We are subject to federal, state and international laws, directives, and regulations relating to the collection, use, retention, disclosure, security, transfer, and other processing of personal data. These laws, directives, and regulations, and their interpretation and enforcement continue to evolve and may be inconsistent from jurisdiction to jurisdiction. For example, the General Data Protection Regulation (“GDPR”), which went into effect in the European Union on May 25, 2018, applies to all of our activities conducted from an establishment in the European Union and may also apply to related products and services that we offer to European Union users. The United Kingdom has adopted legislation that substantially implements the GDPR. The GDPR provides for significant penalties in the case of non-compliance of up to €20 million or four percent of worldwide annual revenues, whichever is greater. The United Kingdom legislation implementing the GDPR provides for a similar penalty structure. Numerous other jurisdictions worldwide have enacted laws relating to the collection, use, retention, disclosure, security, transfer, and other processing of personal data, including Brazil, which has enacted the Brazilian General Data Protection Law (“LGPD”). The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the GDPR.
In the United States, California has enacted the California Consumer Privacy Act, as amended (“CCPA”) and numerous similar recently enacted laws create new data privacy rights for individuals. Other evolving legislation relating to privacy and cybersecurity at the federal, state, and local levels also may, or may be argued to, apply to us. Additionally, certain of our commercial partners, including payment card companies, have imposed data security standards or other obligations relating to privacy, data protection, or data security upon us, and others may do so in the future. We also may be, or may be argued to be, subject to industry standards or other actual or asserted obligations relating to privacy, data protection, and cybersecurity. We strive to comply with applicable laws, regulations, policies, and contractual and other legal obligations relating to privacy, data protection, and cybersecurity. These legal, contractual, and other actual and asserted obligations are, however, evolving rapidly, may be interpreted and applied in new ways and/or in manners that are inconsistent, and may conflict with other obligations or our practices.
Our efforts to comply with the GDPR, the CCPA, the LGPD, and similar emerging and changing laws, regulations, policies, and contractual and other legal obligations relating to privacy data protection, and cybersecurity may require us to change our policies and practices and may cause us to incur substantial costs. Our actual or perceived noncompliance with any actual or asserted legal obligations relating to privacy, data protection, or cybersecurity could result in claims, demands, and litigation by private parties or governmental actors, investigations or other actions or proceedings by governmental entities or others, our loss of the ability to process payment card transactions, or us becoming subject to higher costs for such transactions, harm to our reputation and market position, and significant legal and financial exposure and could affect our ability to retain and attract customers. Any of the risks described above could adversely affect our consolidated results of operations and financial position.