addition, some industries have industry-specific requirements relating to compliance with certain security and regulatory standards, such as those required by the Health Insurance Portability and Accountability Act (HIPAA). For example, HIPAA imposes privacy, security, and breach reporting obligations with respect to individually identifiable health information upon “covered entities” (e.g., health plans, health care clearinghouses, and certain health care providers), and their respective business associates, individuals, or entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity. Such laws give rise to an increasingly complex set of compliance obligations on us regarding our ability to gather, use, and store customer data and customer account data.
These laws are subject to rapid change, differing interpretations, and can be inconsistent among regulatory frameworks or conflict with other rules or our business practices. We strive to comply with all applicable laws, policies, legal obligations, and industry codes of conduct relating to privacy and data protection to the extent possible. Our efforts to comply with the complex matrix of data privacy laws around the world subjects us to increasing costs to review and comply with such laws, including updating our policies, procedures, and business practices to address such evolving privacy laws. We also make public statements and commitments regarding our use and disclosure of personal information through our privacy policy, information provided on our website, and data processing agreements with customers and other third parties. Because the interpretation and application of data protection laws, regulations, standards, and other obligations are often uncertain and in flux, and sometimes contradictory, it is possible that the scope and requirements of these laws and other obligations may be interpreted and applied in a manner that is inconsistent with our practices, and our efforts to comply with rapidly evolving data protection laws and obligations may be unsuccessful. For example, we previously relied on the EU-US Privacy Shield framework, which was invalidated by a European court in July 2020. As a result of such decision, we have had to take additional steps to comply with applicable EU data protection requirements, including implementation of standard contractual clauses.
Any failure, or perceived failure, by us to comply with applicable privacy and security laws, policies, or related contractual obligations, or any compromise of security that results in unauthorized access, or the use or transmission of personal information or other customer data, could result in a variety of claims against us, including governmental enforcement actions and investigations, audits, inquiries, whistleblower complaints, class action privacy litigation in certain jurisdictions, and proceedings by data protection authorities. For example, under the GDPR we may be subject to fines of up to €20 million or up to 4% of the total worldwide annual group turnover of the preceding financial year, as well as potentially face claims from individuals. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. Any non-compliance with data privacy requirements could subject us to significant fines and penalties, adverse media coverage, reputational damage, the loss of current and potential customers, loss of export privileges, or criminal or other civil sanctions, any of which could materially adversely affect our business and financial condition.
The ongoing COVID-19 pandemic, and resulting global economic downturn, has impacted how we, our customers, and our partners are operating, and could result in a material adverse effect on our business.
The ongoing COVID-19 pandemic, and measures taken to control its spread such as travel restrictions, shelter-in-place orders, and business shutdowns, have affected all of the regions in which we conduct business and in which our customers, partners, and suppliers are located; have adversely impacted global economic activity; and have contributed to volatility in financial markets. As the situation around the spread of the COVID-19 pandemic evolves, we have continued to operate in a modified manner—employing precautionary measures designed to protect the health of our employees while enabling us to support our customers and partners. Among other modifications, we generally required our employees to work remotely; instituted business-related travel restrictions; and virtualized, postponed, or cancelled various sales and marketing, employee, and industry events. The remote work measures that we implemented have generally allowed us to provide uninterrupted service to our customers and partners, but have also introduced additional challenges and
24