44 Outside the United States, an increasing number of laws, regulations, and industry r standards apply to data privacy and security. For example, the European Union’s General Data Protection Regulation, or EU GDPR, and the United Kingdom’s GDPR, or UK GDPR, impose strict requirements for processing personal data. Violators of these laws face significant penalties. For example, government regulators may impose temporary r or definitive bans on data processing, as well as fines of up to 20 million Euros (under the EU GDPR) or 17.5 million pounds sterling (under the UK GDPR), or 4% of annual global revenue, whichever is greater, under either law. Further, the EU and UK GDPR also provide for private litigation related to the processing of personal data that can be brought by classes of data subj u ects or consumer protection organizations authorized at law to represent the data subj u ects’ interests. In addition, we may be unabl a e to transfer f personal data from Europe and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data transfer f s. Although there are various mechanisms (such as the European Economic Area standard contractua t l clauses, the UK’s International Data Transfer f Agreement/Addendum, and the EU-U.S. Data Privacy Framework and the UK extension), that may be used in some cases to lawful f ly transfer f personal data to the United States or other countries, these mechanisms are subj u ect to legal challenges and may not be availabl a e to us. An inability or material limitation on our ability to transfer f personal data to the United States or other countries could materially impact our business operations. If we cannot implement a valid compliance mechanism for cross-border data transfer f s, we may face increased exposure to regulatory r actions, subs u tantial fines, and inju n nctions against processing or transfer f ring personal data from Europe and other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations by limiting our ability to conduct clinical trial activities in Europe and elsewhere; limiting our ability to collabor a ate with parties that are subj u ect to such cross-border data transfer f or localization laws; or requiring us to increase our personal data processing capa a bi a lities and infrastructur t e in foreign jurisdictions at significant expense. Additionally, entities that transfer f personal data across borders are subj u ect to increased regulator, individual and activist group scrutiny. Some European regulators have ordered certain companies to suspend or permanently cease certain data transfer f s out of Europe for allegedly violating the GDPR’s cross-border data transfer f requirements. We are also bound by contractua t l obligations related to data privacy and security, and our effo f rts to comply with such obligations may not be successful f . We also publish privacy policies and other statements regarding data privacy and security. If these policies or statements are found to be deficient, lacking in transparency, deceptive, unfai f r or misrepresentative of our practices, we may be subj u ect to investigation, enforcement actions and other adverse consequences. Obligations related to data privacy and security (and individuals’ data privacy and security expectations) are quickly changing, becoming increasingly stringent and creating uncertainty. Additionally, these obligations may be subj u ect to differing applications and interpretations which may be inconsistent or conflic f t among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems and practices and to those of any third parties that process personal data on our behalf.f In addition, these obligations may require us to change our business model. We may at times fail (or be perceived to have failed) in our effo f rts to comply with our data privacy and security obligations. Moreover, despite our effo f rts, our personnel or third parties upon whom we rely may fail to comply with such obligations which could negatively impact our business. If we or any third party on which we rely fail or are perceived to have failed to address or comply with applicable obligations relating to data privacy and security, we could face significant consequences including but not limited to: regulatory r fines and bans on processing personal data; investigations and enforcement actions, penalties and other liabi a lities, litigation (including class action claims and mass arbi r tration demands); additional reporting requirements and/or oversight; orders to destroy or not use personal data; interrupt u ions to our development process; and damage to our reputation, any of which could materially affe f ct our business, financial condition, results of operations and growth prospects. If we or any n contra t ct manufa u cturersr and supp u liersr we engage fail to comply with i enviro i nmental, health l , and safe a ty laws and regu e lations,s we couldl become subject to fine i s or penalties or incur costst that couldl have a material adverse r effe f ct on the success of our busine i ss. We and any contract manufactur t ers and suppl u iers we engage are subj u ect to numerous federal, state and local environmental, health, and safety laws, regulations, and permitting requirements, including those governing labor a atory r procedur d es; the generation, handling, use, storage, treatment and disposal of hazardous and regulated materials and wastes; the emission and discharge of hazardous materials into the ground, air and water; and employee health and safety. Our operations involve the use of hazardous and flammabl a e materials, including chemicals and biological and radioactive materials. Our operations also produce hazardous waste. We generally contract with third parties for the disposal of these materials and wastes. We cannot eliminate the risk of contamination or inju n ry from these materials. In the event of contamination or inju n ry resulting from our use of hazardous materials, we could be held liabl a e for any resulting damages, and any liability could exceed our resources. Under certain environmental laws, we could be held responsible for costs relating to any contamination at our current or past facilities and at third-party facilities. We also could incur significant costs associated with civil or criminal fines and penalties.