Any such security compromise or other event that leads to actual or suspected, or is alleged to lead to, unauthorized access, use, or disclosure of Confidential Information, including personal information regarding our clinical trial subjects or employees, could also harm our reputation directly, compel us to comply with federal and/or state breach notification laws and foreign law equivalents, expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties and fines or mandatory corrective action, and otherwise subject us to liability and proceedings (such as class actions), including under laws and regulations that protect the privacy and security of personal information, and/or significant incident response, system restoration or remediation and future compliance costs, which could adversely affect our results of operations, business or financial condition.
Further, we rely on third-party service providers and technologies to operate critical business systems to process Confidential Information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.
In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised. We have and will enter into collaboration, license, contract research and/or manufacturing relationships with organizations that operate in certain countries that are at heightened risk of theft of technology, data and intellectual property through direct intrusion by private parties or foreign actors, including those affiliated with or controlled by state actors. Accordingly, our efforts to protect and enforce our intellectual property rights around the world may be inadequate to obtain a significant commercial advantage from the intellectual property that we develop or license, and we may be at heightened risk of losing our proprietary intellectual property rights around the world, including outside of such countries, to the extent such theft or intrusion destroy the proprietary nature of our intellectual property.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our data privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.
We are subject to stringent and evolving U.S. and foreign laws, regulations, rules, contractual obligations, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse business consequences.
In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit and share (collectively, processing) personal information and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials and sensitive third-party data. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements and other obligations relating to data privacy and security.
In the United States, federal, state and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act) and other similar laws. For example, the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, HIPAA), imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information, such as information we may obtain from research institutions from which we obtain clinical trial data. Depending on the facts and circumstances, we could be subject to significant penalties if we violate HIPAA. The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, (collectively, CCPA) requires covered businesses that process the personal information of California residents
50