With laws and regulations such as the GDPR in the EU and the CCPA and other state statutes in the United States imposing new and relatively burdensome obligations, and with substantial uncertainty over the interpretation and application of these and other laws and regulations, there is a risk that the requirements of these laws and regulations, or of contractual or other obligations relating to privacy, data protection or information security, will be interpreted or applied in a manner that is, or is alleged to be, inconsistent with our management and processing practices, our policies or procedures or the features of our solution. We may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so. Although we endeavor to comply with our published policies, certifications and documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or vendors do not comply with our published policies and documentation. Any failure or perceived failure by us to comply with our privacy policies, our privacy-, data protection- or information security-related obligations to customers or other third parties or any of our other legal obligations relating to privacy, data protection or information security may result in governmental investigations or enforcement actions, litigation, claims or public statements against us by consumer advocacy groups or others and could result in significant liability or cause our customers to lose trust in us, which could have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our solution. Additionally, if third parties we work with, such as vendors or developers, violate applicable laws or regulations or our policies, such violations may also put our customers’ content at risk and could in turn have an adverse effect on our business.
Any significant change to applicable laws, regulations or industry practices regarding the collection, use, retention, security or disclosure of our customers’ content, or regarding the manner in which the express or implied consent of customers for the collection, use, retention or disclosure of such content is obtained, could increase our costs and require us to modify our solution, possibly in a material manner, which we may be unable to complete and may limit our ability to store and process customer data or develop new applications and features.
Our computer systems, or those of any third parties on whom we depend, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations.
Despite the implementation of security measures in an effort to protect systems that store our information, given their size and complexity and the increasing amounts of information maintained on our information technology systems and those of our third-party contractors and consultants, these systems are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication and electrical failures, as well as security breaches from inadvertent or intentional actions by our employees, contractors, consultants, business partners and/or other third parties, or from cyber-attacks by malicious third parties (including supply chain cyber attacks or the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information), which may compromise our system infrastructure or lead to the loss, destruction, alteration, denial of access to, disclosure or dissemination of, or damage or unauthorized access to, our data (including trade secrets or other confidential information, intellectual property, proprietary business information and personal information) or data that is processed or maintained on our behalf, or other assets, which could result in financial, legal, business and reputational harm to us.
Companies have, in general, experienced an increase in phishing and social engineering attacks from third parties in connection with the COVID-19 pandemic and the increase in remote working further increases security threats. To the extent that any disruption or security incident were to result in any loss, destruction,
42