In the ordinary course of business, we handle personal data and other sensitive information, including that of our tenants, vendors, and employees. As such, we are subject to numerous data privacy and security mandates, including laws, regulations, external and internal data privacy and security policies, and contractual requirements.
For example, the California Privacy Rights Act (“CPRA”), which became effective on January 1, 2023, significantly expanded the definition of “consumer,” originally defined by the California Consumer Privacy Act (“CCPA”), to include job applicants, employees, and independent contractors. Additionally, the CPRA introduced new rights of consumers to limit the use of their sensitive personal information and mandated employers disclose personal information usage, an individual’s rights under the CCPA, and their personal information retention period or the criteria they use to determine their retention period.
The CCPA, which became effective on January 1, 2020, applies to consumers, business entities, and residents of California. It broadly defined “personal information,” providing California residents with expanded privacy rights and protections, and established civil penalties for violations for certain data breaches. It also enabled California residents to opt out of the sales of their personal information, with noncompliant businesses facing significant penalties.
We have taken actions to proactively enhance our handling of personal information, including, but not limited to:
- Updating external and internal privacy notices and policies;
- Implementing procedures to comply with the CCPA and CPRA, including procedures to effectively address potential requests from California residents, including our employees, regarding their personal information;
- Revising our document retention policy to minimize the storage of information subject to the CCPA and CPRA; and
- Amending contracts with our partners and vendors to incorporate data use restrictions, security measures, and other required provisions.
However, there is no guarantee that we will adequately address the requirements of the CCPA and CPRA, or evolving laws in other jurisdictions. The data privacy and security landscape is becoming increasingly complex. Differing regulations may result in inconsistent applications and interpretations across multiple jurisdictions. As such, we may be required to devote significant resources and implement or significantly change existing technologies, systems, or practices in order to prepare for and comply with new regulations. Our failure to comply with applicable federal, state, and local privacy laws could lead to:
- Damage to our reputation;
- Increased remediation and compliance costs;
- Government investigations and enforcement actions;
- Fines, penalties, or litigation, including class actions;
- Challenges in raising capital; and
- Inability to execute on our business strategy, including our growth plans.
Changes in the aforementioned laws may subject us to increased compliance risks and potential liability, and materially and adversely impact our business, financial condition, and results of operations.