We currently hold limited product liability insurance coverage. We will need to purchase additional product liability insurance coverage as we expand our clinical trials, and if we commence commercialization of our product candidates. Insurance coverage is increasingly expensive. If we are unable to obtain insurance at an acceptable cost or otherwise protect against potential product liability claims, we will be exposed to significant liabilities, which may materially and adversely affect our business and financial position. If we are sued for any injury allegedly caused by our or our collaborators’ products, our liability could exceed our total assets and our ability to pay the liability. A product liability claim or series of claims brought against us would decrease our cash and could cause our stock price to fall.
We are subject to stringent and evolving U.S. and foreign laws, regulations, rules, contractual obligations, policies, contractual and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation (including class actions) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse business consequences.
In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal information and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, and sensitive third-party data. Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contracts, and other obligations that govern the processing of personal information by us and on our behalf.
In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of protected health information. Several states have also enacted comprehensive data privacy laws, which either became effective in 2023 or will become effective within the next couple of years. These state comprehensive data privacy laws provide individuals with certain rights concerning their personal information, including the right to access, correct, or delete certain personal information, and opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. One example of these comprehensive state data privacy laws is, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”) (collectively, “CCPA”), which applies to the personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such California residents to exercise certain rights related to their personal information, such as those noted above. The CCPA provides for administrative fines for noncompliance (up to $7,500 per violation) and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability with respect to other personal information we maintain about California residents. In addition, the CPRA expanded the CCPA’s requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency, the California Privacy Protection Agency, to implement and enforce the law. These new comprehensive data privacy laws (including the CCPA) and individuals’ exercise of their rights under these laws may impact our business and ability to provide our products and services. In addition, other data privacy and security laws have been proposed and others have been passed at the federal, state, and local levels in recent years. While some of these laws exempt data processed in the context of clinical trials, these developments may nonetheless further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely.
Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union’s General Data Protection Regulation (EU GDPR) and the United Kingdom GDPR (UK GDPR) (collectively, GDPR) impose strict requirements for processing personal information, and violators of these laws face significant penalties. For example, under GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros under the EU GDPR (17.5 million British Pounds under the UK GDPR) or 4% of annual global revenue, in either case, whichever is greater, or we may be subject to private litigation related to processing of personal information brought by classes of data subjects or consumer protection