Government regulations outside the United States have, and may continue to, become increasingly stringent and common. In the European Union, for example, the European Union Medical Device Regulation was published in 2017 and, when it entered into full force in 2020, included significant additional pre-market and post-market requirements. Penalties for regulatory non-compliance could be severe, including fines and revocation or suspension of a company’s business license, mandatory price reductions, and criminal sanctions. Future laws and regulations may have a material adverse effect on our end customers in the healthcare market, which in turn may negatively impact our ability to sell our solutions and otherwise harm our business and financial results.
Export Regulation
Our business activities are also subject to various restrictions under U.S. export and similar laws and regulations, as well as various economic and trade sanctions administered by the U.S. Treasury Department’s Office of Foreign Assets Control. Further, various countries regulate the import of certain technology and have enacted or could enact laws that could limit our ability to provide customers with our products in those countries.
We are also subject to various domestic and international anti-corruption laws, such as the U.S. Foreign Corrupt Practices Act and the U.K. Bribery Act, as well as other similar anti-bribery and anti-kickback laws and regulations. These laws and regulations generally prohibit companies, their employees, and their intermediaries from authorizing, offering, providing, and/or accepting improper payments or other benefits for improper purposes. Although we take precautions to prevent violations of these laws, our exposure for violating these laws increases as our international presence expands and as we increase sales and operations in foreign jurisdictions.
New legislation or regulation, the application of laws from jurisdictions whose laws do not currently apply to our business, or the application of existing laws and regulations to technology in the wearables industry generally could result in significant additional compliance costs and responsibilities for our business.
Privacy
We are or may become subject to a variety of laws and regulations in the United States and abroad regarding privacy, data protection, and data security. These laws and regulations are continuously evolving and developing. The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, particularly with respect to foreign laws.
In particular, there are numerous U.S. federal, state, and local laws and regulations and foreign laws and regulations regarding privacy and the collection, sharing, use, processing, disclosure, and protection of personal data. Such laws and regulations often have changes in scope, may be subject to differing interpretations, and may be inconsistent among different jurisdictions. For example, the General Data Protection Regulation (the “GDPR”), which became effective in May 2018, includes operational requirements for companies that receive or process personal data of residents of the European Union that are broader and more stringent than those previously in place in the European Union. The GDPR includes significant penalties for non-compliance, including fines of up to €20 million or 4% of total worldwide revenue. Additionally, in June 2018, California enacted the California Consumer Privacy Act (the “CCPA”), which became effective in January 2020. The CCPA requires covered companies to provide California consumers with new disclosures and expands the rights afforded consumers regarding their data. Fines for noncompliance may be up to $7,500 per violation. We cannot currently estimate the potential impact of the CCPA on our business or operations.
Additionally, we rely on various legal mechanisms for transferring certain personal data outside of the European Economic Area, or EEA, including the EU-U.S. Privacy Shield Framework, or Privacy Shield, and EU Standard Contractual Clauses, or SCCs. If we fail or are perceived to fail to meet the Privacy Shield principles or our obligations under the SCCs, or if any of these legal mechanisms for transferring data from the EEA are invalidated by European courts or otherwise become defunct, European Union data protection authorities or the U.S. Federal Trade Commission, or FTC, could bring enforcement actions seeking to prohibit or suspend our data transfers or alleging unfair or deceptive practices. In such cases, we could be required to make potentially expensive changes to our information technology infrastructure and business operations, and we could face legal liability, fines, negative publicity, and resulting loss of business.
Certain health-related laws and regulations such as the Health Insurance Portability and Accountability Act of 1996, or HIPAA, and the Health Information Technology for Economic and Clinical Health Act, or HITECH, may also have an impact on our business. If we are unable to comply with the applicable privacy and security requirements under HIPAA, HITECH, or PCI DSS, or we fail to comply with BAAs that we enter into with covered entities, we could be subject to claims, legal liabilities, penalties, fines, and negative publicity, which could harm our operating results.
Governments are continuing to focus on privacy and data security, and it is possible that new privacy or data security laws will be passed, or existing laws will be amended in a way that is material to our business. Any significant change to applicable laws, regulations, or industry practices regarding our users’ data could require us to modify our services and features, possibly in a material manner, and may limit our ability to develop new products, services, and features. Although we have made efforts to design our policies, procedures, and systems to comply with the current requirements of applicable state, federal, and foreign laws, changes to applicable laws and regulations in this area could subject us to additional regulation and oversight, any of which could significantly increase our operating costs.
We strive to comply with all applicable laws, policies, legal obligations, and industry codes of conduct relating to privacy, data security, and data protection. The costs of compliance with, and other burdens imposed by, the GDPR, CCPA, HIPAA, and similar laws may limit the use and adoption of our products and services, and/or require us to incur substantial compliance costs, which could have
14