Privacy concerns and laws, evolving regulation of cloud computing and other domestic or foreign regulations may limit the use and adoption of our solutions and adversely affect our business.
Further to the above, regulation related to the provision of services on the Internet is increasing, as federal, state and foreign governments continue to adopt new laws and regulations addressing data privacy and the collection, processing, storage and use of personal information. Further, laws are increasingly aimed at the use of personal information for marketing purposes, such as the EU’s e-Privacy Directive (which is set to be replaced by a new EU e-Privacy Regulation which will have a “direct effect” in each EU Member State), and the country-specific regulations that implement that directive. These and other requirements could reduce demand for our solutions or restrict our ability to store and process data or, in some cases, impact our ability to offer our services and solutions in certain locations.
In the U.S., California enacted the California Consumer Privacy Act (CCPA) on June 28, 2018, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. New York enacted the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), which became effective March 2020 and requires companies with data relating to New Yorkers to adopt comprehensive cybersecurity programs. These statutes may increase our compliance costs and potential liability. Some observers have noted that the CCPA and the SHIELD Act could mark the beginning of a trend toward more stringent privacy legislation in the U.S., which could increase our potential liability and adversely affect our business. Furthermore, India has recently proposed enacting its own data protection legislation although the specifics of this are yet to be decided.
In addition to government activity, privacy advocacy and other industry groups have established or may establish new self-regulatory standards that may place additional burdens on us. Our customers expect us to meet voluntary certification or other standards established by third parties, such as TRUSTe. If we are unable to maintain these certifications or meet these standards, it could adversely affect our ability to provide our solutions to certain customers and could harm our business.
The costs of compliance with and other burdens imposed by laws, regulations and standards may limit the use and adoption of our service and reduce overall demand for it, or lead to significant fines, penalties or liabilities for any noncompliance.
Furthermore, concerns regarding data privacy may cause our customers’ customers to resist providing the data necessary to allow our customers to use our service effectively. Even the perception that the privacy of personal information is not satisfactorily protected or does not meet regulatory requirements could inhibit sales of our products or services, and could limit adoption of our subscription solution. Moreover, as our customers face increased scrutiny for data privacy breaches, they may elect to transfer the risk to us through contractual provisions which may subject us to increasing levels of contractual liability for data privacy breaches.
Anti-corruption, anti-bribery, and similar laws, and failure to comply with these laws, could subject us to criminal penalties or significant fines and harm our business and reputation.
We are subject to anti-corruption and anti-bribery and similar laws, such as the U.S. Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, the U.K. Bribery Act 2010, and other anti-corruption, anti-bribery, and anti-money laundering laws in countries in which we conduct activities. Anti-corruption and anti-bribery laws have been enforced aggressively in recent years and are interpreted broadly and prohibit companies and their employees and agents from promising, authorizing, making or offering improper payments, or other benefits to government officials and others in the private sector. As we increase our international sales and business, our risks under these laws may increase. Noncompliance with these laws could subject us to investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, adverse media coverage, and other consequences. Any investigations, actions, or sanctions could harm our business, operating results, and financial condition.