Risks Related to Cybersecurity, Data Protection and Privacy
Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer.
In the ordinary course of our business, we store sensitive data, including intellectual property, proprietary business information and personally identifiable information, in our data centers and on our networks. The secure processing, maintenance and transmission of this information is critical to our operations and business strategy. Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance, or other disruptions. Any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Any such access, disclosure or other loss of information could result in significant costs to address and remediate the incident, lead to legal claims or proceedings, disrupt our operations, and damage our reputation.
We maintain cyber risk insurance, but this insurance may not be sufficient to cover all of our losses from any future breaches of our systems.
Our collection, control, processing, sharing, disclosure and otherwise use of personal data could give rise to liabilities as a result of governmental regulation, conflicting legal requirements, and evolving laws concerning data privacy in the E.U. and E.E.A.
The regulatory environment with regard to privacy and data protection issues is increasingly challenging. For example, the GDPR repealed the Data Protection Directive (95/46/EC) and is directly applicable in all E.U. and E.E.A. Member States since its effective date of May 25, 2018. The GDPR applies to companies established in the E.U. or E.E.A., as well as companies that are not established in the E.U. or E.E.A. and which collect and use personal data in relation to offering goods or services to, or monitoring the behavior of, individuals located in the E.U. or E.E.A., including, for example, through the conduct of clinical trials (whether the trials are conducted directly by the company itself or through a clinical vendor or collaborators). The GDPR permits E.U. and E.E.A. Member State derogations for certain matters and, accordingly, we are also subject to E.U. national laws relating to the processing of certain data such as genetic data, biometric data and health data. It imposes a strict data protection compliance regime including: providing detailed disclosures about how personal data is collected and processed (in a concise, intelligible and easily accessible form); demonstrating that valid consent or another an appropriate legal basis is in place or otherwise exists to justify data processing activities; appointing data protection officers in certain circumstances; granting new rights for data subjects in regard to their personal data (including the right to be “forgotten” and the right to data portability), as well as enhancing current rights (e.g., data subject access requests); introducing the obligation to notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches; imposing limitations on retention of personal data; maintaining a record of data processing; defining for the first time pseudonymized (i.e., key-coded) data; and complying with principal of accountability and complying with the obligation to demonstrate compliance through policies, procedures, training and audit.
We are also subject to E.U. rules with respect to cross-border transfers of personal data out of the E.U. and E.E.A. These rules are under scrutiny from time to time. For example, the Court of Justice of the European Union (the “CJEU”) ruled in July 2020 that the EU-U.S. Privacy Shield was invalid. The E.U.-U.S. Privacy Shield Framework was designed by the U.S. Department of Commerce and the European Commission to provide companies operate in both regions with a mechanism to comply with data protection requirements when transferring personal data from the European Union to the United States in support of numerous business activities. Following the decision of the CJEU, the E.U.-U.S. Privacy Shield can no longer be used as a legal basis for transferring personal data from the European Union to the United States and the CJEU made clear that standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield) may not be a sufficient alternative. Identifying an alternative data transfer mechanism may lead to additional costs, complaints or regulatory investigations or fines. If we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we conduct our clinical trials and could adversely affect our business and financial results.
We depend on a number of third parties in relation to the operation of our business (including clinical research organizations), a number of which process personal data on our behalf. There is no assurance that our own privacy and security-related safeguards and/or any contractual measures that we enter into with these providers will protect us from the risks associated with the third-party processing, storage and transmission of such information. Any violation of data or security laws by our third-party processors could have a material adverse effect on our business and result in the fines and penalties outlined below.
Fines for certain breaches of the GDPR are significant: up to the greater of 4% of total worldwide turnover, or €20 million. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease/ change our processing of our data, enforcement notices, assessment notices (for a compulsory audit), as well potential civil claims including class action type litigation where individuals suffer harm. Our actual or alleged failure to comply with the GDPR could result in enforcement actions and significant penalties against us (as outlined above), which could result in negative publicity, increase our operating, business and/or legal costs, subject us to claims or other remedies and have a material adverse effect on our clinical trials, business, financial condition, and operations.
We are also subject to evolving E.U. privacy laws on cookies, and e-marketing. The E.U. is in the process of replacing the e-Privacy Directive with a new set of rules taking the form of a regulation. The draft E-Privacy Regulation imposes strict opt-in marketing rules with limited exceptions for business-to-business communications, alters rules on third-party cookies, web beacons and similar technology and significantly increases fining powers to the same levels as the GDPR (i.e. the greater of 20 million Euros or 4% of total global annual revenue). While the e-Privacy Regulation was originally intended to be adopted on May 25, 2018 (alongside the GDPR), it is still going through the European legislative process and commentators now expect it to be adopted during the second half of 2020 or during 2021 following a transition period. We are likely to be required to expend further capital and other resources to ensure compliance with these changing laws and regulations.
52