We are subject to or affected by a number of foreign, federal, state and local laws and regulations, as well as contractual obligations and industry standards, that impose obligations and restrictions with respect to data privacy and security, and govern our collection, storage, retention, protection, use, transmission, sharing, and disclosure of personal information including that of our employees, customers and others. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities and others of security breaches involving certain types of data. Such laws may be inconsistent or may change. Governmental authorities may adopt new or additional laws governing personal data.
The global data protection landscape is rapidly evolving, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. We may not be able to monitor and react to all developments in a timely manner. In the United States, California adopted the California Consumer Privacy Act ("CCPA"), which became effective in January 2020. The CCPA establishes a privacy framework for covered businesses, including an expansive definition of personal information and data privacy rights for California residents. The CCPA includes a framework with potentially severe statutory damages and private rights of action for data breaches. Specifically, the CCPA requires covered businesses to provide new disclosures to California residents, provide them new ways to opt-out of the sale of personal information. The CCPA provides for civil penalties for violations and statutory damages ranging from $100 to $750 per violation, which is expected to increase data breach class action litigation and result in exposure to costly legal judgments and settlements. The CCPA was expanded on January 1, 2023, when the California Privacy Rights Act ("CPRA") becomes operative. The CPRA, among other things, gave California residents the ability to limit the use of certain sensitive personal information, further restricted the use of cross-contextual advertising, establish restrictions on the retention of personal information, expanded the types of data breaches subject to the CCPA's private right of action, provide for increased penalties for CPRA violations concerning California residents under the age of 16, and established a new California Privacy Protection Agency to implement and enforce California's privacy laws. As we expand our operations, the CCPA may increase our compliance costs and potential liability. Some observers have noted that the CCPA marks the beginning of a trend toward more stringent privacy legislation in the United States, evidenced by new privacy laws that have become effective in states such as Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia. Other states have begun to propose or enact similar laws.
In Europe, the General Data Protection Regulation (EU) 2016/679 (GDPR), applies across the European Economic Area (EEA). Also, notwithstanding the United Kingdom's (UK) withdrawal from the European Union, by operation of the so-called "UK GDPR," the GDPR continues to apply in substantially equivalent form in the context of UK-focused personal data processing operations. Collectively, European data protection laws (including the GDPR) are wide-ranging in scope and impose numerous, significant and complex compliance burdens in relation to the processing of personal data such as, without limitation, with regard the international transfer of personal data out of the European Economic Area, Switzerland and United Kingdom. European data protection laws also provide for more robust regulatory enforcement and greater penalties for noncompliance than previous data protection laws, including, for example, under the GDPR, fines of up to €20 million or 4.0% of global annual revenue of any noncompliant organization for the preceding financial year, whichever is higher. The GDPR also confers regulators with the ability to impose personal data processing penalties; and a private right of action for data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, as well as obtain compensation for damages resulting from violations of the GDPR. Compliance with any applicable privacy and data security laws and regulations is a cost and time-intensive process, and we may be required to put in place additional mechanisms to comply with such laws and regulations.
We publish privacy policies and other documentation regarding our collection, processing, use and disclosure of personal information and/or other confidential information. Although we endeavor to comply with our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, contractors, service providers or vendors fail to comply with our published policies and documentation. Such failures can subject us to potential local, state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Claims that we have violated individuals' privacy rights or failed to comply with data protection laws or applicable privacy notices even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.