MANNKIND CORP

Previous wording

Successful commercialization of therapeutic products is subject to many risks, including some that are outside our control. There are numerous examples of failures to fully exploit the market potential of therapeutic products, including by biopharmaceutical and device companies with more experience and resources than us. Products that we commercialize ourselves (including any products that we may develop or acquire in the future) and the product that is commercialized by our current collaboration partner (including future products that may be commercialized by our collaboration partner) may not gain market acceptance among physicians, patients, third-party payers and the healthcare community. The degree of market acceptance of our or a collaboration partner’s products depends on many factors, including the following:

Current wording

Successful commercialization of therapeutic products is subject to many risks, including some that are outside our control. There are numerous examples of failures to fully exploit the market potential of therapeutic products, including by biopharmaceutical and device companies with more experience and resources than us. Products that we commercialize ourselves (including any products that we may develop or acquire in the future) and the product that is commercialized by our current collaboration partner (including future products that may be commercialized by a collaboration partner) may not gain market acceptance among physicians, patients, third-party payers and the healthcare community. The degree of market acceptance of our or a collaboration partner’s products depends on many factors, including the following:

Previous wording

If we are unable to maintain an effective sales force for our products, including any other potential future approved products, we may not be able to generate sufficient product revenue in the United States. We are required to expend significant time and resources to train our sales force to educate physicians about our products. In addition, we must continually train our sales force and equip them with effective marketing materials to ensure that a consistent and appropriate message about our products is being delivered to our potential customers. We currently have limited resources compared to some of our competitors, and the continued development of our own commercial organization to market our products and any additional products we may develop or acquire will be expensive and time-consuming. We also cannot be certain that we will be able to continue to successfully develop this capability.

Current wording

If we are unable to maintain an effective sales force for our products, including potential future products, we may not be able to generate sufficient product revenue in the United States. We are required to expend significant time and resources to train our sales force to educate physicians about our products. In addition, we must continually train our sales force and equip them with effective marketing materials to ensure that a consistent and appropriate message about our products is being delivered to our potential customers. We currently have limited resources compared to some of our competitors, and the continued development of our own commercial organization to market our products and any additional products we may develop or acquire will be expensive and time-consuming. We also cannot be certain that we will be able to continue to successfully develop this capability.

Previous wording

We use our Danbury, Connecticut facility to assemble the inhalers from their individual molded parts, formulate both the Afrezza and Tyvaso DPI inhalation powders, fill plastic cartridges with the powders, package the cartridges into secondary packaging and, beginning in 2024, assemble final kits for certain stock-keeping units. Other semi-finished goods are assembled into the final kits for commercial sale by a contract packager.

Current wording

We use our Danbury, Connecticut facility to assemble the inhalers from their individual molded parts, formulate both the Afrezza and Tyvaso DPI inhalation powders, fill plastic cartridges with the powders, package the cartridges into secondary packaging and assemble final kits for certain stock-keeping units. Other semi-finished goods are assembled into the final kits for commercial sale by a contract packager.

Previous wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate and remediate vulnerabilities in our information technology systems (such as our hardware and/or software, including that of third parties with whom we work), but we may not be able to detect, mitigate, and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. We have in the past experienced security incidents. For example, like many companies, we use SolarWinds to help manage our information technology systems. A cyber-attack on SolarWinds was discovered in December 2020 and widely exploited by threat actors. Upon learning of this vulnerability, we applied the software patch provided by SolarWinds and remediated the incident. The incident did not appear to have any negative impact on our operations or the sensitive information we may process. In addition, a ransomware attack on Ultimate Kronos Group’s (“UKG”) Kronos Private Cloud service was discovered in December 2021. At the time, we used UKG Pro, a product offered through UKG that is not in the Kronos Private Cloud, for human capital management. UKG is not aware of an impact on UKG Pro and the incident did not appear to have any negative impact on our operations or the sensitive information we may process. These incidents illustrate that despite our efforts to identify and remediate vulnerabilities, if any, in our information technology systems, our efforts may not be successful.

