Item 1A. Risk Factors
ITEM 1A. RISK FACTORS (Continued)
us via the internet and through other electronic means. Despite the security measures and compliance programs we currently maintain and monitor, our facilities and systems and those of our third-party service providers may contain defects in design or manufacture or other problems that could unexpectedly compromise information security. Unauthorized parties may also attempt to gain access to our facilities or systems, or those of third- parties with whom we do business, through fraud, misrepresentation, or other forms of deception. Many of the techniques used to obtain unauthorized access, including viruses, worms and other malicious software programs, are difficult to anticipate until launched against a target and we may be unable to implement adequate preventative measures. Our failure to have a comprehensive privacy program, whether as the result of our own error or the malfeasance or errors of others, could result in regulatory fines and sanctions, increased litigation, prolonged negative publicity, data breaches, declining customer confidence, loss of key customers, employee liability, shareholder derivative lawsuits and other unfavorable consequences. For example, in recent years many companies have been subject to high-profile security breaches that involved sophisticated and targeted attacks on the company’s infrastructure and the compromise of non-public sensitive and confidential information. These attacks were often not recognized or detected until after the disclosure of sensitive information notwithstanding the preventive and anticipative measures the companies had maintained.
Cyber security threats in our business environment expose us to risks.
We encounter continuous exposure to cyber-attacks and other security threats to our information networks and systems and the information stored on those networks and systems. Cyber-attacks are increasing in their frequency, sophistication and intensity, and have become increasingly difficult to detect. Cyber-attacks could include the deployment of harmful malware, ransomware, denial-of-services attacks and other means to affect service reliability and threaten the availability, confidentiality and integrity or information. Cyber-attacks could also include phishing attempts or other methods to cause payments or information to be transmitted to an unintended recipient. Although we have implemented controls, policies and procedures designed to protect against, detect and mitigate these threats, at considerable cost, we face evolving and persistent attacks on our information infrastructure. The attempts by others to gain unauthorized access to our information technology assets are becoming more diverse and sophisticated. We monitor our obligations under and compliance with global laws requiring information security safeguards and notification in the event of a security breach, including the European Union's Global Data Protection Regulation (the "GDPR") and United States breach notification laws. We respond to potential security issues by utilizing procedures that provide for controls on detecting and addressing cyber security threats and communicating information to senior personnel and security representatives that we retain. We have also taken steps to address cyber security threats at third-parties that handle, possess, process and store our information to mitigate the potential risk to us. Such measures include contractually requiring the third-parties to maintain certain data security controls. However, because of the rapidly changing nature and sophistication of these security threats, which can be difficult to detect, there can be no assurance that our controls, policies and procedures have or will detect or prevent all of these threats, and we cannot predict the full impact of any such past or future incident. Any failure by us to effectively address, enforce and maintain our information technology infrastructure and cyber security requirements may result in substantial harm to our business, including major disruptions to business operations, loss of intellectual property, release of confidential information, malicious corruption of data, regulatory intervention and sanctions or fines, investigation and remediation costs and possible prolonged negative publicity. Although we maintain insurance coverage to address cyber security events that we believe is adequate for our business, there can be no assurance that such insurance will cover substantially all of our potential costs and expenses related to cyber security incidents that may happen in the future. In addition, privacy laws in the U.S., including the California Consumer Privacy Act (the "CCPA"), which went into effect on July 1, 2020, increasingly provide for private rights of action, with high statutory damages in the event of certain security breaches, which could increase our potential liability in the event that our information is impacted by a cyber security incident.
We may face particular data protection, data security and privacy risks in connection with the European Union's Global Data Protection Regulation and other privacy regulations.
Strict data privacy laws regulating the collection, transmission, storage and use of employee data and consumers’ personally-identifying information are evolving in the European Union, U.S. and other jurisdictions in which we operate. The GDPR, which became effective on May 25, 2018, imposes compliance obligations for the collection, use, retention, security, processing, transfer and deletion of personally identifiable information of individuals and
43
Table of Contents
HERTZ GLOBAL HOLDINGS, INC. AND SUBSIDIARIES
THE HERTZ CORPORATION AND SUBSIDIARIES
(DEBTORS-IN-POSSESSION)
ITEM 1A. RISK FACTORS (Continued)
creates enhanced rights for individuals. Additionally, the CCPA expands the definition of personal information and grants, among other things, individual rights to access and delete personal information, and the right to opt out of the sale of personal information.
