in the United States and abroad, report financial information or data accurately or disclose unauthorized activities to us. In particular, sales, marketing and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs and other business arrangements. Employee misconduct could also involve the improper use of, including trading on, information obtained in the course of clinical trials, which could result in regulatory sanctions and serious harm to our reputation. It is not always possible to identify and deter employee misconduct, and any precautions we take to detect and prevent this activity may be ineffective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant fines or other sanctions. Some of these laws and related risks are described under the risk factor “We may be subject to federal and state healthcare laws and regulations. If we are unable to comply or have not fully complied with such laws and regulations, we could face criminal sanctions, damages, substantial civil penalties, reputational harm and diminished profits and future earnings” of this Quarterly Report.
Our failure to comply with data protection laws and regulations could lead to government enforcement actions and significant penalties against us, and adversely impact our operating results.
We are subject to U.S. data protection laws and regulations, for example, laws and regulations that address privacy and data security, at both the federal and state levels. The legislative and regulatory landscape for data protection continues to evolve, and in recent years there has been an increasing focus on privacy and data security issues. Numerous federal and state laws, including state data breach notification laws, state health information privacy laws, state genetic privacy laws, and federal and state consumer protection laws, including, for example, Section 5 of the Federal Trade Commission Act of 1914, as amended, and the California Consumer Privacy Act, or the CCPA as well as the California Privacy Rights Act, or the CPRA govern the collection, use, and disclosure and protection of certain health-related and other personal information. Failure to comply with data protection laws and regulations could result in government enforcement actions and create liability for us, which could include civil and/or criminal penalties, private litigation and/or adverse publicity that could negatively affect our operating results and business. In addition, we may obtain health information from third parties, such as research institutions with which we collaborate, that are subject to privacy and security requirements under HIPAA. Although we are not directly subject to HIPAA, other than potentially with respect to providing certain employee benefits, we could be subject to criminal penalties if we knowingly obtain or disclose individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA. In addition, state laws govern the privacy and security of health, research and genetic information in specified circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Some of our research activities involve minors, which may be subject to additional laws and can require specialized consent processes, privacy protections, and compliance procedures.
The EU, United Kingdom, Switzerland and other countries have also adopted data protection laws and regulations, which impose significant compliance obligations. In the EU, the collection and use of personal data, including health and genetic data, is governed by the provisions of the General Data Protection Regulation, or GDPR. The GDPR became effective on May 25, 2018, and imposes strict requirements for the processing of the personal data of individuals within the European Economic Area, or EEA. Fines for certain breaches of the GDPR are significant, up to the greater of 20 million Euros or 4 % of total global annual turnover. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease/change our processing of our data, enforcement notices, and/or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. Additionally, from 1 January 2021, we are subject to the GDPR and also the United Kingdom GDPR, which, together with the amended United Kingdom Data Protection Act 2018, retains the GDPR in United Kingdom national law following Brexit. The United Kingdom GDPR mirrors the fines under the GDPR, e.g. fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term. These changes may lead to additional costs and increase our overall risk exposure.