Item 1A. Risk Factors
Item 1A. Risk Factors.
Except as set forth below, we are not aware of any material changes to the risk factors set forth under the caption “Risk Factors” in Part II, Item 1A of the Annual Report and Part II, Item 1A of the Quarterly Report for the quarterly period ended June 30, 2023, which are incorporated herein by reference. The risks described in the Annual Report, in the Quarterly Report for the period ended June 30, 2023, and below are not the only ones we face. Additional risks that we currently do not know about or that we currently believe to be immaterial may also impair our business, financial condition, operating results, liquidity, and future prospects.
Risks Related to Our Indebtedness
An event of default has occurred under the indenture governing our 1.50% Convertible Senior Notes due 2025
On or about October 24, 2023, we were notified that additional interest has been accruing on the Convertible Senior Notes (“Notes”) since May 2021 pursuant to the terms of the indenture, as a result of our failure to timely remove the restrictive legends on the Notes and switch the Notes to an unrestricted CUSIP. This additional interest continues to accrue at a rate of 0.50% per annum on the outstanding principal amount of the Notes, and as of November 1, 2023 amounts to approximately $3.2 million in the aggregate. The overdue unpaid interest itself accrues interest at a rate of 2.50% per annum. We have deposited the full amount for these payments with the trustee for the Notes and are coordinating with the trustee for the payments to be completed as soon as reasonably practicable in the fourth quarter of 2023. However, the failure to pay these overdue amounts constitutes an event of default under the indenture, and the trustee or the holders of at least 25% of the outstanding principal amount of Notes can elect to declare all outstanding amounts under the Notes immediately due and payable while this event of default is continuing. Early repayment of the Notes would likely significantly impact our liquidity and financial condition, which could have a material adverse effect on our business. In addition, we cannot access funds under our $50.0 million Line of Credit due to the event of default under the indenture governing the Notes.
Risks Related to Legal and Intellectual Property
We are the subject of a putative securities class action lawsuit, and additional securities litigation may be brought against us in the future.
On September 8, 2023, a purported stockholder of the Company filed a putative securities class action complaint (captioned Lowe v. Tandem Diabetes Care, Inc., et al, Case No. 23-cv-1657) in the United States District Court for the Southern District of California against us and certain of our current executive officers. The complaint generally alleges that defendants violated Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, as amended, by failing to properly account for and disclose the full impact that COVID-19, inflation, and the sales of competitors’ products were having on our sales and revenue. The complaint seeks unspecified monetary damages and other relief. It is possible that additional lawsuits will be filed, or allegations made by stockholders, with respect to these same or other matters and also naming us and/or our officers and directors as defendants. Although we intend to vigorously defend against this claim, there is no guarantee that we will prevail. Accordingly, we are unable to determine the ultimate outcome of this lawsuit or determine the amount or range of potential losses associated with the lawsuit. While we carry liability insurance, there is no assurance that any losses we incur in connection with the current lawsuit or any future lawsuit will be covered or that coverage, if any, will be sufficient. In addition, the current lawsuit and similar future litigation could result in substantial costs and a diversion of management’s attention and resources, which could harm our business.
40
Risks Related to Our Business and Industry
Competitive products, therapeutic techniques, or other technological developments and breakthroughs for the monitoring, treatment or prevention of diabetes may render our products obsolete or less desirable.
Our ability to grow our business and achieve our strategic objectives will depend, among other things, on our ability to develop and commercialize products for the treatment of diabetes that offer distinct features and functionality, are easy-to-use, provide superior treatment outcomes, receive adequate coverage and reimbursement from third-party payors, and are otherwise more appealing than available alternatives. Our primary competitors, as well as a number of other companies and medical researchers are pursuing new delivery devices, delivery technologies, therapeutic techniques, sensing technologies, treatment techniques, procedures, drugs and other therapies for the monitoring, treatment and prevention of diabetes. Any breakthroughs in diabetes monitoring, treatment or prevention could reduce the potential market for our products or render our products obsolete altogether, which would significantly reduce our sales or cause our sales to grow at a slower rate than we currently expect. In addition, even the perception that new products may be introduced, or that technological or treatment advancements could occur, could cause consumers to delay the purchase of our products.
Because the insulin-dependent diabetes market is large and growing, we anticipate companies will continue to dedicate significant resources to developing competitive products and technologies. The introduction by competitors of products that are or claim to be superior to our products may create market confusion that may make it difficult to differentiate the benefits of our products over competitive products. In addition, some of our competitors employ aggressive pricing strategies, including the use of discounts, rebates, low-cost product upgrades or other financial incentives that could adversely affect sales of our products. If a competitor develops a product that competes with or is perceived to be superior to our products, or if competitors continue to utilize strategies that place downward pressure on pricing within our industry, our sales may decline, our operating margins could be reduced and we may fail to meet our financial projections, which would materially and adversely affect our business, financial condition and operating results.
