We are subject to certain U.S. and foreign anti-corruption, anti-money laundering, export control, sanctions, and other trade laws and regulations. We can face serious consequences for violations.
Among other matters, U.S. and foreign anti-corruption, anti-money laundering, export control, sanctions, and other trade laws and regulations, which are collectively referred to as Trade Laws, prohibit companies and their employees, agents, clinical research organizations, legal counsel, accountants, consultants, contractors, and other partners from authorizing, promising, offering, providing, soliciting, or receiving directly or indirectly, corrupt or improper payments or anything else of value to or from recipients in the public or private sector. Violations of Trade Laws can result in substantial criminal fines and civil penalties, imprisonment, the loss of trade privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm, and other consequences. We have direct or indirect interactions with officials and employees of government agencies or government-affiliated hospitals, universities, and other organizations. We also expect our non-U.S. activities to increase in time. We plan to engage third parties for clinical trials and/or to obtain necessary permits, licenses, patent registrations, and other regulatory approvals and we can be held liable for the corrupt or other illegal activities of our personnel, agents, or partners, even if we do not explicitly authorize or have prior knowledge of such activities.
We are subject to stringent privacy laws, information security policies and contractual obligations governing the use, processing and transfer of personal information.
We receive, generate and store significant and increasing volumes of sensitive information, such as health information, insurance information and other potentially personally identifiable information. We face a number of risks relative to protecting this critical information, including loss of access risk, inappropriate use or disclosure, inappropriate modification and the risk of our being unable to adequately monitor, audit and modify our controls over our critical information. This risk extends to the third-party vendors we use to manage this sensitive data.
We are subject to a variety of local, state, national and international laws, directives and regulations that apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal data in the different jurisdictions in which we operate, including comprehensive regulatory systems in the U.S. and Europe. Further, various states have implemented certain data privacy and security laws and regulations that impose restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. California enacted the California Consumer Privacy Act, or CCPA, which creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal data. The CCPA went into effect on January 1, 2020, and became enforceable by the California Attorney General on July 1, 2020. The CCPA has been amended from time to time, and, further a new privacy law, the California Privacy Rights Act, or CPRA, was approved by California voters in the November 3, 2020 election. Effective starting January 1, 2023, the CPRA will significantly modify the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. It remains unclear what, if any, further modifications will be made to the CCPA or CPRA, or how such legislation will be interpreted. This may potentially result in further uncertainty and require us to incur additional costs and expenses in efforts to comply. Certain other state laws impose similar privacy obligations and all 50 states have laws including obligations to provide notification of security breaches of computer databases that contain personal information to affected individuals, state officers and others. For example, the CCPA has prompted a number of proposals for new federal and state-level privacy legislation. This legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.
39