Expedia 2011 Annual Report Download - page 27

all applicable laws, policies, legal obligations and industry codes of conduct relating to privacy and data
protection. It is possible, however, that these obligations may be interpreted and applied in a manner that is
inconsistent from one jurisdiction to another and may conflict with other rules or the practices of the companies.
Any failure or perceived failure by us to comply with the privacy policies, privacy-related obligations to users or
other third parties, or privacy related legal obligations, or any compromise of security that results in the
unauthorized release or transfer of personally identifiable information or other user data, may result in
governmental enforcement actions, litigation or public statements against the company by consumer advocacy
groups or others and could cause our customers and members to lose trust in the company, which could have an
adverse effect on our business.
The regulatory framework for privacy issues worldwide is currently in flux and is likely to remain so for the
foreseeable future. Practices regarding the collection, use, storage, transmission and security of personal
information by companies operating over the internet have recently come under increased public scrutiny. The
U.S. Congress and federal agencies, including the Federal Trade Commission and the Department of Commerce,
are reviewing the need for greater regulation for the collection and use of information concerning consumer
behavior on the internet, including regulation aimed at restricting certain targeted advertising practices. U.S.
courts are also considering the applicability of existing federal and state statutes, including computer trespass and
wiretapping laws, to the collection and exchange of information online. In addition, the European Union is in the
process of proposing reforms to its existing data protection legal framework, which may result in a greater
compliance burden for companies, including Expedia, with users in Europe and increased costs of compliance.
Potential security breaches to our systems, whether resulting from internal or external sources, could
significantly harm our business. There can be no guarantee that our existing security measures will prevent all
possible security breaches or attacks. A party, whether internal or external, that is able to circumvent our security
systems could misappropriate user information or proprietary information or cause significant interruptions in
our operations. In the past, we have experienced “denial-of-service” type attacks on our systems that have made
portions of our websites unavailable for short periods of time as well as unauthorized access of our systems and
data. We may need to expend significant resources to protect against security breaches or to address problems
caused by breaches, and reductions in website availability could cause a loss of substantial business volume
during the occurrence of any such incident. Because the techniques used to sabotage security change frequently,
often are not recognized until launched against a target and may originate from less regulated and remote areas
around the world, we may be unable to proactively address these techniques or to implement adequate preventive
measures. Security breaches could result in negative publicity, damage to reputation, exposure to risk of loss or
litigation and possible liability due to regulatory penalties and sanctions. Security breaches could also cause
travelers and potential users to lose confidence in our security, which would have a negative effect on the value
of our brands. Failure to adequately protect against attacks or intrusions, whether for their own systems or
systems of vendors, could expose us to security breaches that could have an adverse impact on financial
performance.
Acquisitions and investments could result in operating and financial difficulties.
We have acquired a number of businesses in the past, and our future growth may depend, in part, on future
acquisitions, any of which could be material to our financial condition and results of operations. Certain financial
and operational risks related to acquisitions that may have a material impact on our business are:
• Use of cash resources and incurrence of debt and contingent liabilities in funding acquisitions may
limit other potential uses of our cash, including stock repurchases, dividend payments and retirement of
outstanding indebtedness;
• Amortization expenses related to acquired intangible assets and other adverse accounting
consequences, including changes in fair value of contingent consideration;
• Expected and unexpected costs incurred in pursuing acquisitions, including identifying and performing
due diligence on potential acquisition targets that may or may not be successful;
23