We rely extensively on our computer systems to process customer transactions, manage customer data, manage employee data and communicate with third-party vendors and other third parties, and we may also access the Internet to use our computer systems. Our operations require that we collect and store customer data, including credit card numbers and other personal information, for various business purposes, including marketing and promotional purposes. We also collect and store personal information about our employees. Breaches of our security measures or information technology systems or the accidental loss, inadvertent disclosure or unapproved dissemination of proprietary information or sensitive personal information or confidential data about us, or our customers, or our employees including the potential loss or disclosure of such information as a result of hacking or other cyber-attack, computer virus, fraudulent use by customers, employees or employees of third party vendors, trickery or other forms of deception or unauthorized use, or due to system failure, could expose us, our customers, our employees or other individuals affected to a risk of loss or misuse of this information, result in litigation and potential liability for us, damage our reputation or brand names or otherwise harm our business. Additionally, disruptions in the availability of our computer systems, through cyber-attacks or otherwise, could impact our ability to service our customers and adversely affect our sales and the results of operations. We rely on proprietary and commercially available systems, software, tools and monitoring to provide security for processing, transmission and storage of customer information, such as payment card, employee information and other confidential or proprietary information. Our data security measures are reviewed and evaluated regularly; however, they might not protect us against increasingly sophisticated and aggressive threats, and disruptions in our computer systems can occur notwithstanding the data security measures and disaster recovery plans that we have in place. The cost and operational consequences of implementing further data security measures could be significant and there is no certainty that such measures, if purchased, could thwart all threats. Additionally, while we maintain cyber risk insurance to assist in the cost of recovery from a significant cyber event, such coverage may not be sufficient.
Additionally, the collection of customer and employee personal information imposes various privacy compliance related obligations on our business and increases the risks associated with a breach or failure of the integrity of our information technology systems. The collection and use of personal information are governed by privacy laws and regulations enacted in the United States and other jurisdictions around the world. Privacy regulations continue to evolve and on occasion may be inconsistent from one jurisdiction to another. Any loss, disclosure of, misappropriation of, or access to customers', employees' or other personal, proprietary information or any other breach of our network or information security could result in extensive legal proceedings or legal claims, including regulatory investigations and actions, or liability for failure to comply with state or federal privacy and information security laws, including for failure to protect personal information or for misusing personal information. These items could disrupt our operations, cause extensive damage to our reputation, and expose us to legal claims from customers, employees, financial institutions, regulators, payment card associations, and other persons, any of which could adversely affect our business, results of operations and financial condition.
There are also laws and regulations governing the collection and use of biometric information, such as fingerprints and facial scans. For example, the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. ("BIPA") applies to the collection and use of "biometric identifiers" and "biometric information" which include fingerprints and facial scans. BIPA requires written notice and consent before a private entity (like us and our subsidiaries) may collect or disseminate biometric information. It further provides that any private entity in possession of biometric information must establish, publish and comply with a policy regarding its schedule for destroying biometric information and follow reasonable security measures to protect such information. Individuals are afforded a private right of action under BIPA and may recover statutory damages equal to the greater of $1,000 (or $5,000 for reckless violations) or actual damages and reasonable attorneys' fees and costs for each unlawful collection of biometric information, which the Illinois Supreme Court has interpreted to include not only the initial collection of information to create a biometric template, but also, each subsequent scan of biometric information to identify an individual. Many Illinois businesses, including casinos, have been accused of using biometric-enabled devices, including hand or fingerprint scanners for timekeeping or security purposes, and facial recognition technology for security purposes, without the required policy, notice or consent. Any biometric-enabled devices or technologies used by us in Illinois must comply with BIPA's notice, consent, policy and security requirements to avoid potential liability. In addition to BIPA, a number of other proposals exist for new federal and state privacy legislation that, if passed, could increase our potential liability, increase our compliance costs and materially adversely affect our business.
Compliance with applicable privacy laws and regulations may increase our operating costs and/or adversely impact our ability to market our products, properties and services to our customers. In addition, non-compliance with applicable privacy laws and regulations by us (or in some circumstances non-compliance by third party service providers engaged by us) may also result in damage of reputation, result in vulnerabilities that could be exploited to breach our systems and/or subject us to fines, payment of damages, lawsuits (including class actions) or restrictions on our use or transfer of personal information (including biometric information).