Our business involves the receipt, storage, processing and transmission of personal information about customers and employees. In accordance with our published privacy policies, we may share non-deidentified personal information about such persons between our affiliates and with certain vendors and third parties that assist with certain aspects of our business pursuant to written agreements. Also, in connection with our student financial aid platform and the processing of college and university debit cards, we have access to certain student personal information that has been provided to us by the colleges and universities we serve. Our handling and use of personal information is subject to applicable federal and state privacy and information security laws and regulations, and industry standards, such as the Payment Card Industry Data Security Standard. As an entity that provides services to institutions of higher education, we are contractually bound to handle certain personal information from student education records in accordance with the requirements of Family Educational Rights and Privacy Act ("FERPA"). Privacy and information security laws, regulations, and applicable industry standards are evolving rapidly, and our on-going compliance with them may result in cost increases due to necessary systems changes and the development of new processes, which may be difficult to timely implement. If we fail to materially comply with these applicable laws, regulations and industry standards, we could be subject to increased legal risk. In addition, even if we materially comply with all applicable laws, regulations and industry standards, and even though we have taken significant steps to protect non-deidentified personal information, e.g., encrypting such personal information in transit and at rest, we could experience a data security breach, and our reputation could be damaged, possibly resulting in a material breach of contract with one or more of our clients, litigation, and/or lost future sales or decreased usage of credit and debit card products. Further, in the event that we disclose unencrypted, non-deidentified student information in violation of our contractual FERPA obligations, the U.S. Department of Education could require a client to suspend our access to their student information. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. A party that is able to circumvent our security measures could misappropriate our proprietary information or our customers' and employees' personal information, and cause interruption in our operations. Any compromise of our data security could result in a violation of applicable laws, regulations or industry standards, significant legal and financial exposure beyond the scope or limits of insurance coverage, increased operating costs associated with remediation, equipment acquisitions or disposal, and added personnel, and a loss of confidence in our security measures, which could harm our business or affect investor confidence. Data security breaches may also result from non-malicious and non-technical means (for example, inadvertent actions by an employee).
Our business is subject to a variety of domestic and international laws, rules, policies and other obligations regarding data protection.
Although most of our personnel and consumers are in the United States, we do have some personnel and consumers located outside the United States. These international operations may subject us to a complex array of international laws and regulations relating to the collection, use, retention, disclosure, security and transfer of personally identifiable information. Many jurisdictions have passed laws in this area, and other jurisdictions are considering imposing additional restrictions. The interpretation and application of data protection laws in the United States and elsewhere are rapidly evolving. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our current data practices. Complying with applicable international laws and regulations could cause us to incur substantial costs or require us to change our business practices in a manner adverse to our business.
Further, although we continue to implement internal controls and procedures designed to protect our proprietary and confidential information, and non-deidentified customer and employee personal data, including sensitive personal data, in order to comply with privacy and information security laws and regulations, our facilities and systems may be vulnerable to security breaches and other data loss, including cyber-attacks. Such a security breach or data loss could lead to negative publicity, damage to our reputation, exposure to litigation and liability, theft, modification or destruction of proprietary information and personal data, damage to or inaccessibility of critical systems, manufacture of defective products, production downtimes, operational disruptions and remediation and other significant costs, which could adversely affect our reputation, financial condition and results of operations.