We maintain an array of sensitive information, including confidential business and personal information in connection with our operations, and are subject to laws and regulations governing the privacy and security of such information. The global data protection landscape is rapidly evolving, and we may be affected by or subject to new, amended or existing laws and regulations in the future, including as our operations continue to expand and we operate in foreign jurisdictions. These laws and regulations may be subject to differing interpretations, which adds to the complexity of collecting, using, disclosing and processing personal information. Guidance on implementation and compliance practices are often updated or otherwise revised.
In the United States, there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure and protection of personal information, including federal and state health information privacy laws, state laws addressing sensitive data, such as biometric information, federal and state security breach notification laws and federal and state consumer protection laws. Each of these laws is subject to varying interpretations and constantly evolving. While the United States lacks a nationwide privacy law of general applicability, certain state laws govern the privacy and security of personal information, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Certain U.S. States, including, but not limited to, California, Colorado, Virginia, Connecticut, Indiana, Iowa, Tennessee, Texas and Utah, have adopted state-specific privacy regimes similar to legal regimes in place outside the United States. In addition to state laws, the FTC takes the view that failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards.
Outside the United States, numerous countries have adopted generally applicable data privacy regimes at the national level. For example, the European Parliament, the European Commission and the Council of the European Union adopted a comprehensive General Data Protection Regulation ("GDPR") in 2016 to replace the then-current European Union Data Protection Directive and related country-specific legislation. The GDPR took effect in May 2018 and governs the processing of personal data of European Union residents. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the lawful bases to rely upon to process personal data, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification, broadened data subject rights, and the use of third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the European Union, enhances enforcement authority and imposes large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual global revenues of the infringer, whichever is greater. The withdrawal of the United Kingdom from the European Union further complicated European data protection compliance obligations, as we must also comply with data privacy and security laws in effect in the UK that are substantially similar to the GDPR, but may diverge over time.
In Canada, the Personal Information Protection and Electronics Documents Act (Canada) ("PIPEDA"), the Personal Information Protection Act (Alberta), the Personal Information Protection Act (British Columbia), and the Act respecting the protection of personal information in the private sector (Quebec) govern the collection, use, and disclosure of personal information by private sector organizations. The Office of the Privacy Commissioner of Canada ("OPC") has stated that it considers the personal information of cannabis users is to be considered sensitive. Canadian privacy jurisprudence regarding the obligations that private sector organizations have to individual data subjects is constantly evolving. Privacy laws in Canada are also changing at the legislative level in an effort to modernize laws to keep up with technological changes and to align with the international standards such as the GDPR. In Quebec, the passage of Law 25, An Act to modernize legislative provisions as regards the protection of personal information (formerly Bill 64) ("Law 25"), which gradually came into effect between September 2022 and 2024, modernized the obligations incumbent on private sector organizations in relation to the collection, use, and disclosure of personal information within Quebec, including, without limitation, by providing individuals with more significant rights and control over their personal information and imposing more accountability and transparency related obligations (e.g., privacy-by design, data breach notifications) that are in many ways similar to the GDPR. Law 25 enhanced the Commission d'accès à l'information's powers, including by providing new powers of investigation and the ability to impose administrative monetary penalties (of up to $10 million or the amount corresponding to 2% of worldwide turnover for the preceding fiscal year, whichever is greater) and penal fines (of up to $25 million or the amount corresponding to 4% of worldwide turnover for the preceding fiscal year, whichever is greater). On June 17, 2021, the Province of Ontario commenced a public consultation on modernizing Ontario's legislative framework focusing on strengthening privacy laws in Ontario. On November 25, 2024, the Government of Ontario passed Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 ("Bill 194"), which significantly reformed the Freedom of Information and Protection of Privacy Act ("FIPPA"). Bill 194 amended FIPPA to, among other things, require certain public sector entities to report certain privacy breaches to the Information and Privacy Commissioner of Ontario (the "IPC"), require privacy assessments to be conducted before collecting personal information and increase the IPC's investigative powers. In Alberta, on November 6, 2024, the provincial government introduced legislation to modernize the province's access to information and public sector privacy regime. Specifically, Alberta's government is proposing to divide the existing Freedom of Information and Protection of Privacy Act into two acts: the Protection of Privacy Act ("Bill 33") and the Access to Information Act ("Bill 34"). In December 2024, Alberta's government passed Bill 33 and Bill 34. The acts and associated regulations will come into force in Spring 2025. While Bill 33, Bill 34 and Bill 194 do not directly impact private sector organizations, the Company plans to continue to monitor developments regarding privacy law amendments and any forthcoming regulations. On the federal level, on June 16, 2022, the Canadian Federal Government introduced Bill C-27, the Digital Charter Implementation Act, 2022 ("Bill C-27") which would replace PIPEDA with consumer privacy-specific legislation. Additionally, Bill C-27, would have introduced the Artificial Intelligence Data Act. Similar to Quebec's Law 25, Bill C-27's consumer privacy-specific legislation significantly enhances penalties and enforcement measures available to the OPC. Bill C-27 died on the order table when the Canadian Parliament was prorogued in January 2025. It is expected that a version of Bill C-27 will be introduced in the new Canadian Parliament, regardless of who the next governing party is.
In addition, with respect to consumer health information, there are a number of federal, state and provincial laws protecting the confidentiality of certain patient health information, including patient records, and restricting the use and disclosure of that protected information. For example, the privacy rules under PIPEDA and other applicable privacy laws protect medical records and other personal health information by limiting their use and disclosure of health information to the minimum level reasonably necessary to accomplish the intended purpose and apply to our operations globally. In Canada, we may also be required to retain certain customer personal information for prescribed periods of time pursuant to the Cannabis Act.
In the United States, the Health Insurance Portability and Accountability Act ("HIPAA") imposes privacy and security requirements and breach reporting obligations with respect to individually identifiable health information upon "covered entities" (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, received, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity. HIPAA mandates the reporting of certain breaches of health information to the HHS, affected individuals and if the breach is large enough, the media. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured protected health information, a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. In addition, provisions of the Americans with Disabilities Act require confidential treatment of employee medical records.
If we were found to be in violation of the privacy or security rules under PIPEDA, HIPAA, or other applicable laws protecting the confidentiality of health information in jurisdictions we operate in, we could be subject to sanctions and civil or criminal penalties, which could increase our liabilities, harm our reputation and have a material adverse effect on our business, financial condition, results of operations and growth prospects.
Additional jurisdictions in which we operate or which we may enter also have data privacy and security laws and regulations that govern the collection, use, disclosure, transfer, storage, disposal, and protection of sensitive personal information. Data privacy and security are rapidly developing areas of law, as well, and imposition of new requirements is common. The interpretation and enforcement of such laws and regulations are uncertain and subject to change, and may require substantial costs to monitor and implement compliance. Failure to comply with data protection laws and regulations could result in government enforcement actions (which could include substantial civil and/or criminal penalties), litigation, business disruption, and/or adverse publicity and could negatively affect our business, financial condition, results of operations and growth prospects.