Significant capital, managerial and human resources are required to enhance information security and to address any issues caused by security failures. If we are unable to protect our systems and the information stored in our systems from unauthorized access, use, disclosure, disruption, modification or destruction, such problems or security breaches may cause loss, expose us to litigation and possible liability to the owners of confidential information, disrupt our operations and may harm our reputation and ability to attract customers.
Our failure to comply with privacy and data protection laws and regulations in various jurisdictions could subject us to sanctions, damages, and litigation, and could harm our reputation and business.
We collect and process certain personal data of our users, including email addresses, usage data, identification information, user passwords, and additional information. We also collect and process user billing information, such as credit card numbers, full names, billing addresses, and phone numbers of our users.
We are subject to the privacy and data protection laws and regulations in various jurisdictions, including China, European Union, and Korea. Privacy laws provide restrictions and guidance in connection with our storage, use, processing, disclosure, transfer, and protection of personal information. We strive to comply with all applicable laws, regulations, policies relating to privacy and data protection. We are also subject to privacy and data security-related obligations deriving from our privacy policy and terms of use with our users, and we may be liable to third parties in the event we are deemed to have wrongfully processed, used, stored, disclosed or otherwise disposed of personal data.
Data security and protection has become one of the policy focuses of PRC regulators. For example, in November 2016, the Standing Committee of NPC promulgated the PRC Cyber Security Law, which became effective on June 1, 2017. The PRC Cyber Security Law requires that a network operator, which includes, among others, internet information services providers, take technical measures and other necessary measures in accordance with applicable laws and regulations and the compulsory requirements of the national and industrial standards to safeguard the safe and stable operation of its networks. We are subject to such requirements as we are operating website and mobile applications and providing certain internet services mainly through our mobile applications. The law further requires internet information service providers to formulate contingency plans for network security incidents, report to the competent departments immediately upon the occurrence of any incident endangering cyber security and take corresponding remedial measures. Any violation of the PRC Cyber Security Law may subject us to warnings, fines, confiscation of illegal gains, revocation of licenses, cancellation of filings, shutdown of websites or criminal liabilities.
European Union traditionally takes a broader view as to what is considered personal information and has imposed greater obligations under their privacy and data protection laws. In particular, the European Union adopted a new General Data Protection Regulation in April 2016, which became effective in May 2018. The General Data Protection Regulation results in more stringent requirements for data processors and controllers, including more fulsome disclosures about the processing of personal information, data retention limits, and deletion requirements, mandatory notification in the case of a data breach, and elevated standards regarding valid consent in some specific cases of data processing. The General Data Protection Regulation also includes substantially higher penalties for failure to comply with the requirements. For example, in the event of violations, a fine up to €20 million or up to 4% of the annual worldwide turnover, whichever is greater, may be imposed. In addition to General Data Protection Regulation, when other future laws and regulations come into effect, the more stringent requirements on privacy user notifications and data handling will require us to adapt our business and incur additional costs.
Privacy concerns are becoming more widely acknowledged and may cause our users to resist providing the personal data necessary to allow them to use our platform effectively. We have implemented multiple measures and security protocols to maintain and improve our privacy protection capability. However, measures we have implemented may not alleviate all potential privacy concerns and threats. In addition, a failure by us or a third-party contractor providing services to us to comply with applicable privacy and data security laws, regulations, obligations, or our terms of use with our users, may result in sanctions, statutory or contractual damages or litigation. These violations or proceedings may, among other things, force us to spend money in defense or settlement, result in the imposition of monetary liability or restrict access to our services from certain territory, which could adversely affect our reputation and business.
S-27