Use of technology to offer title and escrow products involves the storage and transmission of information, including personal information, in relation to our staff, contractors, business partners and current, past or potential customers. We have legal and contractual obligations regarding confidentiality and the protection and appropriate use of personally identifiable and other proprietary or confidential information. Data privacy has become a significant issue in the United States and around the world. The regulatory framework for privacy issues worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. Many government bodies and agencies have adopted or are considering adopting laws and regulations regarding the processing, collection, use, storage and disclosure of personal information and breach notification procedures. We are also required to comply with laws, rules and regulations, as well as contractual obligations, relating to data security. Interpretation of these laws, rules and regulations and their application to our platform in applicable jurisdictions is ongoing and cannot be fully determined at this time.
We are subject to numerous and constantly evolving privacy laws and regulations. Certain of our activities are subject to the privacy regulations of the Gramm-Leach-Bliley Act, along with its implementing regulations, which restricts certain collection, processing, storage, use and disclosure of personal information, requires notice to individuals of privacy practices, provides individuals with certain rights to prevent the use and disclosure of certain nonpublic or otherwise legally protected information and imposes requirements for the safeguarding and proper destruction of personal information through the issuance of data security standards or guidelines. On October 24, 2017, the National Association of Insurance Commissioners ("NAIC") adopted its Insurance Data Security Model Law, or the Insurance Data Security Model Law, intended to serve as model legislation for states to enact in order to govern the cybersecurity and data protection practices of insurers, insurance agents, and other licensed entities registered under state insurance laws. Alabama, Connecticut, Delaware, Indiana, Louisiana, Michigan, Mississippi, New Hampshire, Ohio, South Carolina and Virginia have adopted versions of the Insurance Data Security Model Law, each with a different effective date, and other states may adopt versions of the Insurance Data Security Model Law in the future. The New York Department of Financial Services has promulgated its own Cybersecurity Requirements for Financial Services Companies that is not based upon the Insurance Data Security Model Law, and requires insurance companies to establish and maintain a cybersecurity program, and implement and maintain cybersecurity policies and procedures with specific requirements. In addition, the California Financial Information Privacy Act further regulates how California consumers' nonpublic personal information is shared and includes certain more stringent obligations than the Gramm-Leach-Bliley Act.
On June 28, 2018, California enacted a new privacy law known as the California Consumer Privacy Act of 2018 ("CCPA"), which became effective January 1, 2020. The CCPA increases privacy rights for California residents, and imposes obligations on companies that process their personal information, including an obligation to provide certain new disclosures to such residents. Specifically, among other things, the CCPA creates new consumer rights, and imposes corresponding obligations on covered businesses, relating to the access to, deletion of, and sharing of personal information collected by covered businesses, including California residents' right to access and delete their personal information, opt out of certain sharing and sales of their personal information, and receive detailed information about how their personal information is used. The law exempts from certain requirements of the CCPA certain information that is collected, processed, sold, or disclosed pursuant to the California Financial Information Privacy Act or the federal Gramm-Leach-Bliley Act. The definition of "personal information" in the CCPA is broad and may encompass other information that we maintain beyond that excluded under the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act exemption. Further, the CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation. In addition, it remains unclear how various provisions of the CCPA will be interpreted and enforced. Moreover, the California Privacy Rights Act ("CPRA") was approved by California voters in November 2020 and will further modify and expand the CCPA, including by expanding consumers' rights with respect to certain personal information and creating a new state agency to oversee implementation and enforcement efforts. We may be required to expend significant time and financial resources to evaluate our practices for compliance with CPRA. Some observers have noted that the CCPA and CPRA could mark the beginning of a trend toward more stringent privacy legislation in the United States, and multiple states have enacted, or are expected to enact, similar laws. There is also discussion in Congress of a new comprehensive federal data protection and privacy law to which we likely would be subject if it is enacted. The effects of the CCPA and CPRA, and other similar state or federal laws, are potentially significant and may require us to modify our data processing practices and policies, and to incur substantial costs and potential liability in an effort to comply with such legislation.
Complying with privacy and data protection laws and regulations may cause us to incur substantial operational costs or require us to change our business practices. Although we take steps to comply with financial industry cybersecurity regulations and other data security laws such as the CCPA and believe we are materially compliant with their requirements, our failure to comply with new or existing cybersecurity regulations could result in material regulatory actions and other penalties. Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws and other actual or alleged legal obligations, such as contractual or self-regulatory obligations, may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our platform. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our platform, which could have an adverse effect on our business. Any inability to adequately address privacy concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business, results of operations and financial condition.
Additionally, we are subject to the terms of our privacy policies and privacy-related obligations to third parties. Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to consumers or other third parties, or our privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of sensitive information, which could include personally identifiable information or other user data, may result in governmental or regulatory investigations, enforcement actions, regulatory fines, compliance orders, litigation or public statements against us by consumer advocacy groups or others, and could cause consumers to lose trust in us, all of which could be costly and have an adverse effect on our business. In addition, new and changed rules and regulations regarding privacy, data protection (in particular those that impact the use of machine intelligence) and cross-border transfers of consumer information could cause us to delay planned uses and disclosures of data to comply with applicable privacy and data protection requirements. For example, our use of certain vendors outside of the United States to perform services on our platform could subject us to additional data protection regimes and increased risk of noncompliance. Moreover, if third parties that we work with violate applicable laws or our policies, such violations also may put personal information at risk, which may result in increased regulatory scrutiny and have a material adverse effect to our reputation, business and operating results.