Go Daddy 2015 Annual Report Download - page 36

Table of Contents
the impact such future laws, regulations and standards may have on our business. Future laws, regulations, standards and other obligations could impair our ability
to collect or use information we utilize to provide targeted advertising to our customers, thereby impairing our ability to maintain and grow our total customers and
increase revenue. Future restrictions on the collection, use, sharing or disclosure of our users’ data or additional requirements for express or implied consent of
users for the use and disclosure of such information could require us to modify our products, possibly in a material manner, and could limit our ability to develop
new products and features.
In addition, several foreign countries and governmental bodies including the European Union and Canada, have laws and regulations concerning the
collection and use of personally identifiable information obtained from their residents, including payment card information, which are often more restrictive than
those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of personally identifiable
information, including payment card information identifying, or which may be used to identify, an individual, such as names, email addresses and, in some
jurisdictions, Internet Protocol (IP) addresses. Although we are working to comply with those laws and regulations applicable to us, these and other obligations
may be modified and they may be interpreted in different ways by courts, and new laws and regulations may be enacted in the future. Within the European Union,
legislators have reached a political agreement on the General Data Protection Regulation (GDPR), a new regulation that would supersede the 1995 European Union
Data Protection Directive, and which, when finalized and in effect, may include more stringent operational requirements for processors and controllers of
personally identifiable information, including payment card information, impose significant penalties for non-compliance and have broader extra-territorial effect.
Any such new laws, regulations, other legal obligations or industry standards, or any changed interpretation of existing laws, regulations or other standards
may require us to incur additional costs and restrict our business operations. If our privacy or data security measures fail to comply with current or future laws,
regulations, policies, legal obligations or industry standards, we may be subject to litigation, regulatory investigations, fines or other liabilities, as well as negative
publicity and a potential loss of business. Moreover, if future laws, regulations, other legal obligations or industry standards, or any changed interpretations of the
foregoing limit our customers’ ability to use and share personally identifiable information, including payment card information, or our ability to store, process and
share such personally identifiable information or other data, demand for our products could decrease, our costs could increase, and our business, operating results
and financial condition could be harmed.
In particular, with regard to transfers of personal data, as such term is used in the 1995 EU Data Protection Directive and applicable European Union member
state legislation, from our employees and European customers and users to the U.S., we historically have relied upon adherence to the U.S. Department of
Commerce’s Safe Harbor Privacy Principles and compliance with the U.S.-EU Safe Harbor Framework agreed to by the U.S. Department of Commerce and the
European Union. The U.S.-EU Safe Harbor Framework, which established means for legitimizing the transfer of personal data by U.S. companies from the
European Economic Area (the EEA) to the U.S., recently was invalidated by a decision of the European Court of Justice (the ECJ). In light of the ECJ’s decision,
we are reviewing our business practices and may find it necessary or desirable to make changes to our personal data handling to cause our transfer and receipt of
EEA residents’ personal data to be legitimized under applicable European law. We may be unsuccessful in establishing legitimate means for our transfer and
receipt of personal data from the EEA or otherwise responding to the ECJ’s decision, and we may experience reluctance or refusal by current or prospective
European customers to use our products. Our response to the ECJ’s decision may cause us to assume additional liabilities or incur additional costs, and the ECJ
decision and our response could result in our business, operating results and financial condition being harmed. Additionally, we and our customers may face a risk
of enforcement actions by data protection authorities in the EEA until the time, if any, personal data transfers to us and by us from the EEA are legitimized under
applicable European Union data protection law. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and
technical personnel and negatively affect our business, operating results and financial condition.
Failure to adequately protect and enforce our intellectual property rights could substantially harm our business and operating results.
The success of our business depends in part on our ability to protect and enforce our patents, trademarks, copyrights, trade secrets and other intellectual
property rights. We attempt to protect our intellectual property under patent, trademark, copyright and trade secret laws, and through a combination of
confidentiality procedures, contractual provisions and other methods, all of which offer only limited protection.
31