AmazonScience/document-haystack

1limited exceptions, the EU General Data Protection Regulation (“EU GDPR”) applies EU data protection laws to certain 2companies processing personal data of individuals in the EU, regardless of the company’s location. We also are subject to the 3U.K. General Data Protection Regulation (“U.K. GDPR”), which is how the EU GDPR has been implemented into U.K. law. 4These laws and regulations, and similar laws and regulations in other jurisdictions, impose strict requirements regarding the 5collection, storage, handling, use, disclosure, transfer, security and other processing of personal information, which may have 6adverse consequences, including significant compliance costs and severe monetary penalties for non-compliance. Significant 7uncertainty exists as privacy, data protection, and data security laws may be interpreted and applied differently from country to 8country and may create inconsistent or conflicting requirements.9Further, we make public statements about our use, collection, disclosure and other processing of personal information through 10our privacy policies, information provided on our website and press statements. Although we endeavor to comply with our 11public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our 12privacy policies and other statements that provide promises and assurances about privacy, data protection and data security can 13subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual 14practices. Additional risks could arise in connection with any failure or perceived failure by us, our service providers or other 15third parties with which we do business to provide adequate disclosure or transparency to individuals, including our customers, 16about the personal information collected from them and its use, to receive, document or honor the privacy preferences 17expressed by individuals, to protect personal information from unauthorized disclosure, or to maintain proper training on 18privacy practices for all employees or third parties who have access to personal information in our possession or control.19Our efforts to comply with GLBA, FCRA, CPRA, PIPEDA, EU GDPR, U.K. GDPR and other privacy, data protection and 20data security laws and regulations, as well as our posted privacy policies, and related contractual obligations to third parties, 21entail substantial expenses, may divert resources from other initiatives and projects, and could limit the services we are able to 22offer. Furthermore, enforcement actions and investigations by regulatory authorities related to data security incidents and 23privacy, data protection and data security violations continue to increase. The enactment of more restrictive laws or regulations, 24or future enforcement actions, litigation or investigations, could impact us through increased costs or restrictions on our 25business, and any noncompliance or perceived noncompliance could result in monetary or other penalties, harm to our 26reputation, distraction to our management and technical personnel and significant legal liability.27Our businesses are subject to the risk of increased litigation, government investigations and regulatory enforcement.28Our businesses are subject to increased litigation, government investigations and other regulatory enforcement risks as a result 29of a number of factors and from various sources, including the highly regulated nature of the financial services industry, the 30focus of state and federal prosecutors on banks and the financial services industry and the structure of the credit card industry. 31Given the inherent uncertainties involved in litigation, government investigations and regulatory enforcement decisions, and the 32very large or indeterminate damages sought in some matters asserted against us, there can be significant uncertainty as to the 33ultimate liability we may incur from these kinds of matters. The finding, or even the assertion, of substantial legal liability 34against us could have a material adverse effect on our business and financial condition and could cause significant reputational 35harm to us, which could seriously harm our business. For example, the 2019 Cybersecurity Incident has resulted in litigation, 36consent orders, settlements, government investigations and other regulatory enforcement inquiries.37In addition, financial institutions, such as ourselves, face significant regulatory scrutiny, which can lead to public enforcement 38actions or nonpublic supervisory actions. We and our subsidiaries are subject to comprehensive regulation and periodic 39examination by, among other regulatory bodies, the Federal Banking Agencies, SEC, CFTC and CFPB. We have been subject 40to enforcement actions by many of these and other regulators and may continue to be involved in such actions, including 41governmental inquiries, investigations and enforcement proceedings, including by the OCC, Department of Justice, the FinCEN 42and state Attorneys General. 43Over the last several years, federal and state regulators have focused on risk management, compliance with anti-money 44laundering (“AML”) and sanctions laws, privacy, data protection and data security, use of service providers, fair lending and 45other consumer protection issues and innovative activities, such as those that utilize new technology. In August 2020, we 46entered into consent orders with the Federal Reserve and the OCC resulting from regulatory reviews of the 2019 Cybersecurity 47Incident and relating to ongoing enhancements of our cybersecurity and operational risk management processes, and we paid a 48civil monetary penalty as part of the OCC agreement. The OCC and the Federal Reserve have since terminated their consent 49orders. In January 2021, we also paid a civil monetary penalty assessed by FinCEN against the Bank in connection with AML 5035 Capital One Financial Corporation (COF)