directors, increased compliance costs, delays or impediments in the development of new products, negative publicity, increased operating costs, diversion of management time and attention, or other remedies that harm our business, including orders that we modify or cease existing business practices.
In addition to laws and regulations enacted in the United States, including the new California Consumer Privacy Act of 2018, the EU’s legislative and regulatory landscape for privacy and data security continues to evolve. There has been increased attention to privacy and data security issues that could potentially affect our business, including the EU General Data Protection Regulation (GDPR), which entered into effect on May 25, 2018 and imposes penalties up to 4% of annual global turnover for breaches of related obligations.
In the event we enroll patients in our ongoing or future clinical trials in the European Economic Area (the EEA), we will be subject to the additional privacy restrictions imposed by the General Data Protection Regulation (the GDPR), including restrictions relating to the collection, use, storage, transfer, and other processing of personal data, including personal health data, regarding individuals in the EEA as governed by the GDPR and the related national data protection laws of the individual EEA countries. The GDPR imposes several requirements on companies that process personal data, with especially strict rules on the transfer of personal data out of the EEA, including to the U.S, and fines and penalties for failure to comply with the requirements of the GDPR and the related national data protection laws of the individual EEA countries. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. The obligations under the GDPR may be onerous and adversely affect our business, financial condition, results of operations and prospects. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with any EEA activities. Further, the United Kingdom’s exit from the EU, often referred to as Brexit, has created uncertainty with regard to future data protection regulation in the United Kingdom.
Because of the remote work policies we implemented due to the COVID-19 pandemic, information that is normally protected, including company confidential information, may be less secure. Cybersecurity and data security threats continue to evolve and raise the risk of an incident that could affect our operations or compromise our business information or sensitive personal information, including health data.
We may also need to collect more extensive health-related information from our employees to manage our workforce. If we or our third party partners fail to comply or are alleged to have failed to comply with applicable data protection and privacy laws and regulations, and related employment rules, or if we were to experience a data breach involving personal information, we could be subject to government enforcement actions or private lawsuits.
In addition, our business could be adversely impacted if our ability to transfer personal data outside of the EEA or Switzerland is restricted, which could adversely impact our operating results. For example, in July 2020, the Court of Justice of the European Union, or the Court of Justice, declared the Privacy Shield Decision (Decision 2018/1250) invalid, which could adversely impact our ability to transfer personal data from the EU to the U.S. The Court of Justice