procedures in the future, beyond what we have already done. EU data protection authorities will have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total worldwide global turnover for the preceding fiscal year, whichever is higher, and violations of the GDPR may also lead to damages claims by data controllers and data subjects. Such penalties are in addition to any civil litigation claims by data controllers, customers, and data subjects. Since we act as a data processor for our customers, we are taking steps to cause our processes to be compliant with applicable portions of the GDPR, but we cannot assure you that such steps will be effective. In particular, although the UK enacted a Data Protection Act in May 2018 that is designed to be consistent with the GDPR, due to Brexit (see “—Legal, political, and economic uncertainty surrounding the planned exit of the United Kingdom, or UK, from the European Union, or EU, may be a source of instability in international markets, create significant currency fluctuations, adversely affect our operations in the UK, and pose additional risks to our business, revenue, financial condition, and results of operations”), uncertainty remains regarding how data transfers to and from the UK will be regulated.
The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, particularly laws outside the United States, as a result of the rapidly evolving regulatory framework for privacy issues worldwide. For example, laws relating to the liability of providers of online services for activities of their users and other third parties are currently being tested by a number of claims, including actions based on invasion of privacy and other torts, unfair competition, copyright and trademark infringement, and other theories based on the nature and content of the materials searched, the ads posted, or the content provided by users. As a result of the laws that are or may be applicable to us, and due to the sensitive nature of the information we collect, we have implemented policies and procedures to preserve and protect our data and our customers’ data against loss, misuse, corruption, misappropriation caused by systems failures, unauthorized access, or misuse. If our policies, procedures, or measures relating to privacy, data protection, marketing, or customer communications fail to comply with laws, regulations, policies, legal obligations, or industry standards, we may be subject to governmental enforcement actions, litigation, regulatory investigations, fines, penalties and negative publicity and could cause our application providers, customers and partners to lose trust in us, and have an adverse effect on our business, operating results, and financial condition.
In addition to government regulation, privacy advocates, and industry groups may propose new and different self regulatory standards that may apply to us. Because the interpretation and application of privacy and data protection laws, regulations, rules, and other standards are still uncertain, it is possible that these laws, rules, regulations, and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our platform. If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business.
Any failure or perceived failure by us to comply with laws, regulations, policies, legal, or contractual obligations, industry standards, or regulatory guidance relating to privacy or data security, may result in governmental investigations and enforcement actions (including, for example, a ban by EU Supervisory Authorities on the processing of EU personal data under the GDPR), litigation, fines and penalties, or adverse publicity, and could cause our customers and partners to lose trust in us, which could have an adverse effect on our reputation and business. Our obligation to assist our customers in their compliance with laws, regulations, and policies, like data processing and data protection requirements under the GDPR may also result in government enforcement actions litigation, fines and penalties, or adverse publicity. We expect that there will continue to be new proposed laws, regulations, and industry standards relating to privacy, data protection, marketing, consumer communications, and information security in the United States, the EU, and other jurisdictions, and we cannot determine the impact such future laws, regulations, and standards may have on our business. Future laws, regulations, standards, and other obligations or any changed interpretation of existing laws or regulations could impair our ability to develop and market new functionality and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, or disclosure of data or
44