Item 1A. Risk Factors
ITEM 1A: RISK FACTORS
We are subject to various risks and uncertainties, which could materially affect our business, results of operations, financial condition, future results, and the trading price of our common stock. You should read carefully the following information together with the information appearing in Part I, Item 1A, Risk Factors in our Annual Report on Form 10-K for the year ended December 31, 2021 as filed with the U.S. Securities and Exchange Commission (“SEC”) on February 3, 2022 (“2021 Form 10-K”). The following information supplements and, to the extent inconsistent, supersedes some of the information appearing in the Risk Factors section of our 2021 Form 10‑K. These risk factors, as well as our condensed consolidated financial statements and notes thereto and the other information appearing in this report, should be reviewed carefully for important information regarding risks that affect us.
LEGAL, REGULATORY AND COMPLIANCE RISKS
Our business is subject to extensive government regulation and oversight. Our failure to comply with extensive, complex, overlapping, and frequently changing rules, regulations, and legal interpretations could materially harm our business.
Privacy and Protection of Customer Data
The legal and regulatory environment relating to privacy and data protection laws continues to evolve in ways we cannot predict, including with respect to technologies such as cloud computing, artificial intelligence, cryptocurrency, and blockchain technology. Any failure, or perceived failure, by us to comply with our privacy policies as communicated to customers or with privacy and data protection laws could result in proceedings or actions against us by data protection authorities, government entities, or others. Such proceedings or actions could subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, result in reputational harm, and materially harm our business. In addition, compliance with inconsistent privacy and data protection laws may restrict or limit our ability to provide products and services to our customers.
PayPal relies on a variety of compliance methods to transfer personal data of EEA individuals to the U.S., including Binding Corporate Rules for internal transfers of certain types of personal data and Standard Contractual Clauses (“SCCs”) as approved by the European Commission for transfers to and from third parties. In June 2021, the European Commission imposed new SCC requirements which impose certain contract and operational requirements on PayPal, its merchants, and vendors in order to adhere to certain affirmative duties, including requirements related to government access transparency, enhanced data subject rights, and broader third-party assessments to ensure safeguards necessary to protect personal data exported from PayPal’s EEA customers and/or employees to countries outside the EEA. To the extent PayPal relies on SCCs, we may be required to incur additional costs and take additional steps to legitimize certain cross-border data transfers from the EEA, including new contractual arrangements under the updated requirements to avoid limitations on PayPal’s ability to process EEA data in countries outside of the EEA.
Many jurisdictions in which we operate have adopted, or are in the process of adopting or amending data privacy legislation or regulations aimed at creating and enhancing individual privacy rights. In the United States, numerous states have enacted or are in the process of enacting state level data privacy laws and regulations governing the collection, use, and retention of state residents’ personal information, and internationally, many of markets in which we operate have similarly enacted or are in the process of enacting or amending similar privacy laws and regulations. The continued proliferation of privacy laws in the jurisdictions in which we operate is likely to result in a disparate array of privacy rules with unaligned or conflicting provisions, accountability requirements, individual rights, and enforcement powers, and may subject us to increased regulatory scrutiny and business costs, and lead to unintended consumer confusion.
58
Table of Contents
BUSINESS AND OPERATIONS RISKS
The conflict between Russia and Ukraine and its related implications could materially and adversely affect our business, financial condition, and results of operations.
In February 2022, Russia commenced military hostilities against Ukraine. In March 2022, we suspended our transactional services in Russia. We have also expanded our services for Ukrainian customers. The potential effects of the conflict between Russia and Ukraine, individually or in the aggregate, could have the effect of heightening or exacerbating many of the risk factors described in Item 1A, Risk Factors, in our Annual Report on Form 10-K for the fiscal year ended December 31, 2021, and may adversely affect our business, financial condition and results of operations. These effects could include, but are not limited to, geopolitical instability and uncertainty; adverse impacts on global and regional economic conditions and financial markets, including significant volatility in credit and capital markets; reduced economic activity; changes in laws and regulations affecting our business, including sanctions targeting Russia imposed by the U.S. and other countries, counter-sanctions imposed by Russia, and additional sanctions or counter-sanctions which may be enacted; and increased cybersecurity threats and concerns. The ultimate extent to which the conflict between Russia and Ukraine may negatively impact our business, financial condition, and results of operations will depend on future developments, which are highly uncertain, difficult to predict, and subject to change.
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.