Improper collection, use, disclosure, cross border transfer, retention and other processing of confidential, personal, or proprietary data could result in regulatory scrutiny, legal and financial liability, or harm to our reputation. In operating our business and providing services and solutions to clients, we store and transfer sensitive employee and client data, including personal data, in and across multiple jurisdictions. We collect data from client and individuals located all over the world and leverage systems and teams to process it. As a result, we are subject to a variety of laws and regulations in the U.S., Europe and around the world regarding privacy, data protection, data security and cyber security. These laws and regulations are continuously evolving and developing. Some of these laws and regulations are increasing the level of data handling restrictions, including rules on data localization, all of which could affect our operations and result in regulatory liability and high fines. In particular, high-profile data breaches at major companies continue to be disclosed regularly, which is leading to even greater regulatory scrutiny and fines at the highest levels they have ever been. These fines are not limited to data breaches and regulators are increasingly focusing on other data processing activities including those related to ad-tech and “data subject” rights. The number of laws that apply to us keeps increasing and the interpretation of such laws is often uncertain and may be conflicting.
At the international level, we are subject to an increasing number of comprehensive privacy laws including, for example, those passed in Indonesia, the Kingdom of Saudi Arabia and India. Many of these laws, which are modeled after the GDPR, have greatly increased the jurisdictional reach of privacy laws and added a broad array of requirements for handling personal data, such as the public disclosure of data breaches, data protection impact assessments, data portability and the appointment of data protection officers in some cases. Following the UK’s withdrawal from the EU, we are also subject to the UK General Data Protection Regulation (“UK GDPR”), a version of the GDPR as implemented into UK law, and this law may not mirror the GDPR, thereby adding operational complexity and legal risk. Given the breadth and depth of changes in data protection obligations, including classifying data and committing to a range of administrative, technical and physical controls to protect data and enable data transfers across borders, our compliance with such laws will continue to require time, resources and review of the technology and systems we use. Despite a proliferation of regulatory guidance papers, there remains uncertainty in key areas related to these laws, and that uncertainty could result in potential liability for our failure to meet our obligations, including the possibility of significant fines some of which can amount to 4% or more of our global revenue. Further, despite recent developments, including a new U.S.- EU Data Privacy Framework and the U.S.-UK Data Bridge, there remains a high level of uncertainty concerning the future of the flow of personal information between the U.S. and EU, between the U.S. and the UK and between the UK and the EU, and that uncertainty may impair our ability to offer our existing and planned products and services or increase our cost of doing business. Some of the global laws enacted in recent years, including those in China and the Kingdom of Saudi Arabia, also include data localization elements that will require that certain personal data stay within their borders. These requirements are complex and our efforts to comply with them require significant resources, and we cannot guarantee we are or will be in full compliance with such laws at all times.
At the U.S. federal level, we are subject to various privacy laws and regulations, including those promulgated under the authority of the U.S. Federal Trade Commission, which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including with respect to data privacy and cybersecurity. At the U.S. state level, we are subject to laws and regulations related to privacy, such as the CCPA which introduced concepts such as transparency and rights like access and deletion, that have been enacted by over a dozen states with many more on the verge of enacting such laws. These laws establish a privacy framework for covered businesses, including various obligations imposed on them related to the personal information they collect and use, and offer various rights for their state residents. Some of these laws provide a private right of action for violations and in some cases damages may be significant. Many of these laws diverge from the CCPA and create their own set of rules and this proliferation of inconsistent state level privacy laws will add operational complexity and increased risk of noncompliance or violations which could trigger enforcement action or litigation.
In addition to data protection and data privacy laws, foreign countries and U.S. states are enacting AI and cybersecurity laws and regulations. For example, in late 2023 the New York State Department of Financial Services (NYDFS) issued amendments to its previous cybersecurity regulations which imposed obligations on companies such as Marsh McLennan, including for example, requiring companies to provide evidence of how they are implementing their data retention, data governance and data classifications policies and procedures. A number of states have also adopted laws covering data collected by insurance licensees that include security and breach notification requirements. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations.
Many statutory requirements, both in the U.S. and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our vendors. For example, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a breach. In addition to government regulation, our agreements with certain third parties may require us to notify them in the event of a security breach. Further, privacy advocates and industry groups have and may in the future propose self-regulatory standards. These laws, rules and industry standards may legally or contractually apply to us, or we may elect to comply with them. We expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. Many of these laws and rules also include strict notification requirements for organizations related to confirmed or suspected breaches. This narrow notification window is often too short to fully validate the facts, and there is an increased risk of reporting a false alarm or immaterial breach, which may lead to reputational damage despite there not being an actual data breach.
We post public privacy policies and other documentation regarding our collection, use, disclosure, cross-border transfer, retention, and other processing of personal information. Although we endeavor to comply with our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, contractors, service providers, vendors or other third parties with whom we do business fail to comply with our published policies and documentation. Such failures could carry similar consequences or subject us to potential enforcement actions or investigations if they are found to be deceptive, unfair or misrepresentative of our actual practices.
Furthermore, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations, including an ongoing focus on compliance related to website "cookies" and other online trackers, as well as the use of online session recording tools in some countries or U.S. states, continue to increase. Privacy violations, including unauthorized use disclosure or transfer of sensitive, personal or confidential client or Company data, whether through systems failure, employee negligence, fraud or misappropriation, by the Company, our vendors or other parties with whom we do business (if they fail to meet the standards we impose) could damage our reputation and subject us to significant litigation, monetary damages, regulatory enforcement actions, fines and criminal prosecution in one or more jurisdictions. Given the complexity of operationalizing the various privacy laws mentioned above, the maturity level of proposed compliance frameworks and the continued lack of certainty on how to implement their requirements, we and our clients are at risk of enforcement actions taken by data protection authorities around the world or litigation from consumer advocacy groups acting on behalf of data subjects. We may not be able to respond quickly or effectively to regulatory, legislative and other developments, and these changes may in turn impair our ability to offer our existing or planned products and services and increase our cost of doing business.