Current wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate and remediate vulnerabilities in our information technology systems (such as our hardware and/or software, including that of third parties with whom we work), but we may not be able to detect, mitigate, and remediate all such vulnerabilities including on a timely basis. It may also be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities, which could be exploited and result in a security incident. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. We have in the past experienced security incidents. For example, like many companies, we use SolarWinds to help manage our information technology systems. A cyber-attack on SolarWinds was discovered in December 2020 and widely exploited by threat actors. Upon learning of this vulnerability, we applied the software patch provided by SolarWinds and remediated the incident. The incident did not appear to have any negative impact on our operations or the sensitive information we may process. In addition, a ransomware attack on Ultimate Kronos Group’s (“UKG”) Kronos Private Cloud service was discovered in December 2021. At the time, we used UKG Pro, a product offered through UKG that is not in the Kronos Private Cloud, for human capital management. UKG is not aware of an impact on UKG Pro and the incident did not appear to have any negative impact on our operations or the sensitive information we may process. These incidents illustrate that despite our efforts to identify and remediate vulnerabilities, if any, in our information technology systems, our efforts may not be successful.

Previous wording

Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to implement other requirements, such as providing credit monitoring. Such disclosures and compliance with such requirements are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our products, deter new customers from using our products, and negatively impact our ability to grow and operate our business. Additionally, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our cybersecurity insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Current wording

Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosures or the failure to comply with such applicable requirements could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our products, deter new customers from using our products, and negatively impact our ability to grow and operate our business. Additionally, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our cybersecurity insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Previous wording

Our losses have had, and may continue to have, an adverse impact on our working capital, total assets and stockholders’ equity. Our ability to achieve and sustain positive cash flow from operations and profitability depends heavily upon successfully commercializing our products, and although we had positive cash flows from operations during the three months ended March 31, 2024 and the year ended December 31, 2023, we may not generate positive cash flow from operations or be profitable in the future.

Current wording

Our losses have had, and may continue to have, an adverse impact on our working capital, total assets and stockholders’ equity. Our ability to achieve and sustain positive cash flow from operations and profitability depends heavily upon successfully commercializing our products, and although we had positive cash flows from operations during the six months ended June 30, 2024 and the year ended December 31, 2023, we may not generate positive cash flow from operations or be profitable in the future.

Previous wording

Although we had positive cash flows from operating activities during the three months ended March 31, 2024 and the year ended December 31, 2023, we have a history of operating losses. As of March 31, 2024, we had an accumulated deficit of $230.0 billion. The accumulated deficit has resulted principally from costs incurred in our R&D programs, the write-off of assets (including goodwill, inventory and property, plant and equipment) and general operating expenses. We expect to make substantial expenditures and may incur operating losses in the future in order to continue commercializing our products and to advance development of product candidates in our pipeline.

Current wording

As of June 30, 2024, we had an accumulated deficit of $3.2 billion. The accumulated deficit has resulted principally from costs incurred in our R&D programs, the write-off of assets (including goodwill, inventory and property, plant and equipment) and general operating expenses. We expect to make substantial expenditures and may incur operating losses in the future in order to continue commercializing our products and to advance development of product candidates in our pipeline.

Previous wording

For example, in June 2023, the contract manufacturer responsible for the production of clofazimine inhalation solution, the investigational product we are developing as MNKD-101, experienced a fire in its manufacturing facility in Germany. As a result of the incident, the initiation of a Phase 3 clinical study of MNKD-101, originally planned for late 2023, is now expected to commence in the second quarter of 2024. If we fail to commence or complete, or experience delays in or are forced to curtail, our proposed development programs or otherwise fail to adhere to our projected development goals in the timeframes we expect (or within the timeframes expected by analysts or investors), our business, financial condition and results of operations may be harmed and the market price of our common stock and other securities may decline. In addition, we may be delayed or prevented from generating revenues from milestone or other payments that depend on our ability to achieve any milestone obligations specified in an out-licensing arrangement.

Current wording

If we fail to commence or complete, or experience delays in or are forced to curtail, our proposed development programs or otherwise fail to adhere to our projected development goals in the timeframes we expect (or within the timeframes expected by analysts or investors), our business, financial condition and results of operations may be harmed and the market price of our common stock and other securities may decline. In addition, we may be delayed or prevented from generating revenues from milestone or other payments that depend on our ability to achieve any milestone obligations specified in an out-licensing arrangement.

Previous wording

In addition, at the state level, there may be periods during which the use of net operating loss carryforwards is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. As a result, if we earn net taxable income, we may be unable to use all or a material portion of our net operating loss carryforwards and other tax attributes, which could potentially result in increased future tax liability to us and adversely affect our future cash flows.

