RISKS RELATING TO INFORMATION TECHNOLOGY AND DATA PRIVACY
Significant disruptions of information technology systems, breaches of data security, or unauthorized disclosures of sensitive data or personally identifiable information or individually identifiable health information could adversely affect our business, and could subject us to liability or reputational damage.
Our business is increasingly dependent on critical, complex, and interdependent information technology (IT) systems, including Internet-based systems, some of which are managed or hosted by third parties, to support business processes as well as internal and external communications. The size and complexity of our IT systems make us potentially vulnerable to IT system breakdowns, malicious intrusion, and computer viruses, which may result in the impairment of our ability to operate our business effectively. In addition, having a significant portion of our employees work remotely due to the COVID-19 Pandemic can strain our information technology infrastructure, which may affect our ability to operate effectively, may make us more susceptible to communications disruptions, and expose us to greater cybersecurity risks.
We are continuously evaluating and, where appropriate, enhancing our IT systems to address our planned growth, including to support our planned manufacturing operations. There are inherent costs and risks associated with implementing the enhancements to our IT systems, including potential delays in access to, or errors in, critical business and financial information, substantial capital expenditures, additional administrative time and operating expenses, retention of sufficiently skilled personnel to implement and operate the enhanced systems, demands on management time, and costs of delays or difficulties in transitioning to the enhanced systems, any of which could harm our business and results of operations. In addition, the implementation of enhancements to our IT systems may not result in productivity improvements at a level that outweighs the costs of implementation, or at all. In addition, our systems and the systems of our third-party providers and collaborators are potentially vulnerable to data security breaches which may expose sensitive data to unauthorized persons or to the public. Such data security breaches could lead to the loss of confidential information, trade secrets or other intellectual property, could lead to the public exposure of personal information (including personally identifiable information or individually identifiable health information) of our employees, clinical trial patients, customers, business partners, and others, could lead to potential identity theft, or could lead to reputational harm. Data security breaches could also result in loss of clinical trial data or damage to the integrity of that data. In addition, the increased use of social media by our employees and contractors could result in inadvertent disclosure of sensitive data or personal information, including but not limited to, confidential information, trade secrets and other intellectual property.
Any such disruption or security breach, as well as any action by us or our employees or contractors that might be inconsistent with the rapidly evolving data privacy and security laws and regulations applicable within the United States and elsewhere where we conduct business, could result in enforcement actions by U.S. states, the U.S. Federal government or foreign governments, liability or sanctions under data privacy laws, including healthcare laws such as HIPAA, that protect certain types of sensitive information, regulatory penalties, other legal proceedings such as but not limited to private litigation, the incurrence of significant remediation costs, disruptions to our development programs, business operations and collaborations, diversion of management efforts and damage to our reputation, which could harm our business and operations. Because of the rapidly moving nature of technology and the increasing sophistication of cybersecurity threats, our measures to prevent, respond to and minimize such risks may be unsuccessful.
In addition, the European Parliament and the Council of the European Union has adopted a comprehensive general data privacy regulation, known as the GDPR, which governs the collection and use of personal data in the European Union. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification and the use of third party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the European Union to the United States, provides an enforcement authority and imposes large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the infringer, whichever is greater. Moreover, the European Court of Justice in July 2020 invalidated the Privacy Shield framework that had been in place between the EU and the U.S., which invalidation has created uncertainty about how data can now be shared in a compliant manner. Additionally, the California Consumer Privacy Act (CCPA), effective January 1, 2020, requires, among other things, provision of new disclosures to California consumers, gives such consumers new abilities to opt-out of certain sales of personal information,