We collect and process data, including personal, financial and confidential information about individuals, including our employees and business partners and may obtain or process personal data in the provision of hosting or HPC solutions we may offer. The collection, use, processing and storage of such data about individuals are governed by data privacy laws, regulations, guidelines and rules enacted and enforced in Australia, Canada, the UK, EU, the U.S. (federal and state) and other jurisdictions worldwide. We do not currently have any formal data privacy policies and procedures in place and have not completed an assessment of whether we are in compliance with all applicable data privacy laws and regulations. Data privacy laws and regulations are complex, continue to evolve, and on occasion may be inconsistent between jurisdictions leading to uncertainty in interpreting such laws and it is possible that these laws, regulations and requirements may be interpreted and applied in a manner that is inconsistent with our existing information processing practices, and many of these laws are significantly litigated and/or subject to regulatory enforcement. The implication of this includes that various federal, state and foreign legislative or regulatory bodies may enact or adopt new or additional laws and regulations concerning data privacy, data retention, data transfer and data protection. Such laws may continue to add to our compliance costs, restrict or dictate how we collect, maintain, combine, disseminate and otherwise process information and could have a material adverse effect on our business, results of operations, financial condition and prospects.
The General Data Protection Regulation ("GDPR"), and any additional requirements in the national implementing laws of countries in the European Economic Area ("EEA"), which went into effect in the European Union on May 25, 2018, applies to the collection, use, retention, security, processing, and transfer of personal data of individuals in the EEA; the United Kingdom ("UK") data protection regime consisting primarily of the UK General Data Protection Regulation ("UK GDPR") and the UK Data Protection Act 2018 could further add to our compliance costs and limit how we process information. It is possible that the GDPR and UK GDPR may be interpreted or applied in a manner that is adverse to us or otherwise inconsistent with our practices; or that the European Union, UK or other national supervisory authorities may hold that we are not in full compliance with the GDPR's or UK GDPR's requirements. In addition, the GDPR increases the scrutiny of transfers of personal data from the EEA to the United States and other jurisdictions that the European Commission does not recognize as having "adequate" data protection laws; in July 2020, the Court of Justice of the European Union limited how organizations could lawfully transfer personal data from the EEA and, in the case of the UK GDPR, the transfers of personal data from the UK to the United States by invalidating the EU-US Privacy Shield and imposing further restrictions on use of the standard contractual clauses, which could increase our costs and our ability to efficiently process personal data. On July 10, 2023, the European Commission adopted an adequacy decision in relation to the United States under a new EU-U.S. Data Privacy Framework ("EU-U.S. DPF"). The adequacy decision concludes that the United States ensures an adequate level of protection for personal data transferred from the EU to organizations in the United States that are included in the "Data Privacy Framework List," maintained and made publicly available by the United States Department of Commerce pursuant to the EU-U.S. DPF. However, the EU-U.S. DPF replaces two prior adequacy frameworks which were invalidated by the CJEU and any further invalidation of the EU-U.S. DPF by the CJEU could create considerable uncertainty regarding providing our products and services in Europe, which may materially and adversely affect our business, financial condition, and results of operations. Additionally, following the withdrawal of the UK from the European Union and the expiry of the transition period, from January 1, 2021, we now have to comply with the GDPR and separately the UK GDPR, each regime having the ability to fine up to the greater of €20 million / £17.5 million, respectively or 4% of annual global turnover. Failure to comply with these laws may also result in the imposition of significant criminal penalties and private litigation.
The relationship between the UK and the European Union in relation to certain aspects of data protection law remains subject to change, including how data transfers between European Union member states and the UK will be treated. These changes may lead to additional compliance costs and could increase our overall risk. Failure to comply with the requirements of the GDPR and UK GDPR may result in fines and other administrative penalties. Government enforcement actions can be costly and interrupt the regular operation of our business, and data breaches or violations of data privacy laws can result in fines, reputational damage and civil lawsuits, any of which may adversely affect our business, financial condition and results of operations. Also, like many websites, we use cookies and other tracking technologies on our website. In recent years, European lawmakers and regulators have expressed concern over electronic marketing and the use of nonessential cookies, web beacons and similar technology for online behavioral advertising, or tracking technologies, leading to an effort to replace the current rules on e-marketing (currently set out in the ePrivacy Directive and national implementing laws) with a new ePrivacy Regulation. When implemented, the new ePrivacy Regulation is expected to alter rules on tracking technologies and significantly increase fining powers to the same levels as the GDPR.
In the United States, according to the Federal Trade Commission ("FTC"), failure to take appropriate steps to keep consumers' personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. State privacy and security laws vary from state to state and, in some cases, can impose more restrictive requirements than U.S. federal law. For example, California enacted the California Consumer Privacy Act on June 28, 2018, which went into effect on January 1, 2020, and subsequently enacted the California Privacy Rights Act of 2020, (collectively, the "CCPA"), which became effective in most material respects on January 1, 2023. The CCPA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal data. The CCPA is enforced by both the Office of the Attorney General of California and the newly-established California Privacy Protection Agency, and failure to fully comply can result in regulatory fines of up to $2,500 per violation (which has been interpreted to mean per impacted individual) and civil penalties up to $7,500 per violation for knowing/willful violations. The CCPA further allows consumers to file lawsuits against a business if a data breach involving certain sensitive information has occurred as a result of the business' violation of the duty to implement and maintain reasonable security procedures and practices. This private right of action and the significant outstanding uncertainties in the interpretation, application and enforcement of key CCPA provisions may increase the likelihood of, and risks associated with, data breach litigation. Other state legislatures have passed, are currently contemplating, or may pass their own comprehensive data privacy and security laws, with potentially greater penalties and more rigorous compliance requirements relevant to our business. The CCPA and other such similar laws may increase our compliance costs and potential liability, and many similar laws have been proposed and/or enacted in other states and at the federal level.
Any actual or perceived failure by us or the third parties with whom we work to comply with data privacy laws, regulations, guidelines, rules or industry standards, or any security incident that results in the unauthorized release or transfer of personally identifiable information, may result in governmental enforcement actions and investigations including by European Data Protection Authorities and US federal and state regulatory authorities, fines and penalties, litigation and/or adverse publicity, including by consumer advocacy groups, and could cause a loss of trust in us, which could harm our reputation and have a material adverse effect on our business, reputation, results of operations, financial condition and prospects.