Organizations sending commercial electronic messages to individuals must either have express consent from the individual in the prescribed form or the situation must qualify as an instance of implied consent or other authorization set out in Canada’s Anti-Spam Legislation (the “CASL”). The penalties for non-compliance under CASL are significant and the regulator, the Canadian Radio-Television and Telecommunications Commission, is active with respect to enforcement. In addition, the E.U.’s General Data Protection Regulation (the “GDPR”), which went into effect in May 2018, requires subject companies to implement and maintain comprehensive information privacy and security protections with respect to personal data (data that relates to an identified or identifiable individual) about persons in the E.U. that is collected or processed by such companies. The GDPR provides for substantial penalties for noncompliance.
Although we are working to comply with those federal, state, provincial and foreign laws and regulations, industry standards, governmental standards, contractual obligations and other legal obligations that apply to us, those laws, regulations, standards and obligations are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another, other requirements or legal obligations, our practices or the features of our applications or platform. Any failure or perceived failure by us or our contractors to comply with federal, state, provincial or foreign laws or regulations, industry standards, contractual obligations or other legal obligations, or any actual or suspected security incident, whether or not resulting in loss of, unauthorized access to, or acquisition, alteration, destruction, release or transfer of PII or other data, may result in governmental enforcement actions and prosecutions, private litigation, fines and penalties or adverse publicity and could cause employees, suppliers and consumers to lose trust in us, which could have an adverse effect on our reputation and business. Any inability or perceived inability (even if unfounded) on our part to adequately address privacy, data protection, and information security concerns, or comply with applicable laws, regulations, policies, industry standards, governmental standards, contractual obligations, or other legal obligations, could result in additional cost and liability to us, damage our reputation, inhibit sales, and adversely affect our business.
We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, Canada, the E.U. and other jurisdictions, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. Future laws, regulations, standards and other obligations, or amendments or changes in the interpretation of existing laws, regulations, standards and other obligations, could impair our or our suppliers’ ability to collect, use, disclose or otherwise process information relating to employees or consumers, which could decrease demand for our applications, increase our costs and impair our ability to maintain and grow our supplier and consumer bases and increase revenue. Such laws and regulations may require us to implement privacy and security policies, permit users to access, correct and delete personal information stored or maintained by such companies, inform individuals of security breaches that affect their personal information, and, in some cases, obtain individuals’ consent to use PII or other data for certain purposes. In addition, a foreign government could require that any data collected in a country not be transferred or disseminated outside of that country, or impose restrictions or conditions upon such dissemination, and we may face difficulty in complying with any such requirements for certain geographic regions. Indeed, many privacy laws, such as those in force in Canada and the E.U., already impose these requirements. If we fail to comply with federal, state, provincial and foreign data privacy laws and regulations, our ability to successfully operate our business and pursue our business goals could be harmed. Furthermore, due to our acceptance of credit cards, we are subject to the PCI-DSS, which is designed to protect the information of credit card users.
We have had security incidents in the past, which we do not believe reached the level of a breach that would be reportable under applicable state laws or our other obligations; however, there can be no assurance that our determinations were correct. In the event our determinations are challenged and found to have been incorrect, we may be subject to unfavorable publicity or claims by one or more state attorneys general, federal regulators, or private plaintiffs, any of which could damage our reputation, inhibit sales and adversely affect our business.
Our business could suffer if the jurisdictions in which we operate change the way in which they regulate the internet, including regulations relating to user-generated content and privacy.
Governments may adopt laws and regulations that make it more difficult to operate our business, both domestically and abroad. We are subject to a number of data privacy and internet-related laws and regulations which result in significant compliance burdens. For example, we have settled two claims under the Americans with Disabilities Act that obligated us to make our websites WCAG 2.0 Level AA compliant for users with visual or other
27