39 • analogous state and foreign laws and regulations, such as state and foreign anti-kickback, false claims, consumer protection and unfair competition laws which may apply to pharmaceutical business practices, including but not limited to, research, distribution, sales and marketing arrangements as well as submitting claims involving healthcare items or services reimbursed by any third-party payor, including commercial insurers; state laws that require pharmaceutical companies to comply with the pharmaceutical industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government that otherwise restricts payments that may be made to healthcare providers and other potential referral sources; state laws that require drug manufacturers to file reports with states regarding pricing and marketing information, such as the tracking and reporting of gifts, compensations and other remuneration and items of value provided to healthcare professionals and entities; state and local laws that require the registration of pharmaceutical sales representatives; and state and foreign laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could, despite our efforts to comply, be subject to challenge under one or more of such laws. Efforts to ensure that our business arrangements will comply with applicable healthcare laws may involve substantial costs. It is possible that governmental and enforcement authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant civil, criminal and administrative penalties, damages, disgorgement, monetary fines, imprisonment, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings and curtailment of our operations, any of which could adversely affect our ability to operate our business and our results of operations. In addition, the approval and commercialization of any of our product candidates outside the United States will also likely subject us to foreign equivalents of the healthcare laws mentioned above, among other foreign laws. We are subject to stringent and changing obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of sales; and other adverse business consequences. In the ordinary course of business, we may collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (commonly known as processing) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, and sensitive third-party data. Our data processing activities subject us to a variety of provincial, state, national, and foreign laws and regulations, as well as policies, contracts and other obligations that apply to the processing of sensitive information. Data privacy and security laws and regulations are evolving and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, and consumer protection laws. For example, the California legislature enacted the California Consumer Privacy Act, or CCPA, which took effect on January 1, 2020. The CCPA requires covered companies to provide new disclosures to California residents, and honor their requests to access, delete and opt-out of certain sharing of their personal data. The CCPA provides for civil penalties for violations (up to $7,500 per violation) and a private right of action for certain data breaches. In addition, it is anticipated that the California Privacy Rights Act of 2020, or CPRA, effective January 1, 2023, will expand the CCPA. Additionally, the CPRA establishes a new California Privacy Protection Agency to implement and enforce the CPRA, which could increase the risk of enforcement. While certain clinical trial activities are exempt from the CCPA’s and the CPRA’s requirements, other personal data that we handle may be subject to the CCPA and the CPRA, which may increase our compliance costs, exposure to regulatory enforcement action and other liabilities. Since the enactment of the CCPA, new privacy and data security laws have been proposed in more than half of the states and in the U.S. Congress, reflecting a trend toward more stringent privacy legislation in the U.S. For example, Virginia passed the Consumer Data Protection Act, Colorado passed the Colorado Privacy Act, and Utah passed the Utah Consumer Privacy Act, all of which become effective in 2023. Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union’s General Data Protection Regulation, or EU GDPR, and the United Kingdom’s GDPR, or UK GDPR, impose strict requirements for processing personal data. Violators of these laws face significant penalties. For example, under the EU GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater. Further, the EU GDPR also provides for private litigation related to the processing of personal data that can be brought by classes of data subjects or consumer protection organizations authorized at law to represent the data subjects’ interests.