exposure to hazardous substances, will not occur in the future or have not occurred in the past, including as a result of human error, accidents, equipment failure or other causes. The costs of complying with environmental laws and regulations, and liabilities that may be imposed for violating them, or for remediation obligations or responding to third-party claims, could have a material adverse effect on our business, results of operations, cash flows, financial condition and/or prospects.
Although we believe that we hold all permits required for our use of hazardous materials, any failure to comply with applicable laws and regulations could result in fines, suspension of permits or authorizations or claims for damages, which could have a material adverse effect on our business, results of operations, cash flows, financial condition and/or prospects.
We are subject to risks related to data privacy concerns, cyber security breaches and failure to comply with laws, regulations, standards, and contracts relating to data privacy and security.
We are subject to evolving data protection laws, privacy and security requirements and other regulatory restrictions in the various jurisdictions in which we operate. These laws are subject to differing interpretations and may be inconsistent among jurisdictions, and guidance on implementation and compliance practices are often updated or otherwise revised, which adds to the complexity of processing personal information. During the course of our business, we come in the possession of sensitive personal data, including information from clinical trials, and health data obtained in connection with reporting of adverse events and may store or process such information outside the country in which it was collected. This information needs to be handled by us in compliance with such obligations. These and other obligations could require us or our partners to incur additional costs to achieve compliance, limit our competitiveness, necessitate the acceptance of more onerous obligations in our contracts, restrict our ability to use, store, transfer, and process data, impact our or our partners’ ability to process or use data in order to support the provision of our products or services, affect our or our partners’ ability to offer our products and services or operate in certain locations, cause regulators to reject, limit, or disrupt our clinical trial activities, result in increased expenses, reduce overall demand for our products and services and make it more difficult to meet expectations of or commitments to customers or collaborators
Furthermore, our failure to keep apprised of, and comply with, privacy, data use and security laws, standards and regulations, including, for instance, unauthorized disclosure of, or access to, data, could result in the suspension or revocation of our approvals or registrations, the limitation, suspension or termination of services or the imposition of administrative, civil or criminal penalties, including fines. For example, under the EU General Data Protection Regulation that entered into force in May 25, 2018, fines may be as high as 20 million Euros or 4% of the annual worldwide revenue, whichever is higher, for certain infringements. Laws such as the GDPR and EU member state laws may also apply to health-related and other personal information that we process. These laws impose strict obligations on the ability to process health-related and other personal information of data subjects in the European Union and the United Kingdom, including, among other things, standards relating to the privacy and security of personal data, which require the adoption of administrative, physical and technical safeguards designed to protect such information. These laws may affect our use, collection, analysis, and transfer (including cross-border transfer) of such personal information. These laws include several requirements relating to transparency requirements related to communications with data subjects regarding the processing of their personal data, obtaining the consent of the individuals to whom the personal data relates, limitations on data processing, establishing a legal basis for processing, notification of data processing obligations or security incidents to appropriate data protection authorities or data subjects, the security and confidentiality of the personal data and various rights that data subjects may exercise. The GDPR prohibits the transfer, without an appropriate legal basis, of personal data to countries outside of the European Economic Area, or EEA, such as the United States, which are not considered by the European Commission to provide an adequate level of data protection. Switzerland has adopted similar restrictions. Although there are legal mechanisms to allow for the transfer of personal data from the EEA and Switzerland to the United States, uncertainty about compliance with EU data protection laws remains and such mechanisms may not be available or applicable with respect to the personal data processing activities necessary to research, develop, and market
43