We rely on information technology systems to process, transmit, store, and protect electronic information. For example, a significant portion of the communications between our personnel, customers, and suppliers depends on information technology. Our information technology systems may be vulnerable to a variety of interruptions due to events beyond our control, including, but not limited to, natural disasters, terrorist attacks, telecommunications failures, computer viruses, hackers, and other security issues. Although we have technology and information security processes and disaster recovery plans in place to mitigate our risks to these vulnerabilities, these measures may not be adequate to ensure that our operations will not be disrupted, should such an event occur.
The General Data Protection Regulation ("GDPR"), which went into effect in the European Union (EU) on May 25, 2018, applies to the collection, use, retention, security, processing, and transfer of personally identifiable information of residents of E.U. countries. The GDPR created a range of new compliance obligations and imposes significant fines and sanctions for violations. It is possible that the GDPR may be interpreted or applied in a manner that is adverse to, or unforeseen by us, including requirements that are inconsistent with our practices, or that we may otherwise fail to construe its requirements in ways that are satisfactory to the E.U. authorities. Upon leaving the E.U. on January 31, 2021, the U.K. enacted a new domestic data privacy law called the "U.K. – General Data Protection Regulation" ("UK-GDPR"). Although somewhat less restrictive than the GDPR, the UK-GDPR is similar to the GDPR with respect to both an entity's obligation to protect personal information and the imposition of significant fines for violations.
Any failure, or perceived failure, by us to comply with the GDPR or the UK-GDPR, or with any applicable regulatory requirements or orders, including, but not limited to privacy, data protection, information security, or consumer protection related privacy laws and regulations, in one or more jurisdictions within the E.U., the U.K. or elsewhere, could: result in proceedings or actions against us by governmental entities or individuals; subject us to significant fines, penalties, and/or judgments; require us to change our business practices; limit access to our products and services in certain countries, or otherwise adversely affect our business, as we would be at risk to lose both customers and revenue, and incur substantial costs.