We currently provide content licensing to customers in more than 150 countries and license content from contributors located in over 100 countries. In connection with providing content licensing, we collect, store, process and use our customers' and contributors' personally identifiable information and other data, and we rely on third parties that are not directly under our control to do so as well. We also collect, store, process, transmit and use our employees' personally identifiable information and other data in connection with their employment. While we take measures intended to protect the security, integrity and confidentiality of the personal information and other sensitive information we collect, store or transmit, we cannot guarantee that inadvertent or unauthorized use or disclosure will not occur, or that third parties will not gain unauthorized access to or misuse this information. There have been a number of reported incidents where third-party service providers or partners have used software to access the personal data of their customers' or partners' customers for marketing and other purposes. Our privacy policies and practices prohibit such activities, but our third-party service providers or partners may nevertheless engage in such activity without our knowledge or consent. If we or our third-party service providers or partners were to experience a cybersecurity incident, data breach or disruption, unauthorized access or failure of systems compromising our customers', contributors' or employees' data, or if one of our third-party service providers or partners were to access our customers' personal data without authorization, our brand and reputation could be adversely affected, use of our products could decrease, we could experience business interruption and we could be exposed to a risk of loss, litigation and regulatory proceedings. Depending on the nature of the information compromised in a cybersecurity incident, data breach or disruption or unauthorized access or failure of systems compromising our customers', contributors' or employees' data, we may also have obligations to notify customers, contributors, employees or governmental bodies about the incident and we may need to provide some form of mitigation and relief for the individuals affected. In addition, ongoing rulemaking and the potential for changes to cybersecurity disclosure rules may subject us to enhanced or uncertain requirements. Complying with these obligations could cause us to incur substantial costs, including compliance, crisis management and remediation costs, and receive negative publicity. While we maintain insurance coverage that is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the event we experience a cybersecurity incident, data breach, disruption, unauthorized access or failure of systems.
Regulatory scrutiny of privacy, data collection, use of data and data protection continues to intensify both within the United States and globally. The personal information and other data we collect, store, process and use is increasingly subject to legislation and regulations in numerous jurisdictions around the world, especially in Europe. These laws often develop in ways we cannot predict and some laws may be in conflict with one another. This may significantly increase our cost of doing business, particularly as we expand our localization efforts. For example, the GDPR imposes stringent operational requirements for controllers and processors of personal data of individuals in the European Economic Area (the "EEA"), and noncompliance can trigger fines of up to the greater of €20 million or 4% of global annual revenues. Further, following the U.K.'s formal exit from the E.U. in January 2020, we became subject to the GDPR as incorporated into U.K. law. Additionally, although we are making use of the E.U. Standard Contractual Clauses with regard to the transfer of certain personal data to countries outside the EEA recent legal developments in Europe have created complexity and regulatory compliance uncertainty regarding certain transfers of personal information from the EEA to the United States. For example, on July 16, 2020, the Court of Justice of the European Union ("CJEU") invalidated the E.U.-U.S. Privacy Shield Framework ("Privacy Shield") under which personal information could be transferred from the E.U. to U.S. entities who had self-certified under the Privacy Shield program. While the CJEU upheld the adequacy of E.U.-specified standard contractual clauses as an adequate mechanism for cross-border transfers of personal data, it made clear that reliance on them alone may not necessarily be sufficient in all circumstances and that their use must be assessed on a case-by-case basis taking into account the surveillance laws in and the right of individuals afforded by, the destination country. The CJEU went on to state that, if the competent supervisory authority believes that the standard contractual clauses cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer unless the data exporter has already done so itself.
To fill the gap left by the invalidation of the Privacy Shield, the U.S. and EU agreed on a legal framework in October 2022 for transferring personal information from the EU to the U.S. ("EU-U.S. Data Privacy Framework"). In July 2023, the European Commission issued an adequacy decision on the EU-U.S. Data Privacy Framework which replaced the Privacy Shield. An entity seeking to transfer personal information under the EU-U.S. Data Privacy Framework must first self-certify to the U.S. Department of Commerce that it complies with the EU-U.S. Data Privacy Framework Principles. The protections afford transfers of personal information under the EU-U.S. Data Privacy Framework was also extended to transfers between the U.S. and U.K. in October 2023.
