41 • analogous state and foreign laws and regulations, such as state and foreign anti-kickback, false claims, consumer protection and unfair competition laws which may apply to pharmaceutical business practices, including but not limited to, research, distribution, sales and marketing arrangements as well as submitting claims involving healthcare items or services reimbursed by any third-party payor, including commercial insurers; state laws that require pharmaceutical companies to comply with the pharmaceutical industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government that otherwise restricts payments that may be made to healthcare providers and other potential referral sources; state laws that require drug manufacturers to file reports with states regarding pricing and marketing information, such as the tracking and reporting of gifts, compensations and other remuneration and items of value provided to healthcare professionals and entities; state and local laws that require the registration of pharmaceutical sales representatives; and state and foreign laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could, despite our efforts to comply, be subject to challenge under one or more of such laws. Efforts to ensure that our business arrangements will comply with applicable healthcare laws may involve substantial costs. It is possible that governmental and enforcement authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant civil, criminal and administrative penalties, damages, disgorgement, monetary fines, imprisonment, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings and curtailment of our operations, any of which could adversely affect our ability to operate our business and our results of operations. In addition, the approval and commercialization of any of our product candidates outside the United States will also likely subject us to foreign equivalents of the healthcare laws mentioned above, among other foreign laws. We and the third parties with whom we work are subject to stringent and evolving obligations related to data privacy and security. These obligations include U.S. and foreign laws, regulations and rules; contractual obligations; industry standards; and policies. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations and actions; litigation (including class claims) and arbitration; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue and profits; loss of sales; and other adverse business consequences. In the ordinary course of business, we and the third parties with whom we work collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, and sensitive third-party data (collectively, sensitive information). Our data processing activities subject us to numerous data privacy and security obligations such as various provincial, state, national, and foreign laws and regulations, as well as guidance, industry standards, internal privacy and security policies, contractual requirements, and other obligations related to data privacy and security. Data privacy and security laws and regulations are evolving and resulting in increased regulatory and public scrutiny and escalating levels of enforcement and sanctions. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights include, in relation to their personal data, the right to access, correct, delete and opt-out of certain data processing activities (such as targeted advertising, profiling and automated decision-making). The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. Certain of these state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act, or the CCPA, provides for civil penalties and a private right of action for certain data breaches (which could lead to the recovery of significant statutory damages). Although these laws may exempt some data processed in the context of clinical trials, these laws increase compliance costs and potential liability for us and the third parties with whom we work. Similar laws are being considered in other states as well as at the federal and local levels. We expect more states to pass similar laws in the future.