If we are not able to comply with all safety, health and environmental regulations applicable to our operations and industry, we may be held liable for any breaches of those regulations.
Safety, health and environmental laws and regulations affect nearly all aspects of our operations, including product development, working conditions, waste disposal, emission controls, the maintenance of air and water quality standards and land reclamation, and, with respect to environmental laws and regulations, impose limitations on the generation, transportation, storage and disposal of solid and hazardous waste. Continuing to meet GMP standards, which we follow voluntarily, requires satisfying additional standards for the conduct of our operations and subjects us to ongoing compliance inspections in respect of these standards. Compliance with safety, health and environmental laws and regulations can require significant expenditures, and failure to comply with such safety, health and environmental laws and regulations may result in the imposition of fines and penalties, the temporary or permanent suspension of operations, the imposition ofclean-up costs resulting from contaminated properties, the imposition of damages and the loss of or refusal of governmental authorities to issue permits or licenses to us or to certify our compliance with GMP standards. Exposure to these liabilities may arise in connection with our existing operations, our historical operations and operations that may in the future be closed or sold to third parties. We could also be held liable for worker exposure to hazardous substances and for accidents causing injury or death. There can be no assurance that we will at all times be in compliance with all safety, health and environmental laws and regulations notwithstanding our attempts to comply with such laws and regulations.
Changes in applicable safety, health and environmental standards may impose stricter standards and enforcement, increased fines and penalties fornon-compliance, more stringent environmental assessments of proposed projects and a heightened degree of responsibility for companies and their officers, directors and employees. We are not able to determine the specific impact that future changes in safety, health and environmental laws and regulations may have on our industry, operations and/or activities and our resulting financial position; however, we anticipate that capital expenditures and operating expenses will increase in the future as a result of the implementation of new and increasingly stringent safety, health and environmental laws and regulations. Further changes in safety, health and environmental laws and regulations, new information on existing safety, health and environmental conditions or other events, including legal proceedings based upon such conditions or an inability to obtain necessary permits in relation thereto, may require increased compliance expenditures by us.
We may become subject to liability arising from any fraudulent or illegal activity by our employees, contractors, consultants and others.
We are exposed to the risk that our employees, independent contractors, consultants, service providers and licensors may engage in fraudulent or other illegal activity. Misconduct by these parties could include intentional undertakings of unauthorized activities, or reckless or negligent undertakings of authorized activities, in each case on our behalf or in our service that violate: (i) government regulations, specifically Health Canada regulations; (ii) manufacturing standards; (iii) Canadian federal and provincial healthcare laws and regulations; (iv) laws that require the true, complete and accurate reporting of financial information or data; (v) U.S. federal laws banning the possession, sale or importation of cannabis into the United States and prohibiting the financing of activities outside the United States that are unlawful under Canadian or other foreign laws or (vi) the terms of our agreements with insurers. In particular, we could be exposed to class action and other litigation, increased Health Canada inspections and related sanctions, the loss of current GMP compliance certifications or the inability to obtain future GMP compliance certifications, lost sales and revenue or reputational damage as a result of prohibited activities that are undertaken in the growing or production process of our products without our knowledge or permission and contrary to our internal policies, procedures and operating requirements.
We cannot always identify and prevent misconduct by our employees and other third parties, including service providers and licensors, and the precautions taken by us to detect and prevent this activity may not be effective in controlling unknown, unanticipated or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from such misconduct. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of civil, criminal or administrative penalties, damages, monetary fines and contractual damages, reputational harm, diminished profits and future earnings or curtailment of our operations.
We may experience breaches of security at our facilities or loss as a result of the theft of our products.
Because of the nature of our products and the limited legal channels for distribution, as well as the concentration of inventory in our facilities, we are subject to the risk of theft of our products and other security breaches. A security breach at Tilray Nanaimo or, once completed, one of our planned facilities could result in a significant loss of available products, expose us to additional liability under applicable regulations and to potentially costly litigation or increase expenses relating to the resolution and future prevention of similar thefts, any of which could have an adverse effect on our business, financial condition and results of operations.
We may be subject to risks related to our information technology systems, including the risk that we may be the subject of a cyber-attack and the risk that we may be innon-compliance with applicable privacy laws.
We have entered into agreements with third parties for hardware, software, telecommunications and other information technology, or IT, services in connection with our operations. Our operations depend, in part, on how well we and our vendors protect networks, equipment, IT systems and software against damage from a number of threats, including, but not limited to, cable cuts, damage to physical plants, natural disasters, intentional damage and destruction, fire, power loss, hacking, computer viruses, vandalism and theft. Any of these and other events could result in IT system failures, delays or increases in capital expenses. Our operations also depend on the timely maintenance, upgrade and replacement of networks, equipment and IT systems and software, as well as preemptive expenses to mitigate the risks of failures. The failure of IT systems or a component of IT systems could, depending on the nature of any such failure, adversely impact our reputation and results of operations.
There are a number of laws protecting the confidentiality of certain patient health information, including patient records, and restricting the use and disclosure of that protected information. In particular, the privacy rules under the Personal Information Protection and Electronics Documents Act (Canada), or the PIPEDA, and similar laws in other jurisdictions, protect medical records and other personal health information by limiting their use and the disclosure to the minimum level reasonably necessary to accomplish the intended purpose. We collect and store personal information about our patients and are responsible for protecting that information from privacy breaches. A privacy breach may occur through a procedural or process failure, an IT malfunction or deliberate unauthorized intrusions. Theft of data for competitive purposes, particularly patient lists and preferences, is an ongoing risk whether perpetrated through employee collusion or negligence or through deliberate cyber-attack. Moreover, if we are found to be in violation of the privacy or security rules under PIPEDA or other laws protecting the confidentiality of patient health information, including as a result of data theft and privacy breaches, we could be subject to sanctions and civil or criminal penalties, which could increase our liabilities and harm our reputation.
29