43 • analogous state and foreign laws and regulations, such as state and foreign anti-kickback, false claims, consumer protection and unfai f r competition laws which may apply to pharmaceutical business practices, including but not limited to, research, distribution, sales and marketing arrangements as well as subm u itting claims involving healthcare items or services reimbursed by any third-party payor, including commercial insurers; state laws that require pharmaceutical companies to comply with the pharmaceutical industry’ r s voluntary r compliance guidelines and the relevant compliance guidance promulgated by the federal government that otherwise restricts payments that may be made to healthcare providers and other potential referral sources; state laws that require drug r manufac f turers to file reports with states regarding pricing and marketing information, such as the tracking and reporting of gifts, compensations and other remuneration and items of value provided to healthcare profes f sionals and entities; state and local laws that require the registration of pharmaceutical sales representatives; and state and foreign laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effe f ct, thus complicating compliance effort f s. Because of the breadth of these laws and the narrowness of the statut t ory r exceptions and safe harbors availabl a e, it is possible that some of our business activities could, despite our effo f rts to comply, be subj u ect to challenge under one or more of such laws. Effo f rts to ensure that our business arrangements will comply with applicable healthcare laws may involve subs u tantial costs. It is possible that governmental and enforcement authorities will conclude that our business practices may not comply with current or future statut t es, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations. If any such actions are instituted against us, and we are not successful f in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant civil, criminal and administrative penalties, damages, disgorgement, monetary fines, imprisonment, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractua t l damages, reputational harm, diminished profit f s and future earnings and curtailment of our operations, any of which could adversely affe f ct our ability to operate our business and our results of operations. In addition, the approval and commercialization of any of our product candidates outside the United States will also likely subj u ect us to foreign equivalents of the healthcare laws mentioned above, among other foreign laws. We are subject to stri t ng i ent and evolvi l ng i oblig l atio t ns related to datat privacy c and security i .y These oblig l atio t ns include d U.S. and foreign g laws,s regu e lations and rules; contra t ctual oblig l atio t ns; industry t stan t dards; and polic l ies. Our actual or perceived failure to comply with i such oblig l atio t ns couldl lead to regu e latory investig t atio t ns and actions; litigatio t n (inc i luding i clas l s clai l ms i )s and arbitr i atio t n; fine i s and penaltie t s; disru i pt u io t ns of our busine i ss operations; repu e tational harm; loss of revenue and profits f ; loss of sales; and othe t r adverse r busine i ss consequences. In the ordinary course of business, we collect, receive, store, process, generate, use, transfer f , disclose, make accessible, protect, secure, dispose of,f transmit, and share (commonly known as processing) personal data and other sensitive information, including proprietary and confid f ential business data, trade secrets, intellectua t l property, data we collect about trial participants in connection with clinical trials, and sensitive third-party data. Our data processing activities subj u ect us to numerous data privacy and security obligations such as various provincial, state, national, and foreign laws and regulations, as well as policies, contracts and other obligations. Data privacy and security laws and regulations are evolving and may result in ever- increasing regulatory r and public scrutiny and escalating levels of enforcement and sanctions. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notific f ation laws, personal data privacy laws, consumer protection laws and other similar laws. In the past few years, numerous U.S. states — including California, Colorado, Connecticut, Utah and Virginia — have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affo f rding residents with certain rights concerning their personal data. As applicable, such rights may include, in relation to their personal data, the right to access, correct, delete and opt-out of certain data processing activities (such as targeted advertising, profil f ing and automated decision-making). The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. Certain of these state laws allow for statut t ory r fines for noncompliance. For example, the California Consumer Privacy Act (the CCPA) provides for civil penalties for violations (up u to $7,500 per violation) and a private right of action for certain data breaches(which could lead to the recovery of significant statut t ory r damages). Although these laws may exempt some data processed in the context of clinical trials, these laws increase compliance costs and potential liabi a lity in the general data processing industry. r Similar laws are being considered in other states as well as at the federal and local levels. We expect more laws to apply to our data processing activities. These laws will further complicate our compliance effo f rts and increase our legal risks and compliance costs (including of third parties upon whom we rely).