to work with our franchisees to have their restaurants upgrade to the same system. If we are unable to successfully upgrade or expand our technological capabilities, we may not be able to take advantage of market opportunities, manage our costs and transactional data effectively, satisfy customer requirements, execute our business plan or respond to competitive pressures. Additionally, unforeseen problems with our point-of-sale system or our credit card processing system may affect our operational abilities and internal controls and we may incur additional costs in connection with such upgrades and expansion.
Failure to comply with federal and state laws and regulations relating to privacy, data protection, advertising and consumer protection, or the expansion of current or the enactment of new laws or regulations relating to privacy, data protection, advertising and consumer protection, could have a material adverse effect on our business, financial condition and results of operations.
Our business requires the collection, transmission and retention of large volumes of customer and employee data, including credit and debit card numbers and other personally identifiable information, in various information technology systems that we and our franchisees maintain, and in those maintained by our third parties with whom we contract to provide services. The integrity and protection of that customer and employee data is critical to us. Further, our customers and employees have a high expectation that we and our service providers will adequately protect their personal information.
Further, the standards for systems currently used for transmission and approval of electronic payment transactions, and the technology utilized in electronic payment themselves, all of which can put electronic payment data at risk, are determined and controlled by the payment card industry, not by us. For example, we are subject to industry requirements such as the Payment Card Industry Data Security Standard, or PCI-DSS, as well as certain other industry standards. Any failure to comply with these rules and/or requirements could significantly harm our brand, reputation, business and results of operations, and in the case of PCI-DSS, could result in monetary penalties and/or the exclusion from applicable card brands. We also rely on independent service providers for payment processing, including payments made using credit and debit cards. If these independent service providers become unwilling or unable to provide these services to us or if the cost of using these providers increases, our business could be harmed.
We rely on a variety of marketing and advertising techniques, including email communications, affiliate partnerships, social media interactions, digital marketing, direct mailers, public relations initiatives and local community sponsorships, promotions and partnerships, and we are subject to various laws and regulations that govern such marketing and advertising practices. A variety of federal and state laws and regulations govern the collection, use, retention, sharing and security of consumer data, particularly in the context of digital marketing, which we rely upon to attract new customers. We are, and may increasingly become, subject to other various laws, directives, industry standards and regulations, as well as contractual obligations, relating to data privacy and security in the jurisdictions in which we operate. The information, security and privacy requirements imposed by governmental regulation are increasingly demanding and are subject to potentially differing interpretations. In the United States, various federal and state regulators, including governmental agencies like the Consumer Financial Protection Bureau and the Federal Trade Commission (the “FTC”), have adopted, or are considering adopting, laws and regulations concerning personal information and data security and have prioritized privacy and information security violations for enforcement actions.
Laws and expectations relating to privacy continue to evolve, and we continue to adapt to changing needs. For example, the definition of “personal information” or “personal data” under newer privacy laws is much broader than the definition of “personally identifiable information” that appears in older privacy laws, and many jurisdictions have or will soon enact new privacy laws. Specifically, certain states in which we operate or may operate in the future have enacted or may soon enact comprehensive privacy laws that may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than current federal, international or other state laws, and such laws may differ from each other, all of which may complicate compliance efforts. For example, the California Consumer Privacy Act (“CCPA”), which went into effect on
42