TripAdvisor 2012 Annual Report Download - page 37

In addition, we lack backup systems or contingency plans for certain critical aspects of our operations or
business processes. Many other systems are not fully redundant and their disaster recovery or business continuity
planning may not be sufficient. Fire, flood, power loss, telecommunications failure, break-ins, earthquakes, acts
of war or terrorism, acts of God, computer viruses, electronic intrusion attempts from both external and internal
sources and similar events or disruptions may damage or impact or interrupt computer or communications
systems or business processes at any time. Although we have put measures in place to protect certain portions of
our facilities and assets, any of these events could cause system interruption, delays and loss of critical data, and
could prevent us from providing content and services to users, travelers and/or third parties for a significant
period of time. Remediation may be costly and we may not have adequate insurance to cover such costs.
Moreover, the costs of enhancing infrastructure to attain improved stability and redundancy may be time
consuming and expensive and may require resources and expertise that are difficult to obtain.
We process, store and use personal information and other data, which subjects us to risks stemming from
possible failure to comply with governmental regulation and other legal obligations and potential liability
related to security breaches.
We may acquire personal or confidential information from users of our websites and mobile applications.
There are numerous laws regarding privacy and the storing, sharing, use, processing, disclosure and protection of
personal information and other consumer data, the scope of which are changing, subject to differing interpretations,
and may be inconsistent between countries or conflict with other rules. We strive to comply with all applicable laws,
policies, legal obligations and industry codes of conduct relating to privacy and data protection. It is possible,
however, that these obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction
to another and may conflict with other rules or our practices. Any failure or perceived failure by us to comply with
our privacy policies, privacy-related obligations to users or other third parties, or privacy-related legal obligations,
or any compromise of security that results in the unauthorized release or transfer of personally identifiable
information or other user data, may result in governmental enforcement actions, litigation or public statements
against the relevant company by consumer advocacy groups or others and could cause our customers and members
to lose trust in us, which could have an adverse effect on our business.
The regulatory framework for privacy issues worldwide is currently in flux and is likely to remain so for the
foreseeable future. Practices regarding the collection, use, storage, transmission and security of personal
information by companies operating over the Internet have recently come under increased public scrutiny. The
U.S. Congress and federal agencies, including the Federal Trade Commission and the Department of Commerce,
are reviewing the need for greater regulation for the collection and use of information concerning consumer
behavior on the Internet, including regulation aimed at restricting certain targeted advertising practices. U.S.
courts are also considering the applicability of existing federal and state statutes, including computer trespass and
wiretapping laws, to the collection and exchange of information online. In addition, the European Union is in the
process of proposing reforms to its existing data protection legal framework, which may result in a greater
compliance burden for companies, including us, with users in Europe and increased costs of compliance. We
have collaborations with other online service providers that involve exchanges of user information, and these
practices may attract increased regulatory scrutiny in the United States and Europe in the future.
Potential security breaches to our systems, whether resulting from internal or external sources, could
significantly harm our business. There can be no guarantee that our existing security measures will prevent all
possible security breaches or attacks. A party, whether internal or external, that is able to circumvent our security
systems could misappropriate user information or proprietary information or cause significant interruptions in
our operations. In the past, we have experienced “denial-of-service” type attacks on our systems that have made
portions of our websites unavailable for short periods of time as well as unauthorized access of our systems and
data. We may need to expend significant resources to protect against security breaches or to address problems
caused by breaches, and reductions in website availability could cause a loss of substantial business volume
during the occurrence of any such incident. Because the techniques used to sabotage security change frequently,
often are not recognized until launched against a target and may originate from less regulated and remote areas
27