Our cybersecurity and processing systems, as well as those of the third parties with which we interact, may be damaged, disrupted or otherwise breached for a number of reasons, including power outages, computer and telecommunication failures, computer viruses, malware or other destructive software, internal design, manual or usage errors, cyber-attacks, terrorism, workplace violence or wrongdoing, catastrophic events, natural disasters, severe weather conditions, and remote work arrangements instituted in response to COVID-19. Our visibility and role as a processor of transactions containing personally identifiable information may also put us at a greater risk of being targeted by hackers. In the normal course of our business, we have been the target of malicious cyber-attack attempts. The perception that the COVID-19 pandemic has made companies’ information technology systems more vulnerable has additionally increased the already significant volume of such attempts.
In addition, numerous and evolving cybersecurity threats, including advanced and persistent cyber-attacks, phishing and social engineering schemes could compromise the confidentiality, availability and integrity of data in our systems as well as those of the third parties with which we interact. The security measures and procedures we and the third parties with which we interact have in place to protect sensitive consumer data and other information may not be successful or sufficient to counter all data breaches, cyber-attacks, or system failures. Further, employee error or malfeasance, faulty password management or other irregularities may result in a defeat of security measures or a system breach. Although we devote significant resources to our cybersecurity programs and have implemented security measures to protect our systems and data, and to prevent, detect and respond to data security incidents, in each case that we believe are reasonable and appropriate, these efforts, and the efforts of third parties with which we interact, may not prevent these or other threats.
Moreover, because the techniques used to obtain unauthorized access, or to disable or degrade systems change frequently, have become increasingly more complex and sophisticated, and may be difficult to detect for periods of time, we and the third parties with which we interact may not anticipate these acts or respond adequately or timely. As these threats continue to evolve and increase, we may be required to devote significant additional resources in order to modify and enhance our security controls and to identify and remediate any security vulnerabilities or diligencing those of third parties.
If we are sued in connection with any data security breach or system failure, we could be involved in protracted litigation. In addition, a breach could lead to unfavorable publicity and significant damage to our brand, the loss of existing and potential customers, allegations by customers that we have not performed or breached our contractual obligations, or decreased use and acceptance of our solutions. A breach or failure may also subject us to additional regulations or governmental or regulatory scrutiny, which could result in significant compliance costs, fines or enforcement actions, or potential restrictions imposed by regulators on our ability to operate our business. A security breach would also likely require us to devote significant management and other resources to address the problems created by the security breach. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.
We are subject to laws of the United States and foreign jurisdictions relating to privacy, data retention and individually identifiable information, and failure to comply with these laws, whether or not inadvertent, and changes to these laws, could have a material adverse effect on our business.
We receive, process, transmit and store information relating to identifiable individuals, both in our role as a service provider and as an employer. In addition, we receive, process, transmit and store other sensitive data, such as photographs taken and video recorded, as part of our Government Solutions programs. As a result, we are subject to various laws and regulations regarding privacy and data retention, including regulations by government agencies, such as the FTC, and state, local and foreign agencies. Our data handling also is subject to contractual obligations and industry standards. In the United States, various laws and regulations apply to the collection, processing, disclosure, and security of certain types of data, including the use of contact information and other data for marketing, advertising and other communications with individuals and businesses. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the online collection, use, dissemination and security of data. A number of foreign countries and governmental bodies, including the European Union (“EU”), have laws and regulations dealing with the handling and processing of personal information obtained from their residents, which in certain cases are more restrictive than those in the United States. These laws often include obligations on companies to notify individuals of security breaches involving particular personal information, which could result from breaches experienced by us or our third-party service providers.
23