In the ordinary course of our business, we collect, process, transmit, disclose, and retain personal information regarding our employees and their families, our franchisees and their employees, vendors, contractors, and guests (which can include social security numbers, social insurance numbers, banking and tax identification information, health care information for employees, and credit card information) and our franchisees collect similar information. In recent years we expanded our development and management of our brands’ mobile apps, online ordering platforms, and in-restaurant kiosks and home market loyalty programs. While our deployment of such technology facilitates our primary goals of generating incremental sales and improving operations at our franchisees’ restaurants as well as additional customer awareness and interest in our brands, such deployment also means that we are collecting and entrusted with additional personal information, in some cases including geo-location tracking information, about our customers.
In connection with the collection and retention of this information, we are subject to legal and compliance risks and associated liability related to privacy and data protection requirements. These types of legislation, which include the Canadian Consumer Privacy Protection Act, the California Privacy Rights Act of 2020, Quebec's Law 25, the European Union's General Data Protection Regulation (the “GDPR”) and the U.K. General Data Protection Regulation, can impose stringent data protection requirements, provide for costly penalties for noncompliance (eg. up to 4% of annual worldwide revenue for a breach of the GDPR), and confer the right upon data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations. In China, the Personal Information Protection Law (“PIPL”), has established personal information processing rules, data subject rights, and obligations for personal information processors, among other things. In addition to the PIPL, China’s Data Security Law regulates data processing activities associated with personal and non-personal data. Due to enhanced scrutiny from the general public, these regulations as well as their interpretation and criteria for enforcement continue to be subject to frequent change, and there are likely to be other jurisdictions that propose or enact new or emerging data privacy requirements in the future.
The complexity of these privacy and data protection laws may result in significant costs arising from compliance and from any non-compliance, whether or not due to our negligence, and could affect our brand reputation and our results of operations. We have and are expected to continue to have significant investments arising from compliance with these regulatory regimes due to changes in the scope of our operations and the ever-changing techniques and sophistication used to conduct cyber-attacks and breaches. In addition, to the extent that we are not in compliance with these laws or experience a major breach, theft, or loss of personal information that is held by us, or third parties on our behalf (whether or not due to our failure to comply with data security rules and standards), we could be subject to substantial fines, penalties, indemnification claims, and potential litigation which could negatively impact our results of operations and financial condition. For example, in Canada, we have been the subject of government investigation and purported class action lawsuits based on the use of certain geolocation data for Tim Hortons mobile app users. As a result of any breach, we may incur additional expenditures arising from additional security technologies, personnel, experts, and credit monitoring services for those whose data has been breached. These costs could adversely impact our results of operations during the period in which they are incurred. In addition, negative publicity regarding a breach or potential security vulnerabilities in our systems or those of our franchisees or vendors, has and in the future could adversely affect the reputation of our brands and acceptance of digital engagement by our customers which in turn could adversely affect our future results of operations.