A great deal of confidential information owned by us is stored in our information systems, networks, and facilities or those of third parties. This includes valuable trade secrets and intellectual property, corporate strategic plans, marketing plans, customer information, and personally identifiable information, such as employee information (collectively, "confidential information"). We also rely to a large extent on the efficient and uninterrupted operation of complex information technology systems, infrastructure, and hardware (together "IT systems"), some of which are within our control and some of which are within the control of third parties, to accumulate, process, store, and transmit large amounts of confidential information and other data. We are subject to a variety of continuously evolving and developing laws and regulations around the world related to privacy, data protection, and data security. Maintaining the confidentiality, integrity and availability of our IT systems and confidential information is vital to our business.
IT systems are vulnerable to system inadequacies, operating failures, service interruptions or failures, security breaches, malicious intrusions, or cyber-attacks from a variety of sources. Cyber-attacks are growing in their frequency, sophistication, and intensity, and are becoming increasingly difficult to detect, mitigate, or prevent. Cyber-attacks come in many forms, including the deployment of harmful malware, exploitation of vulnerabilities, denial-of-service attacks, the use of social engineering, and other means to compromise the confidentiality, integrity and availability of our IT systems, confidential information, and other data. Breaches resulting in the compromise, disruption, degradation, manipulation, loss, theft, destruction, or unauthorized disclosure or use of confidential information, or the unauthorized access to, disruption of, or interference with our products and services, can occur in a variety of ways, including but not limited to, negligent or wrongful conduct by employees or others with permitted access to our systems and information, or wrongful conduct by hackers, competitors, certain governments, or other current or former company personnel.
The failure or inadequacy of our IT systems, the compromise, disruption, degradation, manipulation, loss, theft, destruction, or unauthorized disclosure or use of confidential information, or the unauthorized access to, disruption of, or interference with our products and services that rely on IT systems, could impair our ability to secure and maintain intellectual property rights; result in a product manufacturing interruption or failure, or in the interruption or failure of products or services that rely on IT systems; damage our operations, customer relationships, or reputation; and cause us to lose trade secrets or other competitive advantages. Unauthorized disclosure of personally identifiable information could expose us to significant sanctions for violations of data privacy laws and regulations around the world and could damage public trust in our company. For example, the GDPR requires companies to meet new requirements regarding the handling of personal data, including its use, protection and transfer and the ability of persons whose data is stored to correct or delete such data about themselves. Failure to meet the GDPR requirements could result in penalties of up to 40% of annual worldwide revenue. The GDPR also confers a private right of action on certain individuals and associations. In addition, the CPRA became effective in January 2020 and has similar requirements to the GDPR.
To date, system inadequacies, operating failures, unauthorized access, service interruptions or failures, security breaches, malicious intrusions, cyber-attacks, and the compromise, disruption, degradation, manipulation, loss, theft, destruction, or unauthorized disclosure or use of confidential information have not had a material impact on our consolidated results of operations. We continue to implement measures in an effort to protect, detect, respond to, and minimize or prevent these risks and to enhance the resiliency of our IT systems; however, these measures may not be successful. If they are not successful, any of these events could result in material financial, legal, business, or reputational harm to our business.