In Israel, the United States and other jurisdictions in which we operate, we are subject to various laws, industry standards, regulations and other legal and contractual obligations related to privacy, data protection and information security. Such laws and regulations are constantly evolving, subject to uncertain and inconsistent interpretation and enforcement, and also may be expanded. If we are found to have breached any such laws, standards, regulations or obligations, in any such jurisdiction, we may be subject to enforcement actions that require us to change our business practices in a manner which may negatively impact our revenue, as well as expose us to litigation, fines, civil and/or criminal penalties and adverse publicity that could cause our customers to lose trust in us, negatively impacting our reputation and business in a manner that harms our financial position.
As part of our business development, we collect, maintain, transmit, store and otherwise process information about individuals, also referred to as personal information, and other potentially sensitive and/or regulated data from our customers. Laws, regulations and standards in Israel, the United States and around the world restrict how personal information is collected, stored, used, disclosed and otherwise processed, as well as, among other things, set standards for its security, implement notice requirements regarding privacy practices, and provide individuals with certain rights regarding the use, disclosure and sale of their protected personal information.
For example, in the United States, various federal and state regulators, including governmental agencies like the Federal Trade Commission, have adopted, or are considering adopting, laws and regulations concerning privacy, data protection and information security. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA") provides for certain privacy rights for California residents and imposes obligations on companies that process their personal information (including device identifiers, IP addresses, cookies and geo-location). Among other things, the CCPA requires covered companies to provide disclosures to California residents and provide such residents data protection and privacy rights, including the ability to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. A number of other states have also recently adopted, or are considering adopting, comprehensive data privacy, data protection and information security laws similar to the CCPA. Additionally, many statutory requirements, both in the United States and other jurisdictions, include obligations for companies to notify individuals of data breaches involving certain personal information. For example, laws in all 50 U.S. states require businesses to provide notice to residents whose personal information has been disclosed as a result of a data breach State laws are changing rapidly and there is discussion in Congress of a new comprehensive federal data privacy law to which we would become subject if it is enacted.
Internationally, laws, regulations and standards in many jurisdictions apply broadly to the collection, use, retention, security, disclosure, transfer and other processing of personal information. For example, the EU General Data Protection Regulation ("GDPR"), which became effective in May 2018, greatly increased the European Commission's jurisdictional reach of its laws and adds a broad array of requirements for handling personal data (including online identifiers and location data). EU member states are tasked under the GDPR to enact, and have enacted, certain implementing legislation that adds to and/or further interprets the GDPR requirements and potentially extends our obligations and potential liability for failing to meet such obligations. The GDPR, together with national legislation, regulations and guidelines of the EU member states governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer and otherwise process personal data. In particular, the GDPR includes obligations and restrictions concerning the consent and rights of individuals to whom the personal data relates, the transfer of personal data out of the European Economic Area ("EEA"), security breach notifications and the security and confidentiality of personal data. The GDPR authorizes fines for certain violations of up to 4% of global annual revenue or €20?million, whichever is greater. Legal developments in the EEA, including rulings from the Court of Justice of the European Union and from various EU member state data protection authorities, have also created complexity and uncertainty regarding transfers of personal data from the EEA to the United States and other so-called third countries outside the EEA. While we have taken steps to mitigate the impact on us, the efficacy and longevity of these mechanisms remains uncertain. In addition, some countries are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our services.
In addition, in Israel, the Privacy Protection Law, 5741-1981 ("PPL"), and the regulations enacted thereunder, including the Privacy Protection Regulations (Data Security), 5777-2017 ("Data Security Regulations"), as well as guidelines issued by the Israeli Privacy Protection Authority, and Amendment No. 40 to the Communications Law (Telecommunications and Broadcasting), 5742-1982, impose obligations with respect to the manner certain personal data is processed, maintained, transferred, disclosed, accessed and secured. Failure to comply with the PPL, its regulations and guidelines issued by the Israeli Privacy Protection Authority may expose us to administrative fines, civil claims (including class actions) and in certain cases criminal liability.
Current pending legislation may result in a change of the current enforcement measures and sanctions and may also require us to modify the manner personal data is collected, processed and maintained by us. The Israeli Privacy Protection Authority may initiate administrative inspection proceedings, from time to time, without any suspicion of any particular breach of the PPL, as it has done in the past with respect to dozens of Israeli companies in various business sectors. In addition, to the extent that any administrative supervision procedure is initiated by the Israeli Privacy Protection Authority and reveals certain irregularities with respect to our compliance with the PPL, in addition to our exposure to administrative fines, civil claims (including class actions) and in certain cases criminal liability, we may also need to take certain remedial actions to rectify such irregularities, which may increase our costs.
We make public statements about our use and disclosure of personal information through our privacy policies, information on our website and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policies and other statements that provide promises and assurances about privacy and data security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices. Any concerns about our privacy and data security practices, even if unfounded, could damage our reputation and adversely affect our business.
Restrictions on the collection, use, sharing, disclosure or other processing of personal information or additional requirements and liability for security and data integrity could require us to modify our data processing practices and policies and our solutions and features, possibly in a material manner, could limit our ability to develop new products and features and could subject us to increased compliance costs and obligations and regulatory scrutiny. Our failure to comply with applicable laws, regulations and other legal obligations, or to protect personal data, could result in enforcement or litigation action against us, including fines, sanctions, penalties, judgments, imprisonment of our officers and public censure, claims for damages by residents and other affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse impact on our business, financial condition and results of operations.