12 In addition, the processing of personal data in connection with clinical trials in the EU must comply with comprehensive data protection requirements imposed by EU’s General Data Protection Regulation, or GDPR. GDPR, which took effect on May 25, 2018, imposes stringent data protection requirements and provides for penalties for noncompliance that can include bans on processing personal data and fines of up to the greater of 20 million euros or four percent of worldwide annual revenues. The GDPR requires organizations to give detailed disclosures about how they collect, use and share personal information; in most cases, obtain explicit consent to process sensitive personal information, such as health or genetic information; contractually require vendors to meet data protection requirements; maintain adequate data security measures; notify regulators and affected individuals of certain data breaches; meet extensive privacy governance and documentation requirements; and honor individuals’ data protection rights, including their rights to access, correct and delete their personal information. European data protection laws, including the GDPR, also restrict the transfer of personal information from Europe, including the European Economic Area, the United Kingdom and Switzerland, to the U.S. and most other countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal information. One of the primary safeguards allowing U.S. companies to import personal information from Europe has been certification to the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield frameworks administered by the U.S. Department of Commerce. However, the Court of Justice of the European Union adopted a decision in July 2020 invalidating the EU-U.S. Privacy Shield. The same decision also raised questions about whether one of the primary alternatives to the EU-U.S. Privacy Shield, namely, the European Commission’s Standard Contractual Clauses, can lawfully be used for personal information transfers from Europe to the U.S. or most other countries. Authorities in Switzerland also have issued guidance raising similar questions about the Swiss-U.S. Privacy Shield and the Standard Contractual Clauses. The failure to comply with any of these laws or regulatory requirements may result in possible legal or regulatory action. Depending on the circumstances, failure to meet applicable regulatory requirements can result in significant penalties, including administrative, civil, and criminal penalties, fines, imprisonment, disgorgement, injunctions, exclusion from participation in federal healthcare programs, integrity oversight and reporting obligations, requests for recall, seizure of products, total or partial suspension of production, denial or withdrawal of product approvals or refusal to allow a firm to enter into supply contracts, including government contracts. Any action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business. Prohibitions or restrictions on sales or withdrawal of future products marketed by us could materially affect our business in an adverse way.