We receive, process, store and use business and personal data relating to our employees, business contacts, members and customers around the world (collectively, "Personal Data"), including the United States and the European Economic Area ("EEA"). As a result, our business is subject to a number of federal, state, local and foreign laws, regulations, regulatory codes and guidelines governing data privacy, data protection and security, including with respect to the collection, storage, use, processing, transmission, disclosure and protection of Personal Data.
For example, in the United States, the data protection landscape is rapidly growing and evolving on both the state and federal level. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. For example, over a third of U.S. states have passed their own comprehensive consumer privacy laws that have or will soon go into effect that introduce new data privacy rights for consumers and new operational requirements for companies. For instance, the California Consumer Privacy Act ("CCPA") provides data privacy rights for California residents and operational requirements for covered businesses. Among other things, companies covered by the CCPA must provide new disclosures to California residents and afford such residents certain privacy rights relating to their Personal Data. The CCPA also considers certain financial information to be "sensitive personal information" imposing additional requirements on businesses. The CCPA is enforceable by the California Attorney General and the California Privacy Protection Agency, a new, additional enforcement bureau. The California Privacy Protection Agency is continuously amending the CCPA regulations, building upon the requirements in the CCPA, including with respect to automated decision making, risk assessment, and cybersecurity audits. In the event of an actual or perceived violation of the CCPA, these regulators could seek severe statutory damages, injunctive relief or agreed settlements providing for ongoing audit and reporting requirements. There is also a private right of action relating to certain data security incidents. Additionally, laws in all fifty U.S. states require notification of certain incidents to a number of third parties, such as impacted customers, regulators, credit reporting agencies or others when certain information has been compromised as a result of a security breach. We cannot fully predict the impact of these laws, or subsequent guidance, regulations or rules on our business or operations, but they may increase our compliance costs and potential liability, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use Personal Data, our financial condition, and the results of our operations or prospects. Further, if we become subject to new state-level privacy laws, guidelines or regulations in the future, we may be required again to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.
Furthermore, at the federal level, we are also subject to laws, regulations and standards covering financial institutions, marketing, advertising, cookies, tracking technologies, e-marketing, and other activities conducted by telephone, email, mobile devices and the internet, such as the Gramm-Leach-Bliley Act ("GLBA"), the Federal Wiretap Act, the Telephone Consumer Protection Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, and similar state consumer protection and communication privacy laws. The GLBA regulates, among other things, the use of certain information about individuals ("non-public personal information") in the context of the provision of financial services. The GLBA includes both a "Privacy Rule," which imposes obligations on financial institutions relating to the use or disclosure of non-public personal information, and a "Safeguards Rule," which imposes obligations on financial institutions and, indirectly, their service providers to implement and maintain physical, administrative and technological measures to protect the security of non-public personal financial information. Any failure to comply with the GLBA could result in substantial financial penalties.
Additionally, the Federal Trade Commission ("FTC") and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers' Personal Data secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. There are a number of legislative proposals in the United States, at both the federal and state level, and in the EU and more globally, that could impose new obligations in areas such as e-commerce and other related legislation or liability for copyright infringement by third parties. We cannot yet determine the impact that these future laws, regulations and standards may have on our business.
In addition, the EU General Data Protection Regulation (the "EU GDPR") and to the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (collectively, the "UK GDPR") (the EU GDPR and UK GDPR together referred to as the "GDPR") which impose stringent data protection requirements for processing the Personal Data of individuals. The GDPR places data protection obligations on processors and controllers of personal data, including, for example, disclosure and transparency requirements, limitations on retention and processing of personal data, and mandatory data breach notification requirements. In addition, the GDPR regulates transfers of Personal Data subject to the GDPR to third countries that have not been found to provide adequate protection to such Personal Data, and we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the European Commission approval of the current EU-US Data Privacy Framework for data transfers to certified entities in the United States to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes; we may have to implement alternative data transfer mechanisms under the GDPR and/or take additional compliance and operational measures; and/or it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition.
Since we are under the supervision of relevant data protection authorities in both the EEA and the UK, we may be fined under both the EU GDPR and UK GDPR for the same breach. Penalties for certain breaches are up to the greater of EUR 20 million/ GBP 17.5 million or 4% of our global annual turnover. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/ change our data processing activities, enforcement notices, assessment notices for a compulsory audit and/or civil claims (including class actions).
We are also subject to evolving EU and UK privacy laws on cookies, tracking technologies and e-marketing. In the EU and UK, informed consent is required for the placement of certain cookies or similar tracking technologies on an individual's device and for direct electronic marketing. Consent is tightly defined and includes a prohibition on pre-checked consents and a requirement to obtain separate consents for each type of cookie or similar technology. Recent European court and regulator decisions are driving increased attention to cookies and similar tracking technologies.
In addition to the EU, a growing number of other global jurisdictions are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of Personal Data or similar requirements that could increase the cost and complexity of delivering our platform, particularly as we expand our operations internationally. Some of these laws, such as the General Data Protection Law in Brazil, or the Act on the Protection of Personal Information in Japan, impose similar obligations as those under the GDPR. Others, such as those in Russia, India and China, could potentially impose more stringent obligations, including data localization requirements.
We seek to comply with applicable laws, regulations, policies, legal obligations and industry standards and have developed privacy policies, data processing addenda and internal privacy procedures to reflect our practices designed to achieve such compliance. However, such laws, regulations, regulatory codes and guidelines regulations are complex, may be inconsistent across jurisdictions or conflict with other rules and their interpretation is rapidly evolving, making implementation and enforcement, and thus compliance requirements, ambiguous, uncertain, and potentially inconsistent and therefore, there can be no assurance that our policies and process will be fully implemented, complied with, or effective. For instance, laws in all fifty U.S. states and outside the United States (and sometimes contractual and/or other obligations) and certain international laws and regulations require notification of certain incidents to a number of third parties, such as impacted customers, regulators, credit reporting agencies or others when certain information has been compromised as a result of a security breach. Compliance with such laws may require changes to our data collection, use, transfer, disclosure, other processing, and certain other related business practices and may thereby increase compliance costs or have other material adverse effects on our business. Further, any significant change in applicable laws, regulations, or industry practices regarding the use or disclosure of our Personal Data, could require us to modify our platform, possibly in a material manner, and may limit our ability to develop new services and features that make use of Personal Data regarding our members and customers.
If we are unable to develop and offer features that meet legal requirements or help our members and customers meet their obligations under the laws or regulations relating to privacy, data protection, or information security, or if we violate or are perceived to violate any laws, regulations, or other obligations relating to privacy, data protection, or information security, we may experience reduced demand for our platform, harm to our reputation and become subject to investigations, claims and other remedies, which would expose us to significant fines, penalties and other damages, all of which would harm our business. Further, given the breadth and depth of changes in global data protection obligations, compliance has caused us to expend significant resources, and such expenditures are likely to continue into the future as we continue our compliance efforts and respond to new interpretations and enforcement actions.
In addition to laws relating to data privacy and security, we are subject to self-regulatory standards and industry certifications that may legally or contractually apply to us. These include the Payment Card Industry Data Security Standards ("PCI-DSS") with which we are currently compliant. In the event that we fail to comply with the PCI-DSS, we could be in breach of our obligations under customer and other contracts, fines and other penalties could result, and we may suffer reputational harm and damage to our operations, financial performance, reputation and business. Further, our clients may expect us to comply with more stringent privacy and data security requirements than those imposed by laws, regulations, or self-regulatory requirements, and we may be obligated contractually to comply with additional or different standards relating to our handling or protection of data on or by our offerings.