We collect, process, store, share, transmit, disclose, and use sensitive information and other data provided by consumers, employees, and business partners, including personal information to support our business operations. We also share this information with third parties, including third-party service providers in a manner designed to be secure. However, third parties may violate applicable laws or our information security policies, which could put our data at risk. We or a third party could also be a victim of a cybersecurity incident that impacts our data. We expend significant resources to protect against both internal and external security breaches and may need to expend more resources depending upon, for example, changes in the dynamic cybersecurity landscape, expected growth of our company, new or changing business ventures or practices, use of new or changing technologies, and/or in the event we need to address problems caused by breaches. Any failure or perceived failure to maintain the security of personal and other data that is provided to us by consumers, employees, and vendors could harm our reputation and expose us to a risk of loss or litigation, regulatory scrutiny, and possible liability, any of which could adversely affect our business and operating results.
We are subject to numerous and rapidly evolving federal, state, and local laws regarding privacy, cybersecurity and the collection, use, and disclosure of personal information and other data. The laws are subject to differing interpretations, and both the laws and their interpretations are often inconsistent across jurisdictions with minimal to no precedent or enforcement history available. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA") gives California consumers expanded rights to manage their personal information, such as rights to: access, delete, and limit the use of their personal information, opt out of certain personal information sharing, receive detailed information regarding the way in which their personal information is used, correct inaccurate personal information, and will likely soon impose further heightened cybersecurity obligations, related to cybersecurity and automated decision-making practices and technologies. Many other states have also implemented laws similar to the CCPA, adding to the evolving patchwork of U.S. privacy and cyber law. Regulations such as the CCPA can expose us to investigations and enforcement actions by regulatory authorities and claims from individuals potentially resulting in penalties and significant legal liability, if our data management and information technology security efforts are inadequate or even alleged to be inadequate. In addition, cybersecurity has become a high priority for regulators around the world, and some jurisdictions have enacted laws setting forth cybersecurity compliance standards and/or requiring companies to notify certain parties of data security breaches involving certain types of personal data. For example, the SEC has adopted rules for mandatory disclosure of cybersecurity incidents suffered by public companies and cybersecurity governance and risk management. Additionally, the Federal Trade Commission and the New York Department of Financial Services have both increased incident reporting and expanded cybersecurity program requirements. If we fail to comply with the relevant laws and regulations, we could suffer financial loss, a disruption of our business, liability to investors, regulatory intervention or reputational damage.
We are also subject to contractual requirements and others' privacy policies that govern how we use and protect personal information and other data. They may be costly to comply with, and may conflict with other contractual obligations, laws, regulations, or rules. These obligations may be interpreted and applied in new ways or in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules, obligations, or our practices. Finally, our increased use of artificial intelligence ("AI") technology, such as a chatbot to streamline customer interactions and certain tools to improve internal work efficiencies, may result in cybersecurity and data privacy risk. This includes AI tools and programs offered by and/or used by new or existing vendors.
Any failure or perceived failure by us to comply with our privacy policies, our privacy- or cybersecurity-related obligations to consumers, employees, or other third parties, or our privacy- or cybersecurity-related legal obligations, or any compromise generally of security that results in the unauthorized release or transfer of sensitive information, which may include personally identifiable information or other customer or employee data, may result in governmental enforcement actions, litigation, provision of required notifications to consumers, regulators, or other authorities, or public statements against us by consumer advocacy groups or others and could cause consumers, employees, commercial partners, securitization or real estate investors, and receivable or real estate financing partners to lose trust in us, which could have an adverse effect on our business. If commercial partners, developers, or other parties that we work with violate applicable laws, contractual assurances with us, or our policies, such violations may also put consumers', employees', commercial partners', or receivable financing partners' information at risk and could in turn harm our reputation, business, and operating results.