In addition, several foreign countries and governmental bodies, including the EU, have laws and regulations dealing with the handling and processing of personal information obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure, and security of various types of data, including data that identifies or may be used to identify an individual, such as names, email addresses, and in some jurisdictions, Internet Protocol (IP) addresses. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future.
Within the EU, the General Data Protection Regulation (GDPR) significantly increases the level of sanctions fornon-compliance from those in existing EU data protection law and imposes direct obligations on data processors in addition to data controllers and may require us to make further changes to our policies and procedures in the future, beyond what we have already done. EU data protection authorities will have the power to impose administrative fines for violations of the GDPR of up to a maximum of €20 million or 4% of the data controller’s or data processor’s total worldwide global turnover for the preceding fiscal year, whichever is higher, and violations of the GDPR may also lead to damages claims by data controllers and data subjects. Such penalties are in addition to any civil litigation claims by data controllers, customers, and data subjects. Since we act as a data processor for our customers, we are taking steps to cause our processes to be compliant with applicable portions of the GDPR, but we cannot assure you that such steps will be effective. In particular, although the UK enacted a Data Protection Act in May 2018 that is designed to be consistent with the GDPR, due to Brexit (see “—Legal, political, and economic uncertainty surrounding the planned exit of the United Kingdom, or UK, from the European Union, or EU, may be a source of instability in international markets, create significant currency fluctuations, adversely affect our operations in the UK, and pose additional risks to our business, revenue, financial condition, and results of operations”), uncertainty remains regarding how data transfers to and from the UK will be regulated.
The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, particularly laws outside the United States, as a result of the rapidly evolving regulatory framework for privacy issues worldwide. For example, laws relating to the liability of providers of online services for activities of their users and other third parties are currently being tested by a number of claims, including actions based on invasion of privacy and other torts, unfair competition, copyright and trademark infringement, and other theories based on the nature and content of the materials searched, the ads posted, or the content provided by users. As a result of the laws that are or may be applicable to us, and due to the sensitive nature of the information we collect, we have implemented policies and procedures to preserve and protect our data and our customers’ data against loss, misuse, corruption, misappropriation caused by systems failures, unauthorized access, or misuse. If our policies, procedures, or measures relating to privacy, data protection, marketing, or customer communications fail to comply with laws, regulations, policies, legal obligations, or industry standards, we may be subject to governmental enforcement actions, litigation, regulatory investigations, fines, penalties, and negative publicity and could cause our application providers, customers, and partners to lose trust in us, and have an adverse effect on our business, operating results, and financial condition.
In addition to government regulation, privacy advocates, and industry groups may propose new and different self regulatory standards that may apply to us. Because the interpretation and application of privacy and data protection laws, regulations, rules, and other standards are still uncertain, it is possible that these laws, rules, regulations, and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our platform. If so, in addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business.
Any failure or perceived failure by us to comply with laws, regulations, policies, legal, or contractual obligations, industry standards, or regulatory guidance relating to privacy or data security, may result in governmental investigations and enforcement actions (including, for example, a ban by EU Supervisory
43