We collect, use, store, disclose, transfer and protect (collectively, "process") personal information, including from employees, customers and potential customers, in connection with the operation of our business. A wide variety of federal, state, local and international laws as well as regulations and industry guidelines apply to the processing of personal information and may vary between jurisdictions or conflict with other rules. Data protection and privacy laws and regulations are evolving, subject to differing interpretations and being tested in courts and may result in increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.
A variety of data protection legislation apply in the U.S. at both the federal and state level, including new laws that may impact our operations. For example, in June 2018, the State of California enacted the California Consumer Privacy Act of 2018 ("CCPA"). The CCPA defines "personal information" in a broad manner and generally requires companies that collect, use, share and otherwise process personal information of California residents to make disclosures about their data collection, use, and sharing practices, allows consumers to opt-out of certain data sharing with third parties for purposes of cross-contextual advertising or the sale of personal information, allows consumers to exercise certain rights with respect to any personal information collected and provides a new cause of action for data breaches.
Failure to comply with the CCPA could result in and provides for penalties for noncompliance of up to $7,500 per violation. Additional states have either passed or are considering data protection laws with similarly broad requirements. Other states, including Virginia, Connecticut, and Colorado, have adopted privacy laws with similarly significant requirements. However, these regulations will only apply to us in the event that we process the personal information of more than 100,000 residents of those states in a given year.
Additionally, the Federal Trade Commission, and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. The burdens imposed by the CCPA and other similar laws that have been or may be enacted at the federal and state level may require us to modify our data collection and processing practices and related policies and to incur substantial expenditures in order to comply with the additional laws.
Global privacy and data protection legislation, enforcement, and policy activity are rapidly expanding and evolving, and may be inconsistent from jurisdiction to jurisdiction. For example, the European Union's General Data Protection Regulation 2016/679 ("GDPR"), which became effective in May 2018, imposes a broad array of requirements for processing personal data, including elevated disclosure requirements regarding collection and use of such data, requirements that companies allow individuals to obtain copies or demand deletion of personal data held by those companies, limitations on retention of information, and public disclosure of significant data breaches, among other things. The GDPR provides for substantial penalties for non-compliance of up to the greater of €20 million or 4% of global annual revenue for the preceding financial year. From January 1, 2021, the GDPR has been retained in the United Kingdom ("U.K."), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419) ("U.K. GDPR"), alongside the U.K.'s Data Protection Act 2018. Although we do not currently operate in Europe, should our operations expand there or if we are deemed to target our services to individuals in the European Economic Area or the United Kingdom, we could be required to comply with the GDPR and U.K. GDPR, which could expose us to significant compliance costs and potential penalties in the event of any actual or alleged violation.
Compliance with these and any other applicable privacy and data protection laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with the new privacy and data protection laws and regulations. Our actual or alleged failure to comply with any applicable privacy and data protection laws and regulations, industry standards or contractual obligations, or to protect such information and data that we process, could result in litigation, regulatory investigations, and enforcement actions against us, including fines, orders, public censure, claims for damages by employees, customers and other affected individuals, public statements against us by consumer advocacy groups, damage to our reputation and competitive position and loss of goodwill (both in relation to existing customers and prospective customers) any of which could have a material adverse effect on our business, financial condition, results of operations, and cash flows. Evolving and changing definitions of personal information, personal data, and similar concepts within the European Union, U.K., the U.S. and elsewhere, especially relating to classification of IP addresses, device identifiers, location data, household data and other information we may collect, may limit or inhibit our ability to operate or expand our business, including limiting strategic partnerships that may involve the sharing of such information and data. Additionally, if third parties that we work with, such as vendors or developers, violate applicable laws or our policies, such violations may also place personal information at risk and have an adverse effect on our business. Even the perception of privacy concerns, whether or not valid, may harm our reputation, subject us to regulatory scrutiny and investigations, and inhibit adoption of our wines by existing and potential customers.