These changes in the legal and regulatory environments in the areas of customer and employee privacy, data security, and cross-border data flows could have a material adverse effect on our business, primarily through the impairment of our marketing and transaction processing activities, the limitation on the types of information that we may collect, process and retain, the resulting costs of complying with such legal and regulatory requirements and potential monetary forfeitures and penalties for noncompliance.
We actively monitor compliance with data protection and privacy-related laws, including with the GDPR, CCPA and upcoming legislation (in the United States and abroad), however, these laws vary depending on the jurisdiction and may create inconsistent or conflicting requirements. Such regulations may increase our compliance and administrative burden significantly and may require us to invest resources and management attention in order to update our IT systems to meet the new requirements. It is possible that we could encounter significant liability for failing to comply with any such requirements.
Maintaining effective employee retention and talent management is critical to our success.
We develop and maintain a talent management strategy that defines current and future talent requirements (e.g., experience, skills, location requirements, timing, etc.) based on our strategic direction, coordinated recruiting and development plans across businesses and regions and considers employee mobility, centers of excellence and shared service concepts to optimize resource plans and leverage labor arbitrage. The consequences that may result from a failure of our employee retention and talent management can include inadequate staffing levels, inability to support bankruptcy and emergence strategy, lack of key talent, declining product quality and competitive differentiation, eroding employee morale and productivity, or an inability to meet/maintain internal control, regulatory or other compliance-related requirements.
We could face a significant withdrawal liability if we withdraw from participation in multiemployer pension plans or in the event other employers in such plans become insolvent and certain multiemployer plans in which we participate are reported to have underfunded liabilities, any of which could have a material adverse effect on our results of operations, financial condition, liquidity or cash flows.
We could face a significant withdrawal liability if we withdraw from participation in one or more multiemployer pension plans or in the event other employers in such plans become insolvent, any of which could have a material adverse effect on our results of operations, financial condition, liquidity or cash flows.
We participate in various “multiemployer” pension plans. In the event that we withdraw from participation in one of these plans, then applicable law could require us to make an additional lump-sum contribution to the plan, and we would have to reflect that as an expense in our consolidated statements of operations and as a liability on our consolidated balance sheets. Our withdrawal liability for any multiemployer plan would depend on the extent of the plan’s funding of vested benefits. Our multiemployer plans could have significant underfunded liabilities. Such underfunding may increase in the event other employers become insolvent or withdraw from the applicable plan or upon the inability or failure of withdrawing employers to pay their withdrawal liability. In addition, such underfunding may increase as a result of lower than expected returns on pension fund assets or other funding deficiencies. The occurrence of any of these events could have a material adverse effect on our consolidated financial condition, results of operations, liquidity and cash flows. See Note 8, "Employee Retirement Benefits," to the Notes to our consolidated financial statements included in this 2020 Annual Report under the caption Item 8, ‘‘Financial Statements and Supplementary Data."
We are subject to many different forms of taxation in various jurisdictions throughout the world, which could lead to disagreements with tax authorities regarding the application of tax laws.
In accordance with Section 482 and the Organization for Economic Cooperation and Development guidelines, we have established transfer pricing policies to govern our intercompany operations. Implementing transfer pricing
44
Table of Contents
HERTZ GLOBAL HOLDINGS, INC. AND SUBSIDIARIES
THE HERTZ CORPORATION AND SUBSIDIARIES
(DEBTORS-IN-POSSESSION)
ITEM 1A. RISK FACTORS (Continued)
policies can be extremely complex and may often require us, together with our advisors, to make subjective determinations. Many countries routinely examine transfer pricing policies of taxpayers subject to their jurisdiction, challenge transfer pricing practices aggressively where there is potential non-compliance and impose significant interest charges and penalties where non-compliance is determined.
We are subject to many forms of taxation in the jurisdictions throughout the world in which we operate, including, but not limited to, income tax, withholding tax and payroll-related taxes. Tax law and administration are extremely complex and often require us, together with our advisors, to make subjective determinations.
In addition, our estimate of tax related assets, liabilities, recoveries and expenses may incorporate significant assumptions. These assumptions include, but are not limited to, the tax laws in various jurisdictions, the effect of tax treaties between jurisdictions, transfer pricing policies, taxable income projections, and the benefits of various restructuring plans. To the extent that such assumptions differ from actual results, we may have to record additional income tax expenses and liabilities.
The tax authorities in the various jurisdictions where we conduct business might not agree with the determinations that we make with our advisors with respect to the application of tax law. Such disagreements could result in lengthy legal disputes and, ultimately, in the payment of substantial funds to the government authorities of foreign and local jurisdictions where we carry on business which could have a material adverse effect on our results of operations, financial condition, liquidity and cash flows.
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.