Further, following the withdrawal of the United Kingdom from the European Union and the end of the transition period, from January 1, 2021, companies could also be subject to the United Kingdom General Data Protection Regulation and Data Protection Act 2018, as amended (collectively, the UK GDPR). The UK GDPR mirrors the fines under the GDPR and has the ability to fine up to the greater of €20 million/£17 million or 4% of annual global revenue. As we expand into other foreign countries and jurisdictions, we may be subject to additional laws and regulations that may affect how we conduct business.
Compliance with U.S. and international data protection laws and regulations could require us to take on more onerous obligations in our contracts, restrict our ability to collect, store, use, transfer, disclose, and otherwise process data, update our data privacy and security policies and procedures, or in some cases, impact our ability to operate in certain jurisdictions. Failure by us or our collaborators and our service providers to comply with U.S. and international data protection laws and regulations could result in government enforcement actions (which could include civil or criminal penalties), private litigation, and/or adverse publicity and could negatively affect our operating results and business. Moreover, clinical trial subjects about whom we or our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose such information. Claims that we have violated individuals’ privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend, could result in adverse publicity, and adversely affect our business, financial condition, results of operations, and prospects.
Our information technology systems, or those of any of our service providers, may fail or suffer security incidents and other disruptions, which could result in a material disruption of our product candidates’ development programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business.
In the ordinary course of business, we collect, store, and transmit confidential information including but not limited to intellectual property, clinical trial data, proprietary and confidential business information, and personal information of our employees, contractors, service providers and strategic partners (collectively, Confidential Information). Our information technology systems and those of our third-party service providers, strategic partners, and other contractors or consultants are vulnerable to attack, damage, and interruption from computer viruses and malware (e.g., ransomware), “phishing” attacks, malicious code, misconfigurations, “bugs” or other vulnerabilities, natural disasters, terrorism, war, telecommunication and electrical failures, hacking, cyberattacks, phishing attacks and other social engineering schemes, employee theft or misuse, human error, fraud, denial or degradation of service attacks, and sophisticated nation-state and nation-state-supported actors.
In addition, attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication, and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise, as well as through artificial intelligence. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security incidents that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. There can also be no assurance that our and our third-party service providers’, strategic partners’, contractors’, or consultants’ cybersecurity risk management program and processes, including policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems, networks and Confidential Information.
We and certain of our service providers are from time to time subject to cyberattacks and security incidents. If any such event, whether actual or perceived, were to occur, it could affect our reputation and/or operations, subject us to lawsuits (including class actions), cause us to incur significant costs, including legal expenses, harm customer confidence, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. For example, the loss of clinical trial data from clinical trials could result in delays in our regulatory approval efforts and potential regulator enforcement and significantly increase our costs to recover or reproduce the data. We also rely on a third party to manufacture our product candidates, and similar events relating to their computer systems could also have a material adverse effect on our business. To the extent that any actual or perceived disruption