We receive, store, handle, transmit, use and otherwise process business information and information related to individuals, including from and about actual and prospective tenants, as well as our employees and service providers. We also depend on a number of third-party vendors in relation to the operation of our business, a number of which we rely on to process personal data on our behalf. While we may not be responsible for the compliance with certain laws, failure by such third parties to comply with those laws could result in harm to our reputation and brand and require us to expend significant resources.
We and our vendors are subject to a variety of federal and state data privacy laws, rules, regulations, industry standards and other requirements, including those that apply generally to the handling of information about individuals, and those that are specific to certain industries, sectors, contexts, or locations. These requirements, and their application, interpretation and amendment are constantly evolving and developing.
We also are subject to laws, rules, and regulations in the United States, such as the California Consumer Protection Act (the "CCPA" (which became effective on January 1, 2020 and is amended by the California Privacy Rights Act)), relating to the collection, use, disclosure and security of employee and business contact data. For other personal data, including tenant, we rely on our third-party partners to store and process such data. Among other things, the CCPA: requires disclosures to such residents about the data collection, use and disclosure practices of covered businesses; provides such individuals expanded rights to access, delete, and correct their personal information, and opt-out of certain sales or transfers of personal information; and provides such individuals with a private right of action and statutory damages for certain data breaches. The enactment of the CCPA is prompting a wave of similar legislative developments in other states in the United States, which creates the potential for a patchwork of overlapping but different state laws. Evolving compliance and operational requirements under the CCPA and the privacy and data security laws of other jurisdictions in which we operate impose significant costs that are likely to increase over time. Our failure, or the failure of third-party partners we rely on to process data, to comply with laws, rules, and regulations related to privacy and data protection could harm our business or reputation.
Additionally, we rely on third-party property managers to run background checks on prospective tenants. Those third-party managers are considered "users" of consumer reports provided by consumer reporting agencies ("CRAs") under the Fair Credit Reporting Act, as amended by the Fair and Accurate Credit Transactions Act (collectively, "FCRA"). FCRA regulates and protects consumer information and, among other things, imposes specific obligations "users" of consumer reports. Such obligations include notifying consumers when such reports are used to make an adverse decision, and, in the context of completing employee background checks, providing a notice containing certain disclosures to the consumer and obtaining their consent. Noncompliance with the FCRA can lead to civil and even criminal penalties, and it permits consumers to bring a private right of action if they are unsatisfied with the dispute resolution process.
Further, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet may be or become applicable to our business, such as the Telephone Consumer Protection Act (the "TCPA"), the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (the "CAN-SPAM Act"), and similar state consumer protection and communication privacy laws, such as California's Invasion of Privacy Act.
Third-party property managers send short message service, or SMS, text messages to tenants. The actual or perceived improper sending of such text messages may subject us to potential risks, including liabilities or claims relating to consumer protection laws such as the TCPA. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the TCPA imposes significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. Federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our SMS texting practices are not adequate or violate applicable law. This may in the future result in civil claims against us. Claims that we have violated the TCPA could be costly to litigate, whether or not they have merit, and could expose us to substantial statutory damages or costly settlements.
Third-party property managers send marketing messages via email and are subject to the CAN-SPAM Act. The CAN-SPAM Act imposes certain obligations regarding the content of emails and providing opt-outs (with the corresponding requirement to honor such opt-outs promptly). While we strive to ensure that all of our marketing communications comply with the requirements set forth in the CAN-SPAM Act, any violations could result in the FTC seeking civil penalties against us.
Moreover, as our third-party property managers accept debit and credit cards for payment, they are subject to the Payment Card Industry Data Security Standard ("PCI-DSS"), issued by the Payment Card Industry Security Standards Council. PCI-DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data. If our third-party property managers or other service providers are unable to comply with the security standards established by banks and the payment card industry, we may be subject to fines, restrictions and expulsion from card acceptance programs, which could materially and adversely affect our business.
Any failure or perceived failure by us to comply with data privacy laws, rules, regulations, industry standards and other requirements could result in proceedings or actions against us by individuals, consumer rights groups, government agencies, or others. We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages or fines or be required to make changes to our business. Further, these proceedings and any subsequent adverse outcomes may subject us to significant negative publicity and an erosion of trust. If any of these events were to occur, our business, results of operations, and financial condition could be materially adversely affected.