The regulatory framework for privacy and data security matters around the world is rapidly evolving and is likely to remain volatile for the foreseeable future. We are subject to privacy and data security obligations in the United States, United Kingdom, European Union and other foreign jurisdictions relating to the collection, use, sharing, retention, security, transfer and other handling of personal data about individuals, including our users and employees around the world. Data protection, consumer protection and privacy laws may differ, conflict and be interpreted and applied inconsistently, from country to country. In many cases, these laws apply not only to user data, employee data and third-party transactions, but also to transfers of personal data between or among ourselves, our subsidiaries, and other parties with which we have commercial relations, in addition to methods of communication and consent for such communication. These laws continue to develop in the U.S. and around the globe, including through regulatory and legislative action and judicial decisions, in ways we cannot predict and that may harm our business. For example, a new Quebec data protection law took effect in September 2023, and updates to Canadian federal privacy legislation are pending. India passed the Digital Personal Data Protection Act in 2023. In addition, the United States, through the Federal Communications Commission, recently implemented new lead generation "robot-text" and "robo-calls" regulations under the Telephone Consumer Protection Act (TCPA). As the particulars of these regulations are unknown at this time, these new consumer protection regulations could impact our organization's corporate go-to-market sales initiatives, as well as certain feature sets in our current product stack.
Any failure to comply with applicable laws, regulations or contractual obligations may harm our business, results of operations and financial condition. If we are subject to an investigation or litigation or suffer a breach of security of personal data, we may incur costs or be subject to forfeitures and penalties that could reduce our profitability. In addition, compliance with these laws may restrict our ability to provide services to our customers that they may find to be valuable. For example, the General Data Protection Regulation ("GDPR") became effective in May 2018. The GDPR, which applies to personal data collected in the context of all of our activities conducted from an establishment in the European Union, related to products and services offered to individuals in the European Union or related to the monitoring of individuals' behavior in Europe, imposes a range of significant compliance obligations regarding the handling of personal data. Actions required to comply with these obligations depend in part on how particular and strict regulators interpret and apply them. If we fail to comply with the GDPR, or if regulators assert we have failed to comply with the GDPR, we may be subject to, for example, regulatory enforcement actions, that can result in monetary penalties of up to 4% of our annual worldwide revenue or EUR 20 million (whichever higher), private lawsuits, class actions, regulatory orders to stop processing and delete data, and reputational damage. In June 2021, the European Commission published new versions of the Standard Contractual Clauses, which are used as a legal cross-border mechanism allowing companies to transfer/allow access to personal data outside the European Economic Area. Use of the previous versions of the Standard Contractual Clauses is no longer allowed and all contracts that include the earlier versions should have been amended to replace them with the new versions by December 27, 2022. Also in June 2021, the European Data Protection Board finalized its recommendations regarding supplemental transfer measures to protect personal data during cross-border transfers. We must incur costs and expenses to comply with the new requirements, which may impact the cross-border transfer of personal data throughout our organization and to/from third parties.
In the United States, at least thirteen states have adopted generally applicable and comprehensive privacy laws. These new and developing state laws provide a number of new privacy rights for residents of these states and impose corresponding obligations on organizations doing business in these states. Not only do these laws require that we make new disclosures to consumers, business contacts, employees, job applicants and others about our data collection, use and sharing practices, but they also require that we provide new rights, such as the rights to access, delete and correct personal data. While the California Consumer Privacy Act (the "CCPA") became effective in 2020, it has already been amended significantly, and compliance with the amended law, the California Privacy Protection Act (the "CPRA") was required as of January 2023. Compliance with the other states' laws will be required at different times during 2023. In addition, a number of other U.S. states are considering adopting laws and regulations imposing obligations regarding the handling of personal data. Compliance with the GDPR, the new state laws, and other current and future applicable U.S. and international privacy, data protection, cybersecurity, artificial intelligence and other data-related laws can be costly and time-consuming. Complying with these varying requirements could cause us to incur substantial costs and/or require us to change our business practices in a manner adverse to our business. Violations of data and privacy-related laws can result in significant penalties.
Australia recently amended its Privacy Act, increasing the maximum penalties available for serious or repeated data breaches from AUS 2.2 million to the greater of: (i) AUS 50 million; (ii) three times the value of any benefit obtained through misuse of the information; or (iii) 30% of a company's adjusted turnover in the relevant period.
We also may be bound by additional, more stringent contractual obligations relating to our collection, use and disclosure of personal data or may find it necessary or desirable to join industry or other self-regulatory bodies or other privacy or security related organizations that require compliance with their rules pertaining to privacy and data protection.
We post on our websites our privacy notices and practices concerning the collection, use, sharing, disclosure, deletion and retention of our user data. Any failure, or perceived failure, by us to comply with our posted privacy notices or with any regulatory requirements or orders or other federal, state or international privacy -related laws and regulations, including the GDPR, CCPA and CPRA, could result in proceedings or actions against us by governmental entities or others (e.g., class action plaintiffs), subject us to significant penalties and negative publicity, require us to change our business practices, increase our costs and adversely affect our business. We may also experience security breaches and likely will in the future, which themselves may result in a violation of these laws and give rise to regulatory enforcement and/or private litigation.