Our operations are subject to numerous governmental laws and regulations, including those governing antitrust and competition, the environment, collection, recycling, treatment and disposal of covered electronic products and components, import and export of products, currency conversions and repatriation, taxation of foreign earnings and use of local employees and suppliers. An inability to comply with these regulations or obtain any necessary certifications in a timely manner could have an adverse effect on our business and results of operations.
Manufacturers of electrical goods are subject to the European Union's RoHS2 and WEEE directives, which took effect during 2006. RoHS2 prohibits the use of lead, mercury and certain other specified substances in electronics products, and WEEE makes producers of electrical goods financially responsible for specified collection, recycling, treatment, and disposal of covered electronic products and components. While we currently hold RoHS2 and WEEE registration and believe we are in compliance with the directives of the European Union, including the RoHS2 directive, parallel initiatives are being proposed in other jurisdictions, including several states in the United States and China. If we do not comply with any such initiatives, our sales and results of operations could be materially impacted.
In addition, a number of data protection laws impact, or may impact, the manner in which we collect, process and transfer personal data. Most notably, the European Union's General Data Protection Regulation ("EU GDPR") and the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (collectively, the "UK GDPR") (the EU GDPR and UK GDPR together referred to as the "GDPR"). The GDPR imposes comprehensive data privacy compliance obligations in relation to our collection, processing, sharing, disclosure, transfer and other use of data relating to an identifiable living individual or "personal data", including a principal of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit.
Further, a number of other regions where we do business, including the United States, the Asia-Pacific region and Latin America, have enacted or are considering new data protection regulations that may impact our business activities that involve the processing of personal data. For example, in the United States, the Federal Trade Commission and state regulators enforce a variety of data privacy issues. In addition, certain states, including California, Colorado, Connecticut, Virginia and Utah, have adopted new or modified privacy and security laws and regulations that may apply to our business. These laws are prompting a wave of similar legislative developments in other states in the United States, which creates the potential for a patchwork of overlapping but different state laws. In order to comply with the varying state laws around data breaches, we must maintain adequate security measures, which require significant investments in resources and ongoing attention.
In addition, U.S. and international laws that have been applied to protect user privacy (including laws regarding unfair and deceptive practices in the U.S. and GDPR in the EU and UK) may be subject to evolving interpretations or applications in light of privacy developments. For example, evolution of laws governing the cross-border transfer of data, such the Court of Justice of the European Union ("CJEU") invalidating the EU-U.S. Privacy Shield in 2020. The CJEU noted that reliance on the standard contractual clauses alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis, creates additional uncertainty around the legality and logistics of such transfers. The European Commission has since published revised standard contractual clauses for data transfers from the EEA: the revised clauses have been mandatory for relevant transfers since September 27, 2021; existing standard contractual clauses arrangements were required to be migrated to the revised clauses by December 27, 2022. We have or are in the process of implementing revised standard contractual clauses for existing intragroup, customer and vendor arrangements. In addition, the United Kingdom's Information Commissioner's Office has published new data transfer standard contracts for transfers from the UK under the UK GDPR. This new documentation was mandatory for relevant data transfers from September 21, 2022; existing standard contractual clauses arrangements must be migrated to the new documentation by March 21, 2024. We will be required to implement the latest UK data transfer documentation for data transfers subject to the UK GDPR, in relation to relevant existing contracts and certain additional contractual arrangements, within the relevant time frames.
Further, European court and regulatory decisions subsequent to the CJEU decision have taken a restrictive approach to international data transfers. Therefore, as the enforcement landscape further develops, and supervisory authorities issue further guidance on international data transfers, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors and make other operational changes. More generally, compliance with enhanced data protection laws requires additional resources and efforts, and noncompliance with personal data protection regulations could result in increased regulatory enforcement and significant monetary fines and costs.
Failure to comply with the GDPR could result in penalties for noncompliance. Since we are subject to the supervision of relevant data protection authorities under both the EU GDPR and the UK GDPR, we could be fined under each of those regimes independently in respect of the same breach. Penalties for certain breaches are up to the greater of EUR 20 million/ GBP 17.5 million or 4% of our global annual turnover. In addition to fines, a breach of the GDPR may result in regulatory investigations, reputational damage, orders to cease/ change our data processing activities, enforcement notices, assessment notices (for a compulsory audit) and/ or civil claims (including class actions). Outside of the EU and the UK other data privacy regimes may impose similar fines and consequences on the same or greater scale.