Table of Contents We rely heavily on technology and automated systems to operate our business, and any failure of these technologies or systems could harm our business, results of operations and financial condition. We are highly dependent on existing and emerging technology and automated systems to operate our business. These technologies and systems include our computerized airline reservation system, flight operations systems, financial planning, management and accounting systems, telecommunications systems, website, maintenance systems and check-in kiosks. In order for our operations to work efficiently, our website and reservation system must be able to accommodate a high volume of traffic, maintain secure information and deliver flight information, as well as issue electronic tickets and process critical financial information in a timely manner. Substantially all of our tickets are issued to passengers as electronic tickets. We depend on our reservation system, which is hosted and maintained under a long-term contract by a third-party service provider, to be able to issue, track and accept these electronic tickets. If our technologies or automated systems are not functioning or if our third-party service providers were to fail to adequately provide technical support, system maintenance or timely software upgrades for any one of our key existing systems, we could experience service disruptions or delays, which could harm our business and result in the loss of important data, increase our expenses and decrease our revenues. In the event that one or more of our primary technology or systems vendors goes into bankruptcy, ceases operations or fails to perform as promised, replacement services may not be readily available on a timely basis, at competitive rates or at all, and any transition time to a new system may be significant. Our technologies and automated systems cannot be completely protected against events that are beyond our control, including natural disasters, power failures, terrorist attacks, cyber-attacks, data theft, equipment and software failures, computer viruses or telecommunications failures. Substantial or sustained system failures could cause service delays or failures and result in our customers purchasing tickets from other airlines. We cannot assure that our security measures, change control procedures or disaster recovery plans are adequate to prevent disruptions or delays. Disruption in or changes to these technologies or systems could result in a disruption to our business and the loss of important data. Any of the foregoing could result in a material adverse effect on our business, results of operations and financial condition. Evolving data security and privacy requirements could increase our costs, and any significant data security incident could disrupt our operations, harm our reputation, expose us to legal risks and otherwise materially adversely affect our business, results of operations and financial condition. Our business requires the secure processing and storage of sensitive information relating to our customers, employees, business partners and others. However, like any global enterprise operating in today’s digital business environment, we are subject to threats to the security of our networks and data, including threats potentially involving criminal hackers, hacktivists, state-sponsored actors, corporate espionage, employee malfeasance, and human or technological error. These threats continue to increase as the frequency, intensity and sophistication of attempted attacks and intrusions increase around the world. We have been the target of cybersecurity attacks in the past and expect that we will continue to be in the future. Furthermore, in response to these threats there has been heightened legislative and regulatory focus on data privacy and cybersecurity in the U.S., the EU and elsewhere, particularly with respect to critical infrastructure providers, including those in the transportation sector. As a result, we must comply with a proliferating and fast-evolving set of legal requirements in this area, including substantive cybersecurity standards as well as requirements for notifying regulators and affected individuals in the event of a data security incident. This regulatory environment is increasingly challenging and may present material obligations and risks to our business, including significantly expanded compliance burdens, costs and enforcement risks. For example, in May 2018, the EU’s new General Data Protection Regulation, commonly referred to as GDPR, came into effect, which imposes a host of new data privacy and security requirements, imposing significant costs on us and carrying substantial penalties for non- compliance. In addition, many of our commercial partners, including credit card companies, have imposed data security standards that we must meet. In particular, we are required by the Payment Card Industry Security Standards Council, founded by the credit card companies, to comply with their highest level of data security standards. While we continue our efforts to meet these standards, new and revised standards may be imposed that may be difficult for us to meet and could increase our costs. A significant cybersecurity incident could result in a range of potentially material negative consequences for us, including unauthorized access to, disclosure, modification, misuse, loss or destruction of company systems or data; theft of sensitive, regulated or confidential data, such as personal identifying information or our intellectual property; the loss of functionality of critical systems through ransomware, denial of service or other attacks; a deterioration in our relationships with business partners and other third parties; and business delays, service or system disruptions, damage to equipment and injury to persons or property. The methods used to obtain unauthorized access, disable or degrade service or 47