We rely heavily on communications and information systems to conduct our business. In the ordinary course of business, we collect and store sensitive data, including our own intellectual property and other proprietary business information and that of our customers, suppliers and business partners, as well as personally identifiable information of our customers and employees, in our data centers and on our networks or in the cloud. Our operations rely on the secure processing, storage and transmission of confidential and other information on both our own, or cloud-based, computer systems and networks. We have made significant investments to ensure our employees are aware of cyber security risks facing our company and how to prevent data breaches. We have modernized our cyber security tools, and are continually modernizing our cyber security processes, in an attempt to keep pace with evolving cyber security risks. In spite of our efforts, we are unable to completely eliminate these risks and occasionally experience minor cyber security incidents. External phishing emails (occurring outside of our computer services) are a growing threat our customers are facing. These emails could lead to the disclosing of intellectual property or personally identifiable information, which could lead to financial harm or reputational damage. While our cyber security team works diligently with our employees around the world, as well as with our customers, to mitigate these threats by helping to identify and analyze phishing emails, we cannot guarantee that sensitive data will not be lost or stolen.
A breach in cyber security due to unauthorized access to our computer systems or misuse could include the misappropriation of assets or sensitive information, the corruption data or other operational disruption. Failures to our computer systems and networks could be caused by internal or external events, such as incursions by intruders or hackers, computer viruses, failures in hardware or software, or cyber terrorists. If we do experience a breach or failure of our systems, we could experience potentially significant operational delays resulting from the disruption of systems, loss due to theft or misappropriation of assets or data, or negative impacts from the loss of confidential data or intellectual property. We may face significant liability in the event personal information we maintain is lost or otherwise subject to misuse or other wrongful use, access or disclosure. Further, we could experience negative publicity resulting in reputation or brand damage with customers or partners.
Additionally, we are subject to privacy and data security laws across multiple jurisdictions, including those relating to the storage of health information, which are complex, overlapping and rapidly evolving. In the U.S., individual states regulate requirements and have authority over privacy and personal data protection. For example, the California Consumer Privacy Act of 2018, which took effect on January 1, 2020, imposes expansive new requirements and protections upon the processing of personal data, aimed at giving California consumers more visibility into and control over their personal information There are also European privacy laws, such as the General Data Protection Regulation (GDPR) of the European Union, that impose restrictions on the transfer, access, use and disclosure of health and other personal information. We have implemented the requirements set forth by the GDPR, which took effect on May 25, 2018. As our activities continue to evolve and expand, we may be subject to additional laws that impose further restrictions on the transfer, access, use and disclosure of health and other personal information, which may impact our business either directly or indirectly. A failure to comply with applicable privacy or security laws or significant changes in these laws could subject us to costly regulatory action or lawsuits and could adversely impact our reputation, business and future business plans. For example, we may be subject to regulatory action or lawsuits in the event we fail to comply with applicable privacy laws.