We rely on information technology systems, some of which are managed by third parties and some of which are managed on a decentralized, independent basis by our operating companies, to process, transmit and store electronic information (including sensitive data such as confidential business information and personally identifiable data relating to employees, customers and other business partners), and to manage or support a variety of critical business processes and activities (such as receiving and fulfilling orders, billing, collecting and making payments, shipping products, providing services and support to customers and fulfilling contractual obligations). These systems, products and services (including those we acquire through business acquisitions) may be damaged, disrupted or shut down due to attacks by computer hackers, nation states, cyber-criminals, computer viruses, employee error or malfeasance, power outages, hardware failures, telecommunication or utility failures, catastrophes or other unforeseen events, and in any such circumstances our system redundancy and other disaster recovery planning may be ineffective or inadequate. In addition, security breaches of our systems (or the systems of our customers, suppliers or other business partners) could result in the misappropriation, destruction or unauthorized disclosure of confidential information or personal data belonging to us or to our employees, partners, customers or suppliers. Like many multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, unauthorized access and other cyber-attacks and we expect to be subject to similar incidents in the future as such attacks become more sophisticated and frequent. We have programs in place that are intended to detect, contain, and respond to data security incidents and that provide at least annual employee awareness training regarding phishing, malware, and other cyber risks. However, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may be difficult to detect, we may be unable to anticipate these techniques or implement adequate preventive measures. If our security measures are breached or fail, unauthorized persons may be able to obtain access to or acquire personal or other confidential data. Depending on the nature of the information compromised, we may also have obligations to notify consumers and/or employees about the incident, and we may need to provide some form of remedy, such as a subscription to a credit monitoring service, for the individuals affected by the incident. While to date none of these incidents have been material to our operations, any of the attacks, breaches or other disruptions or damage described above could interrupt our operations, delay production and shipments, result in theft of our and our customers' intellectual property and trade secrets, damage customer and business partner relationships and our reputation or result in defective products or services, legal claims and proceedings, liability and penalties under privacy laws and increased costs for security and remediation, each of which could adversely affect our business and financial statements.
If we are unable to maintain reliable information technology systems and appropriate controls with respect to global data privacy and security requirements and prevent data breaches, we may suffer adverse regulatory consequences, business consequences and litigation. As a global organization, we are subject to data privacy and security laws, regulations, and customer-imposed controls in numerous jurisdictions as a result of having access to and processing confidential, personal and/or sensitive data in the course of our business. Failure to comply with the requirements of EU General Data Protection Regulation that became effective in May 2018 ("GDPR") and the applicable national data protection laws of the EU member states may result in fines of up to €20 million or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. Several other countries such as China and Russia have passed, and other countries are considering passing, laws that require personal data relating to their citizens to be maintained on local servers and impose additional data transfer restrictions. The California Consumer Privacy Act, which came into effect in January 2020, has some of the same features as the GDPR, and has prompted several other states to follow with similar laws. Government enforcement actions can be costly and interrupt the regular operation of our business, and data breaches or violations of data privacy laws can result in fines, reputational damage and civil lawsuits, any of which may adversely affect our business, reputation and financial statements. In addition, compliance with the varying data privacy regulations across the United States and around the world has required significant expenditures and may require additional expenditures, and may require further changes in our products or business models that increase competition or reduce revenue.