Internationally, many countries have established their own data privacy and security legal framework with which we, our customers and partners may need to comply. For example, in Europe, the General Data Protection Regulation (the “GDPR”) has been enacted as national legislation for respective member states and contains robust obligations on data controllers and processors and fulsome documentation requirements for data protection compliance programs by companies. As a result of our presence in Europe and the United Kingdom (“UK”) and our products and services being offered in the EU and the UK, we are subject to the GDPR, UK GDPR, the UK Data Protection Act 2018, and other similar regional European data protection regulations, all of which impose stringent data protection and cybersecurity requirements, and could increase the risk of non-compliance and the costs of providing our services in a compliant manner. We are also certified as a Privacy Rights Processor under the Asia-Pacific Economic Cooperation. A breach of the GDPR, UK GDPR or other such data protection regulations, could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, or assessment notices (for a compulsory audit). Such penalties, which may include fines up to the greater of €20 million (£17.5 million) or 4% of global turnover, are in addition to any civil litigation claims by customers and data subjects. We may also face civil claims including representative actions and other class action-type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.
Additionally, both the GDPR and UK GDPR impose strict rules on the transfer of personal data out of the EU and the UK to a “third country,” or a country whose laws do not ensure an adequate level of data protection safeguards (such as the U.S.). These obligations may evolve, be interpreted or applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices. For example, in June 2023, the European Commission adopted an adequacy decision (“UK Adequacy Decision”) which facilitates personal data sharing from the European Economic Area (“EEA”) to the UK without the need for additional data protection safeguards. The UK Adequacy Decision includes a “sunset clause”, rendering the decision valid for four years, after which it will be reviewed by the European Commission and renewed only if the European Commission considers that the UK continues to ensure an adequate level of data protection. The European Commission also stated that it would intervene at any point within the four years if the UK deviates from the level of protection presently in place. If this adequacy decision is reversed by the European Commission, it would require that companies implement protection measures such as the approved Standard Contractual Clauses for data transfers between the EU and the UK.
Legal developments in Europe continue to evolve, creating complexity and uncertainty regarding transfers of personal data from the EU and the UK to the U.S. On June 4, 2021, the European Commission finalized new versions of the Standard Contractual Clauses, with the Implementing Decision now in effect. The UK Information Commissioner’s Office of the Data Protection Authority published the UK version of the Standard Contractual Clauses, and by March 2024, we will be required to use and honor these clauses for transfers of UK residents’ personal data to a foreign country that does not have adequate data protection. On July 10, 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework (a new cooperative effort between U.S. and European officials to overcome the security issues raised by the EU-U.S. Privacy Shield regarding personal transfers from the EU to the U.S.). In October 2023, the UK ICO adopted the UK-U.S. data bridge to allow self-certifying companies to effect personal data transfers from the UK to the U.S. without additional safeguards. This new Data Privacy Framework could be subject to legal challenge in front of the Court of Justice of the European Union, which had previously invalidated the Privacy Shield. We currently utilize respective Binding Corporate Rules and Standard Contractual Clauses as the approved data transfer mechanisms by the EU Commission for corresponding applicable data transfer activity. While we do not anticipate any immediate changes in our current operations, we will continue to monitor these legal developments.