Our collection, use, storage, disclosure, transfer and other processing of personal information could give rise to significant costs and liabilities, including as a result of governmental regulation, uncertain or inconsistent interpretation and enforcement of legal requirements or differing views of personal privacy rights, which may have an adverse effect on our reputation, business, financial condition and results of operations.
We collect, use, store, transmit and otherwise process data that is sensitive to the Company and its employees, customers and suppliers. A variety of state, federal, and foreign laws, regulations and industry standards apply to the collection, use, retention, protection, disclosure, transfer and other processing of certain types of data. As we seek to expand our business, we are, and may increasingly become subject to various laws, regulations and standards, as well as contractual obligations, relating to data privacy and security in the jurisdictions in which we operate. In many cases, these laws and regulations may apply not only to third-party transactions, but also to transfers of information between or among us, our affiliates and other parties with whom we conduct business. These laws, regulations and standards are continuously evolving and may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that may have an adverse effect on our reputation, business, financial condition and results of operations.
In the United States, many states are considering adopting, or have already adopted, privacy regulations, including the California Consumer Privacy Act (the “CCPA”), which became operational in 2020. The CCPA increases privacy rights for California residents, including the right to access and delete their personal information, receive detailed information about how their personal information is used and shared, and imposes other obligations on companies that process their personal information. Among, other things, the CCPA provides California consumers the right to opt-out of certain sales of personal information. The CCPA also creates a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. Additionally, in November 2020, California passed the California Privacy Rights Act (the “CPRA”), which expands the CCPA significantly, including by expanding consumers’ rights with respect to certain personal information and creating a new state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. Many of the CPRA’s provisions will become effective on January 1, 2023. The costs of compliance with, and the other burdens imposed by, these and other laws or regulatory actions may increase our operational costs, and/or result in interruptions or delays in the availability of systems. Most recently, Virginia passed the Virginia Consumer Data Protection Act (“VCDPA”), applicable to companies collecting personal information of more than 100,000 Virginia residents, which could further impact our compliance burden. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging.
Our communications with our customers and email and social media marketing are subject to certain laws and regulations. As laws and regulations, including FTC enforcement, evolve to govern the use of these communications and marketing platforms, the failure by us, our employees or third parties acting at our direction to abide by applicable laws and regulations could adversely impact our business, financial condition and results of operations or subject us to fines or other penalties.
We are also subject to certain international privacy laws. In Canada, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and various provincial laws require that companies give detailed privacy notices to consumers, obtain consent to use personal information, with limited exceptions, allow individuals to access and correct their personal information, and report certain data breaches.
In the European Economic Area (the “EEA”), we are subject to the General Data Protection Regulation (“GDPR”) and in the United Kingdom (“U.K.”), we are subject to the U.K. General Data Protection Regulation (“U.K. GDPR”) and the U.K. Data Protection Act 2018 (the “U.K. DPA”), in each case in relation to our collection, control, processing, sharing, disclosure and other use of data relating to an identifiable living individual (personal data). The interpretations and measures conducted by us in our efforts to comply with these laws may have been or may prove to be insufficient. The GDPR and national implementing legislation in EEA member states and the U.K.,
40