We are subject to stringent and evolving U.S. and foreign laws, regulations, rules, contractual obligations, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse business consequences.
In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, processing) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, business plans, transactions, and financial information (collectively, sensitive data).
Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.
In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the California Consumer Privacy Act of 2018 (“CCPA”) requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. In addition, the California Privacy Rights Act of 2020 (“CPRA”), which becomes operative January 1, 2023, will expand the CCPA’s requirements, including applying to personal information of business representatives and employees and establishing a new regulatory agency to implement and enforce the law.
Other states, such as Virginia, Colorado, Utah and Connecticut have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. These developments may further complicate compliance efforts and may increase legal risk and compliance costs for us and the third parties upon whom we rely.
Outside the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, the European Union’s Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as amended (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal data.
Furthermore, we seek to obtain marketing authorization from the European Union for our drug candidates. Moreover, a significant portion of the personal data that we may use is managed by third parties (primarily clinical sites and CROs in clinical trials). The collection and use of personal health data in the European Union is governed by the provisions of the EU GDPR. Under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to €20 million or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.
In addition, we may be unable to transfer personal data from Europe and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data flows. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the EEA and the United Kingdom (“UK”) have significantly restricted the transfer of personal data to countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there
63