Current wording

In addition, at the state level, there may be periods during which the use of net operating loss carryforwards is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. For example, California imposed limits on the usability of California state net operating losses to offset taxable income in tax years 2024 through 2026. As a result, if we earn net taxable income, we may be unable to use all or a material portion of our net operating loss carryforwards and other tax attributes, which could potentially result in increased future tax liability to us and adversely affect our future cash flows.

Previous wording

Adverse developments that affect financial institutions, such as events involving liquidity that are rumored or actual, have in the past and may in the future lead to bank failures and market-wide liquidity problems. For example, on March 10, 2023, Silicon Valley Bank (“SVB”) was closed by the California Department of Financial Protection and Innovation, which appointed the Federal Deposit Insurance Corporation (“FDIC”) as receiver. Similarly, on March 12, 2023, Signature Bank and Silvergate Capital Corp. were each swept into receivership. In addition, on May 1, 2023, the FDIC seized First Republic Bank and sold its assets to JPMorgan Chase & Co. While the U.S. Department of Treasury, FDIC and Federal Reserve Board have implemented a program to provide up to $25 billion of loans to financial institutions secured by certain of such government securities held by financial institutions to mitigate the risk of potential losses on the sale of such instruments, widespread demands for customer withdrawals or other liquidity needs of financial institutions for immediate liquidity may exceed the capacity of such program, there is no guarantee that such programs will be sufficient. Additionally, it is uncertain whether the U.S. Department of Treasury, FDIC and Federal Reserve Board will provide access to uninsured funds in the future in the event of the closure of other banks or financial institutions, or that they would do so in a timely fashion.

Current wording

Adverse developments that affect financial institutions, such as events involving liquidity that are rumored or actual, have in the past and may in the future lead to bank failures and market-wide liquidity problems. For example, in March 2023, Silicon Valley Bank (“SVB”) was closed by the California Department of Financial Protection and Innovation, which appointed the Federal Deposit Insurance Corporation (“FDIC”) as receiver. Similarly, days later, Signature Bank and Silvergate Capital Corp. were each swept into receivership. In addition, in May 2023, the FDIC seized First Republic Bank and sold its assets to JPMorgan Chase & Co. While the U.S. Department of Treasury, FDIC and Federal Reserve Board have implemented a program to provide up to $25 billion of loans to financial institutions secured by certain of such government securities held by financial institutions to mitigate the risk of potential losses on the sale of such instruments, widespread demands for customer withdrawals or other liquidity needs of financial institutions for immediate liquidity may exceed the capacity of such program, there is no guarantee that such programs will be sufficient. Additionally, it is uncertain whether the U.S. Department of Treasury, FDIC and Federal Reserve Board will provide access to uninsured funds in the future in the event of the closure of other banks or financial institutions, or that they would do so in a timely fashion.

