System: You are an accounting expert. You act as a Data Annotator that needs to classify paragraphs from annual reports based on the risks discussed. Here is a list of risk often discussed but you can provide others. 

Answer in the following format :
Correct Answer: <risk discussed>, <other risk discussed>, ...
Wrong Answer: <risk not discussed>, <other risk not discussed>, ...
User: A wide variety of provincial, state, national, and international laws and regulations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of personal data. These laws and regulations relating to privacy, data protection and security are evolving and being tested in courts and may result in ever-increasing regulatory and public scrutiny, as well as escalating levels of enforcement and sanctions. Further, the interpretation and application of foreign laws and regulations in many cases is uncertain, and our legal and regulatory obligations in foreign jurisdictions are subject to frequent and unexpected changes, including the potential for various regulatory or other governmental bodies to enact new or additional laws or regulations, to issue rulings that invalidate prior laws or regulations, or to increase penalties significantly._For example, the E.U. General Data Protection Regulation (“E.U. GDPR”), which became effective in May 2018, imposes more stringent data protection requirements, provides for greater penalties for noncompliance than E.U. laws that previously applied (up to the greater of €20 million or 4% of the total worldwide annual turnover), and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the E.U. GDPR. The E.U. GDPR requires, among other things, that personal data only be transferred outside of the E.U. to the United States and other jurisdictions that the European Commission has not yet recognized as having “adequate” data protection laws (a “third country”), where a data transfer mechanism under the E.U. GDPR has been put in place. Historically, we have relied on the E.U.-U.S. and Swiss-U.S. Privacy Shield programs, and the use of model contractual clauses approved by the E.U. Commission, to legitimize these transfers (also referred to as standard contractual clauses or SCCs). In July 2020, the Court of Justice of the European Union in its “Schrems II” decision invalidated the E.U.-U.S. Privacy Shield for purposes of transfers to the U.S. and imposed a requirement for companies to carry out an assessment of the laws and practices governing access to personal data in the third country to ensure an essentially equivalent level of data protection to that afforded in the E.U. Though we no longer rely on the Privacy Shield programs and instead employ model contractual clauses for personal data transfers, the Schrems II decision raises questions as to implications under European and UK law and adequate data protection in the United States. Among other effects, we may experience additional costs associated with increased compliance burdens, putting in place any additional data transfer mechanisms and new contract negotiations with third parties that aid in processing data on our behalf. We may experience reluctance or refusal by current or prospective customers in the European Economic Area (“EEA”), Switzerland, and the U.K. (collectively, “Europe”) to use our products, and we may find it necessary or desirable to make further changes to our handling of personal data of residents of Europe. The regulatory environment applicable to the handling of European residents’ personal data, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results and financial condition being harmed. Additionally, we and our customers may face risk of enforcement actions by data protection authorities in Europe relating to personal data transfers to us and by us from Europe. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results, and financial condition.
Let's give a correct and a wrong answer:
Assistant: