Our ability to conduct our business is significantly dependent on the data that we collect, process, and share in discovering, developing, and commercializing drug products. These data are often considered personal data and are therefore regulated by data privacy laws in the United States and abroad.
We have operations and conduct business in several countries outside the United States and plan to significantly expand the scope of these activities in those and/or additional countries, as discussed above under "Risks associated with our operations outside the United States could adversely affect our business." These activities subject us to additional data protection authority oversight and require us to comply with stringent local and regional data privacy laws, including the EU's General Data Protection Regulations ("GDPR"). The GDPR has a wide range of compliance obligations, including increased consent and transparency requirements and data subject rights. Violations of the GDPR carry significant financial penalties for noncompliance (including possible fines of up to 4% of global annual turnover for the preceding financial year or €20 million (whichever is higher)). In addition to the GDPR, certain EU Member States have issued or will be issuing their own implementation legislation. In June 2021, the EC introduced new standard contractual clauses required to be incorporated into certain new and existing agreements within prescribed timeframes in order to continue to lawfully transfer personal data outside the EU. Many of the countries that have comprehensive data privacy laws have modeled their requirements after the GDPR. Compliance with these requirements has been and is expected to continue to be costly and time consuming.
We conduct clinical trials in many countries around the world, which have new or evolving data privacy laws that are often not interpreted consistently by regulatory authorities, institutional review boards/ethics committees, or clinical trial sites. This complexity has resulted in increased liability in the management of clinical trial data, as well as additional compliance, contractual, and due-diligence obligations that could lead to a delay in clinical trial site start-up. There also has been an increase of enforcement activities in various EU countries that require evidence of compliance with local data privacy requirements. While we continue to monitor these developments, there remains some uncertainty surrounding the legal and regulatory environment for these evolving privacy and data protection laws. Complying with varying jurisdictional requirements could increase the costs and complexity of compliance, including the risk of substantial financial penalties for insufficient notice and consent, failure to respond to data subject rights requests, lack of a legal basis for the transfer of personal information out of the EU or other countries with localization laws (i.e., laws mandating that personal data collected in a foreign country be processed and stored within that country), or improper processing of personal data. Failure by our collaborators to comply with the strict rules on the transfer of personal data into the U.S. could result in the imposition of criminal and administrative sanctions on such collaborators or impact the flow of personal data, which could adversely affect our business.
Most U.S. health care providers, including research institutions from which we or our collaborators obtain clinical trial data, are subject to privacy and security regulations promulgated under HIPAA. For example, as part of our human genetics initiative, our wholly-owned subsidiary, Regeneron Genetics Center LLC, has entered into collaborations with many research institutions, which are subject to HIPAA. Regeneron is not a covered entity or business associate under HIPAA and thus is not subject to its requirements. However, we could be subject to criminal penalties if we, our affiliates, or our agents knowingly receive PHI in a manner that is not permitted under HIPAA. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive PHI from a health care provider or research institution that has not satisfied HIPAA's requirements for its disclosure. There are instances where we collect and maintain personal data, which may include health information that is outside the scope of HIPAA but within the scope of state health privacy laws or similar state level privacy legislation. This information may be received throughout the clinical trial process, in the course of our research collaborations, directly from individuals who enroll in our patient assistance programs, and from our own employees in a pandemic response process (such as in connection with the COVID-19 pandemic).
Consumer protection laws impact the manner in which we develop and maintain processes to support our patient assistance programs, product marketing activities, and the sharing of employee and clinical data for internal and third-party commercial activities. Several U.S. states have proposed and passed consumer privacy laws, which were modeled after the CCPA and influenced by the GDPR. The CCPA is a consumer protection law that establishes requirements for data use and sharing transparency and provides California residents with personal data privacy rights regarding the use, disclosure, and retention of their personal data. Amendments to the CCPA have, among other things, imposed new obligations to provide notice where personal data will be de-identified. Failure to comply with the CCPA may result in, among other things, significant civil penalties and injunctive relief, or statutory or actual damages. In addition, California residents have the right to bring a private right of action in connection with data privacy incidents involving certain elements of personal data. These claims may result in significant liability and damages. These laws and regulations are constantly evolving and may impose limitations on our business activities. Several additional state consumer privacy laws went into effect in 2023 and many other consumer privacy laws are expected to go into effect in the near future. Notably, these state laws provide more restrictions on the use of sensitive personal data, including health information. These states require robust consent and authorizations prior to any collection or use of this data, which may have a large impact on our ability to market to individuals in these jurisdictions based on their health conditions. At the federal level, Section 5 of the FTC Act is a consumer protection law that bars unfair and deceptive acts and practices and requires, among other things, companies to notify individuals that they will safeguard their personal data and that they will fulfil the commitments made in their privacy notices. The FTC has brought legal actions against organizations that have violated consumers' privacy rights or have misled them by failing to maintain appropriate security. For example, in 2023 the FTC issued several enforcement actions related to privacy in the healthcare space, under both Section 5 of the FTC Act and the Health Breach Notification Rule, involving companies allegedly using consumer health data for marketing purposes in violation of their own policies and assurances.
Furthermore, health privacy laws, data breach notification laws, consumer protection laws, data localization laws, biometric privacy laws, and genetic privacy laws may apply directly to our operations and/or those of our collaborators and business partners and may impose restrictions on our collection, use, and dissemination of individuals' health and other personal data. Individuals about whom we or our collaborators obtain health or other personal data, as well as the providers and third parties who share this data with us, may have statutory or contractual limits that impact our ability to further use and disclose the data. Many of these laws differ from each other in significant ways and have different effects. Many of the state laws enable a state attorney general to bring actions and provide private rights of action to consumers as enforcement mechanisms. Compliance with these laws requires a flexible privacy framework as they are constantly evolving. Federal regulators, state attorneys general, and plaintiffs' attorneys have been active in this space.
If we or any collaborators fail to comply with applicable federal, state, local, or foreign regulatory requirements, we could be subject to a range of regulatory actions that could affect our or any collaborators' ability to commercialize our products. Any threatened or actual government enforcement action could also generate adverse publicity and could result in additional regulatory oversight.