Previous wording

Our future revenues and ability to generate positive cash flow from operations may be affected by the continuing efforts of government and other third-party payers to contain or reduce the costs of healthcare through various means. In the United States, there have been several congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for products. At the federal level, in July 2021, the Biden administration released an executive order, “Promoting Competition in the American Economy,” with multiple provisions aimed at prescription drugs. In response to Biden’s executive order, on September 9, 2021, the U.S. Department of Health and Human Services (“HHS”) released a Comprehensive Plan for Addressing High Drug Prices that outlines principles for drug pricing reform and sets out a variety of potential legislative policies that Congress could pursue as well as potential administrative actions HHS can take to advance these principles. In addition, the IRA, among other things, (1) directs HHS to negotiate the price of certain single-source drugs and biologics covered under Medicare and (2) imposes rebates under Medicare Part B and Medicare Part D to penalize price increases that outpace inflation. These provisions take effect progressively starting in fiscal year 2023. On August 29, 2023, HHS announced the list of the first ten drugs that will be subject to price negotiations, although the Medicare drug price negotiation program is currently subject to legal challenges. Further, in response to the Biden administration's October 2022 executive order, on February 14, 2023, HHS released a report outlining three new models for testing by the CMS Innovation Center which will be evaluated on their ability to lower the cost of drugs, promote accessibility, and improve quality of care. It is unclear whether the models will be utilized in any health reform measures in the future. On December 7, 2023, the Biden administration announced an initiative to control the price of prescription drugs through the use of march-in rights under the Bayh-Dole Act. On December 8, 2023, the National Institute of Standards and Technology published for comment a Draft Interagency Guidance Framework for Considering the Exercise of March-In Rights which for the first time includes the price of a product as one factor an agency can use when deciding to exercise march-in rights. While march-in rights have not previously been exercised, it is uncertain if that will continue under the new framework. At the state level, legislatures have increasingly passed legislation and implemented regulations designed to control pharmaceutical and biological product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product acc…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Our future revenues and ability to generate positive cash flow from operations may be affected by the continuing efforts of government and other third-party payers to contain or reduce the costs of healthcare through various means. In the United States, there have been several congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for products. At the federal level, in July 2021, the Biden administration released an executive order, “Promoting Competition in the American Economy,” with multiple provisions aimed at prescription drugs. In response to Biden’s executive order, on September 9, 2021, the U.S. Department of Health and Human Services (“HHS”) released a Comprehensive Plan for Addressing High Drug Prices that outlines principles for drug pricing reform and sets out a variety of potential legislative policies that Congress could pursue as well as potential administrative actions HHS can take to advance these principles. In addition, the IRA, among other things, (1) directs HHS to negotiate the price of certain single-source drugs and biologics covered under Medicare and (2) imposes rebates under Medicare Part B and Medicare Part D to penalize price increases that outpace inflation. These provisions take effect progressively starting in fiscal year 2023. On August 29, 2023, HHS announced the list of the first ten drugs that will be subject to price negotiations, although the Medicare drug price negotiation program is currently subject to legal challenges. Further, in response to the Biden administration's October 2022 executive order, on February 14, 2023, HHS released a report outlining three new models for testing by the Centers for Medicare & Medicaid Services ("CMS") Innovation Center which will be evaluated on their ability to lower the cost of drugs, promote accessibility, and improve quality of care. It is unclear whether the models will be utilized in any health reform measures in the future. On December 7, 2023, the Biden administration announced an initiative to control the price of prescription drugs through the use of march-in rights under the Bayh-Dole Act. On December 8, 2023, the National Institute of Standards and Technology published for comment a Draft Interagency Guidance Framework for Considering the Exercise of March-In Rights which for the first time includes the price of a product as one factor an agency can use when deciding to exercise march-in rights. While march-in rights have not previously been exercised, it is uncertain if that will continue under the new framework. At the state level, legislatures have increasingly passed legislation and implemented regulations designed to control pharmaceutical and biological product pricing, including price or patient reimbursement constraints, d…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

The federal Physician Payments Sunshine Act under PPACA, which requires certain manufacturers of drugs, devices, biologics, and medical supplies to report annually to Centers for Medicare & Medicaid Services (“CMS”) information related to payments and other transfers of value to physicians (defined to include defined to include doctors, dentists, optometrists, podiatrists and chiropractors), certain other healthcare professionals (such as physician assistants and nurse practitioners), and teaching hospitals, and ownership and investment interests held by physicians and their immediate family members.

Current wording

The federal Physician Payments Sunshine Act under PPACA, which requires certain manufacturers of drugs, devices, biologics, and medical supplies to report annually to CMS information related to payments and other transfers of value to physicians (defined to include defined to include doctors, dentists, optometrists, podiatrists and chiropractors), certain other healthcare professionals (such as physician assistants and nurse practitioners), and teaching hospitals, and ownership and investment interests held by physicians and their immediate family members.

Previous wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union's General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”) (EU GDPR and UK GDPR, collectively “GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018), and Australia’s Privacy Act impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to the processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Current wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union's General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”) (EU GDPR and UK GDPR, collectively “GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018), and Australia’s Privacy Act impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to the processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. We may also be subject to new and emerging data privacy regimes in Asia, including Japan’s Act on the Protection of Personal Information.

Previous wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (“EEA”) and the United Kingdom (“UK”) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework)these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Some European regulators have prevented companies from transferring personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. The United States is also increasingly scrutinizing certain data transfers and may also impose certain data localization requirements, particularly if we transfer personal data to, or process personal data of residents of, high risk or sanctioned jurisdictions.

Current wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (“EEA”) and the United Kingdom (“UK”) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework)these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Some European regulators have prevented companies from transferring personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. Regulators in the United States are also increasingly scrutinizing certain personal data transfers and may impose data localization requirements, particularly if we transfer personal data to, or process personal data of residents of, high risk or sanctioned jurisdictions, such as the Biden Administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.