We rely on a mixture of mechanisms to transfer personal data from our E.U. business to the U.S. (having previously relied on Privacy Shield) and are evaluating what additional mechanisms may be required to establish adequate safeguards for personal information. As supervisory authorities issue further guidance on personal information export mechanisms, including circumstances where the standard contractual clauses cannot be used and/or start taking enforcement action, we could suffer additional costs, complaints, and/or regulatory investigations or fines. Moreover, if we are otherwise unable to transfer personal information between and among countries and regions in which we operate, it could affect the manner in which we provide our services and could adversely affect our financial results.
Several other foreign jurisdictions have adopted or are considering adopting new or updated comprehensive privacy legislation to offer additional data privacy protections for individuals. For example, in Brazil, the General Data Privacy Law, which was signed into law in August 2018 and was subject to enforcement beginning in August 2021, imposes detailed rules for the collection, use, processing and storage of personal data. Similarly, on August 9, 2023, India passed a data protection law that will establish how entities can handle personal data and the rights individuals have over their personal data. Further, data privacy laws have been enacted in a number of jurisdictions, including, but not limited to, the European Union, Illinois and California, which regulate the collection of certain biometric data regarding individuals, including their facial images, and the use of such data, including in facial recognition systems. Private and class plaintiffs have successfully asserted claims in settled litigation relating to the processing and storage of photographs under biometric privacy laws. Similar laws have also been introduced in several additional states. We have entered into certain contractual agreements that may implicate or make use of such technology. Such laws may have the effect of adversely impacting our ability to grow our business in that area. Although we are closely monitoring regulatory developments in this area, any actual or perceived failure by us to comply with any regulatory requirements or orders or other domestic or international privacy or consumer protection-related laws and regulations could result in proceedings or actions against us by governmental entities or others (e.g., class action litigation), subject us to significant penalties and negative publicity, require us to change our business practices, increase our costs and adversely affect our business.
Data protection legislation is also becoming increasingly common in the United States at both the federal and state level. For example, in June 2018, the State of California enacted the CCPA, which came into effect on January 1, 2020. The CCPA requires, among other things, companies that collect personal information about California residents to make new disclosures to those residents about their data collection, use and sharing practices, allows residents to exercise certain rights regarding their personal information (including the right to opt out of certain data sharing with third parties), and provides a private right of action for data breaches. In addition, the California Privacy Rights Act ("CPRA"), which came into effect on January 1, 2023 (with a look back to January 2022), amends and expands the CCPA to add additional disclosure obligations (including an obligation to disclose retention periods or criteria for categories of personal information), grant consumers additional rights (including rights to correct their data, limit the use and disclosure of sensitive personal information, and opt out of the sharing of personal information for certain targeted behavioral advertising purposes), and establishes a privacy enforcement agency known as the California Privacy Protection Agency ("CPPA"). The CPPA will serve as California's chief privacy regulator, which will likely result in greater regulatory activity and enforcement in the privacy area. Additional comprehensive data privacy laws have become effective in Colorado, Utah, Virginia and Connecticut, and in 2024, data privacy laws in Florida, Oregon, Montana and Texas will take effect creating an evolving climate for data privacy compliance obligations and risks. Five other states (Delaware, Iowa, New Jersey, Tennessee and Indiana) have similar comprehensive data privacy laws set to become effective by 2026. Additionally, the Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination and security of data. The scope and interpretation of data privacy and cybersecurity regulations continues to evolve, and we believe that the adoption of increasingly restrictive regulations in this area is likely in the near future within the U.S. at both state and federal levels. The burdens imposed by the CCPA, the CPRA and other similar laws that may be enacted at the federal and state level may require us to modify our data processing practices and policies and to incur substantial costs in order to investigate, comply and defend against potential private class-action litigation.
Further, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed and stored only within that country. Russia adopted such a law in 2014, and, in 2018, India introduced a bill, which was updated in December 2019, requiring local storage of certain personal data of Indian data principals. Such data localization requirements may have cost implications for us, impact our ability to utilize the efficiencies and value of our global network, and could affect our strategy. Further, if other countries in which we have customers were to adopt data localization laws, we could be required to expand our data storage facilities there or build new ones in order to comply. The expenditure this would require, as well as costs of ongoing compliance, could harm our financial condition.