two state court cases, we made a motion to dismiss the action, which was denied by the court, which additionally has stayed party discovery. The federal court lawsuit was recently stayed by the court. While adverse results in these lawsuits may include awards of substantial monetary damages, we believe it is too early to determine the possibility of liability and have not accrued any potential or estimated liabilities relating to these matters.
Further, because some of our customers have establishments in the European Union (“EU”) or otherwise process the personal data of EU residents, the General Data Protection Regulation 2016/679 (“GDPR”) may apply to our processing of certain customer and employee information. The GDPR went into effect on May 25, 2018 and has resulted in and will continue to result in significantly greater compliance burdens and costs for companies like us. Any data security breach could require notifications to the data subject and/or owners under federal, U.S., U.S. state, and/or international data breach notification laws and regulations.
The effects of the CCPA, CPRA, IBIPA, GDPR and other U.S. state, U.S. federal, and international laws and regulations that are currently in effect or that may go into effect in the future, are significant and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such laws and regulations. Any actual or perceived failure to comply with these and other data protection and privacy laws and regulations could result in regulatory scrutiny and increased exposure to the risk of litigation or the imposition of consent orders, resolution agreements, requirements to take particular actions with respect to training, policies or other activities, and civil and criminal penalties, including fines, which could have an adverse effect on our results of operations or financial condition. Moreover, allegations of non-compliance, whether or not true, could be costly, time consuming, distracting to management, and cause reputational harm.
In addition to government regulation, privacy advocates, and industry groups may propose new and different self-regulatory standards. Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our solutions. Any failure to comply with government laws or regulations that apply to our applications, including privacy and data protection laws, could subject us to liability. In addition to the possibility of fines, lawsuits, and other claims, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business, operating results, or financial condition. Any actual or perceived inability to adequately address privacy concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations, standards, and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales, and adversely affect our business, operating results, or financial condition.
Furthermore, privacy concerns may cause our customers’ employees to resist providing the personal data necessary to allow our customers and their employees to use our applications effectively. Even the perception of privacy concerns, whether or not valid, may inhibit market adoption of our applications in certain industries. All these legislative and regulatory initiatives may adversely affect our ability, or our customers to create, collect, receive, process, handle, maintain, store, transmit, use, or disclose demographic and personal data from their employees, which could reduce demand for our solutions.
Adverse tax laws or regulations could be enacted, or existing laws could be applied in a manner adverse to us or our customers, which could increase the costs of our solutions and applications and could adversely affect our business, operating results, or financial condition.
As a vendor of services, we are ordinarily held responsible by taxing authorities for collecting and paying any applicable sales or other similar taxes. Additionally, the application of federal, state, and local tax laws to services provided electronically like ours is evolving. New income, sales, use, or other tax laws, statutes, rules, regulations, or ordinances could be enacted at any time (possibly with retroactive effect), and could be applied solely or disproportionately to services and applications provided over the internet. These enactments could adversely affect our sales activity, due to the inherent cost increase the taxes would represent, and could adversely affect our business, operating results, or financial condition.
43