We rely on data collected through our mobile application. We use this data in connection with, among other things, determining the placement for our charging stations. Our inability to obtain necessary rights to use this data or freely transfer this data could result in delays or otherwise negatively impact our research and development and expansion efforts and limit our ability to derive revenues from value-add customer products and services.
We are subject to governmental regulation and other legal obligations related to privacy, data protection and information security and may be subject to governmental enforcement actions, litigation, fines and penalties or adverse publicity if we are unable to comply with such obligations.
We collect, process, store, and use a wide variety of data from current and prospective customers and other individuals, including personal information. Federal, state, local and foreign governments and agencies in the jurisdictions in which we operate, and in which customers operate, have adopted, are considering adopting, or may adopt laws and regulations regarding the collection, use, storage, processing, and disclosure of information regarding consumers and other individuals, which could impact our ability to offer services in certain jurisdictions. Laws and regulations relating to the collection, use, disclosure, security, and other processing of individuals' information can vary significantly from jurisdiction to jurisdiction. The costs of compliance with, and other burdens imposed by, laws, regulations, standards, and other obligations relating to privacy, data protection, and information security are significant. In addition, some companies, particularly larger enterprises, often will not contract with vendors that do not meet these rigorous standards and may impose onerous data-related obligations on vendors. Accordingly, the failure, or perceived inability, to comply with these laws, regulations, standards, and other obligations may limit the use and adoption of our products and services, reduce overall demand, lead to regulatory investigations, litigation, and significant fines, penalties, or liabilities for actual or alleged noncompliance, or slow the pace at which we close sales transactions, any of which could harm our business. Moreover, if we or any of our employees or contractors fail or are believed to fail to adhere to appropriate practices regarding customers' data, it may damage our reputation and brand.
Additionally, existing laws, regulations, standards, and other obligations may be interpreted in new and differing manners in the future, and may be inconsistent among jurisdictions. Future laws, regulations, standards, and other obligations, and changes in the interpretation of existing laws, regulations, standards, and other obligations could result in increased regulation, increased costs of compliance and penalties for non-compliance, and limitations on data collection, use, disclosure, and transfer for us and our customers. Further, California adopted the
California Consumer Privacy Act ("CCPA") and the California State Attorney General has begun enforcement actions. Further, on November 3, 2020, California voters approved the California Privacy Rights Act ("CPRA"). The costs of compliance with, and other burdens imposed by, laws and regulations relating to privacy, data protection, and information security that are applicable to the businesses of customers may adversely affect ability and willingness to process, handle, store, use, and transmit certain types of information, such as demographic and other personal information.
In addition to government activity, privacy advocacy groups, the technology industry, and other industries have established or may establish various new, additional, or different self-regulatory standards that may place additional burdens on technology companies. Customers may expect that we meet voluntary certifications or adhere to other standards established by them or third parties. If we are unable to maintain these certifications or meet these standards, it could reduce demand for our solutions and adversely affect our business.
Personal data information is increasingly subject to legislation and regulations in numerous non-U.S. jurisdictions around the world. We operate in the European Union, where the General Data Protection Regulation 2016/679 ("GDPR"), imposes strict requirements on controllers and processors of personal data, including, for example, higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals, a strong individual rights regime, shortened timelines for data breach notifications and restrictions on the transfer of personal data outside of the European Economic Area.
Following its departure from the European Union, the United Kingdom has adopted a separate regime based on the GDPR ("UK GDPR") that imposes similarly onerous requirements. Companies that violate the EU or UK regime can face regulatory investigations, private litigation, prohibitions on data processing, and fines of up to the greater of 4% of their worldwide annual revenue or 20 million Euros (for the EU) or £17.5 million (for the U.K.). Other EU and UK data protection laws and evolving regulatory guidance restrict the ability of companies to market electronically, including through the use of cookies and similar technologies, and companies are increasingly subject to strict enforcement action including fines for non-compliance. As a result, operating our business or offering our services in European or other countries with onerous data protection laws would subject us to substantial compliance costs, potential liability (including class actions) and reputational damage, and may require changes to the ways we collect and use consumer information.
A number of data protection laws (including the GDPR, the UK GDPR and the CCPA) have introduced mandatory breach reporting to regulators and, under certain circumstances, to the individuals whose personal data was compromised in the breach.
Many other jurisdictions are considering or are about to adopt data protection regulations, which are sometimes inconsistent or conflicting. While we strive to monitor and comply with this complex and ever- changing patchwork of laws, a failure or perceived or alleged failure to comply with applicable data privacy requirements in one of the jurisdictions could result in litigation and proceedings against us by governmental entities, customers, or others, fines and civil or criminal penalties, limited ability or inability to operate our business, offer services, or market our business in certain jurisdictions, negative publicity and harm to our brand and reputation, and reduced overall demand for our products and services. Such occurrences could adversely affect our business, financial condition, and results of operations. Our general liability insurance may not cover all potential claims to which we are exposed and may not be adequate to indemnify us for the full extent of our potential liabilities. In addition, we could be adversely affected if data privacy regulations are expanded (through new regulation or through legal rulings) to require major changes in our business practices.