We process sensitive, confidential or personal data or information in the ordinary course of our business that is subject to privacy and security laws, regulations, industry standards, external and internal policies, contracts and other obligations that govern the collection, processing, storing, transfer, and sharing of such data by us and on our behalf. Concerns about our practices or the ultimate use of our products and services with regard to the collection, use, retention, security or disclosure of personal information or other privacy-related matters, including for use in AI technologies, even if unfounded, could damage our reputation and adversely affect our operating results. The theft, loss or misuse of personal data in our possession or by one of our partners could result in damage to our reputation, regulatory proceedings, disruption of our business activities or increased security or remediation costs and costs related to defending legal claims.
In the United States, federal, state, and local authorities have enacted numerous data privacy and security laws, including for data breach notification, personal data privacy and consumer protection. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, or CPRA, or collectively the CCPA, gives California residents the right to access, delete and opt-out of certain sharing of their personal information, and to receive detailed information about how it is used and shared. The CCPA provides for substantial fines for intentional violation and the law created a private right of action for certain data breaches. Similar laws are being considered in several other states, as well as at the federal and local levels. Additionally, several states and localities have enacted measures related to the use of AI in products and services. If we become subject to additional data privacy laws, the risk of enforcement action against us could increase.
Worldwide regulatory authorities are also considering and have enacted various laws concerning data protection. The European Union adopted the General Data Protection Regulation, or GDPR, and the United Kingdom similarly adopted the U.K. GDPR, governing the strict handling of personal data of persons within the European Economic Area, or EEA, and the United Kingdom, respectively, including its use and protection and the ability of persons whose data is stored to access, correct, and delete such data about themselves. Additionally, Europe’s Network and Information Security Directive, or NIS2, regulates resilience and incident response capabilities of entities operating in a number of sectors, including the digital infrastructure sector. Non-compliance with NIS2 may lead to administrative fines. If we are found not to comply, we could be subject to monetary fines, penalties, reputational damage, damage to our financial condition, and operating results.
Statutory fines under U.S. or worldwide regulations may be imposed on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Statutory fines under U.S. or worldwide regulations may be imposed on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations.
Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices, and to those of any third parties that process personal data on our behalf.