Moreover, we have designed our hardware products to resemble modern consumer electronic devices to address certain embarrassment and functionality concerns consumers have raised with respect to traditional pumps. Similarly, our newer mobile software applications are being designed to incorporate features and functions that are common to other consumer-oriented applications. These consumer industries are themselves highly competitive, and characterized by continuous new product introductions, rapid developments in technology, and subjective and changing consumer preferences. If, in the future, consumers cease to view our products as contemporary or convenient as compared to then-existing consumer technology, our products may become less desirable.
Governments outside the United States tend to impose strict price controls, reimbursement approval and rebate policies, which may adversely affect our ability to generate revenue.
In some countries, particularly EU countries and EFTA member states, the pricing, reimbursement and rebates of health products is subject to governmental control, and in such countries, there can be considerable pressure by governments and other stakeholders on prices, as well as reimbursement and rebates. If reimbursement of our products is unavailable or limited in scope or amount or if pricing or rebates are set at unsatisfactory levels in any such country, our prospects for generating revenue outside of the United States, if any, could be adversely affected and our business could be harmed. For example, in August 2023, a rebate agreement with the French Comité économique des produits de santé (CEPS) for sales of our t:slim X2 with Control-IQ pump in France went into effect. The rebate agreement with CEPS provides for specified reimbursements and requires specified rebates be paid, and we are currently in the process of determining the impact and allocation of such reimbursements and rebates under the agreement. While we currently cannot estimate the amount of such reimbursements and rebates that will be allocable to us, we may ultimately determine that we need to pay all or a portion of the rebates. Any such rebates that we are required to pay could adversely affect our ability to generate revenue from sales of t:slim X2 with Control-IQ in France.
41
Risks Related to Privacy and Security
A security breach or other significant disruption to our information technology systems or data, or those of our third-party business partners, or failures of our software used with our pumps to perform as we anticipate, could materially disrupt our operations or compromise sensitive information relating to our customers, suppliers, employees or other individuals, which could damage our relationships, expose us to litigation or regulatory proceedings, or harm our reputation.
The efficient operation of our business depends on our information technology and communication systems, as well as those of our suppliers, contract manufacturers, distributors and other third-party business partners. We rely on such systems to effectively store, process and transmit confidential, personal, or other sensitive data, including health information, proprietary sales and marketing data, accounting and financial information, manufacturing and quality records, inventory management data, product development tasks, research and development data, customer service and technical support information. These systems and the underlying data are vulnerable to damage or interruption from a number of causes, including earthquakes, fires, floods and other natural disasters, terrorist attacks, attacks by computer viruses or hackers, malware, ransomware or other destructive software, cyber-attacks, social-engineering attacks (including phishing and deep fakes, which may be increasingly more difficult to identify as fake), malicious code, denial-of-service attacks, credential harvesting, supply chain attacks, power losses, and computer system, data network failures, and other similar threats. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. Threat actors may continue to develop and use more sophisticated tools and techniques (including AI) that are specifically designed to circumvent security controls, evade detection, and obfuscate forensic evidence, making it more difficult for us to identify, investigate and recover from incidents. Notably, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Additionally, to offer our products to our customers and operate our business, we use a number of products and services, such as IT networks and systems, including those we own and operate as well as others provided by third-party providers. Our ability to provide our products could be interrupted if these systems were impacted by a ransomware or other cyber-attack.
Should any of the risks described herein occur, it could also result in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of such sensitive information, which could lead to significant reputational or competitive harm, litigation involving us or our business partners, regulatory proceedings, or substantial liabilities, fines, penalties or expenses. Further, many of our third-party service providers are subject to similar risks. We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and other functions and systems. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy- or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such an award. In addition, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.
In addition to the risks regarding information technology systems and processing of sensitive information, our insulin pumps and other products rely on software, some of which is developed by third-party service providers, that could contain vulnerabilities. We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. These vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. These risks significantly increased when we began use of our Tandem Device Updater, which enables customers to remotely update software on their insulin pumps and may be higher after we launched our new mobile application in the second half of 2020. These risks may have further increased in the second half of 2022 when we enabled users to control insulin boluses through the mobile app.
42
Moreover, remote work has become more common and has increased risks to our information technology systems and data, as more of our employees use network connections, computers and devices outside our premises or network, including working at home, while in transit, and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.
We may expend significant resources or modify our business activities to try to protect against security incidents. Whether or not our security measures and those of our third-party service providers are ultimately successful, our expenditures on those measures could have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. Certain data privacy and security obligations may require us to implement and maintain reasonable or specific security measures or industry standards to protect our information technology systems and sensitive information.
Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident (such as the incident described below) or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our products, deter new customers from using our products, and negatively impact our ability to grow and operate our business.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.
In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. The failure of our or our service providers’ information technology systems or our pumps’ software or other mobile or cloud applications to perform as we anticipate, or our failure to effectively identify, investigate and mitigate potential threats through ongoing maintenance and enhancement of software applications, information technology systems and privacy policies and controls, could disrupt our entire operation or adversely affect our software products or ability to provide our products and services. For example, we market our Tandem Device Updater as having the unique capability to deploy software updates to our pumps, which may allow customers remote access to new and enhanced features. The failure of our Tandem Device Updater to provide software updates as we anticipate, including as a result of our inability to secure and maintain necessary regulatory approvals, the inability of our pumps to properly receive software updates, errors or viruses embedded within the software being transmitted, or the failure of our customers to properly use the system to complete the update, could result in decreased sales, increased warranty costs, and harm to our reputation, any of which could have a material adverse effect on our business, financial condition and operating results.
Our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or vendor’s use of generative artificial intelligence (“AI”) or machine learning (“ML”) technologies (collectively, “AI/ML” technologies). Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI model. Additionally, where AI/ML technologies ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI with bad inputs or logic), or if the logic of the AI is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits. If such AI-based outputs are deemed to be biased, we could face adverse consequences, including exposure to reputational and competitive harm, customer loss, and legal liability.
43
We may be subject to stringent and evolving U.S. and foreign laws, regulations, rules, contractual obligations, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.
In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process (or processing)) sensitive information. Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.
There are a number of laws in the United States governing the privacy and security of personal information, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information.
For example, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ("CAN-SPAM”) and the Telephone Consumer Protection Act of 1991 (“TCPA”) impose specific requirements on communications with customers. For example, the TCPA imposes various consumer consent requirements and other restrictions on certain telemarketing activity and other communications with consumers by phone, fax or text message. TCPA violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission or fines of up to $1,500 per violation imposed through private litigation or by state authorities.
As another example, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA) (collectively, “CCPA”), applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for administrative fines of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability with respect to other personal data we maintain about California residents. In addition, the CPRA expanded the CCPA’s requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency to implement and enforce the law. Other states, such as Virginia and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. These state laws and the CCPA provide individuals with certain rights over their personal information, including the right to access, correct, or delete certain personal information, and opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties upon whom we rely, and our customers.
Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), and Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) or the applicable provincial alternatives, impose strict requirements for processing personal data.
For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros / 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In Canada, PIPEDA and various related provincial laws, as well as Canada’s Anti-Spam Legislation (“CASL”), may apply to our operations.
44
Additionally, regulators are increasingly scrutinizing companies that process children’s data. Numerous laws, regulations, and legally-binding codes, such as the Children’s Online Privacy Protection Act (“COPPA”), California’s Age Appropriate Design Code (effective in July 2024), the CCPA and CPRA, other U.S. state comprehensive privacy laws, the EU and UK GDPR, and the UK Age Appropriate Design Code, impose various obligations on companies that process children data, including by requiring certain consents to process such data and extending certain rights to children and their parents with respect that data. Some of these obligations have wide ranging applications, including for services that do not intentionally target child users (defined in some circumstances as a user under the age of 18 years old). These laws may be subject to legal challenges and changing interpretations, which may further complicate our efforts to comply with these laws.
Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal information in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.
The development and use of generative AI/ML technologies present various privacy and security risks that may impact our business. AI/ML are subject to privacy and data security laws, as well as increasing regulation and scrutiny. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed or enacted laws governing AI/ML. For example, European regulators have proposed a stringent AI regulation, and we expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.
We may be subject to new laws governing the privacy of consumer health data. For example, Washington’s My Health My Data Act (“MHMD”) broadly defines consumer health data, places restrictions on processing such data (including imposing stringent requirements for consent), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws.
In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers for relevant organizations based in the United States who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. Additionally, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of the standard contractual clauses to transfer personal data from Europe to the United States was insufficient and levied a 1.2 billion Euro fine against the company and prohibited the company from transferring EU personal data to the United States.
45
In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and we are, or may become subject to such obligations in the future. For example, we may also be subject to the Payment Card Industry Data Security Standard (“PCI DSS”). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. Additionally, some of our customer contracts require us to host personal data locally. We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.
Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. In addition, a shift in consumers’ data privacy expectations or other social, economic or political developments could impact the regulatory enforcement of these obligations, which could increase the cost of and complicate our compliance with applicable obligations.
If we or the third parties on which we rely fail, or are perceived to have failed to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis; if viable, these claims carry the potential for monumental statutory damages, depending on the volume of data and the number of violations.
Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations (including, as relevant, clinical trials); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.