The PRC regulatory and enforcement regime with regard to data security and data protection has been evolving rapidly in recent years. In July 2013, China's Ministry of Industry and Information Technology (and its predecessors), or MIIT, promulgated the Provisions on Protection of Personal Information of Telecommunication and Internet Users to regulate the collection and use of users' personal information in the provision of telecommunication services and internet information services in China. In November 2016, the Standing Committee of the NPC promulgated the Cyber Security Law, which took effect on June 1, 2017, to protect cyberspace security and order. The Cyber Security Law tightens control of cyber security and sets forth various security protection obligations for network operators. According to the Cyber Security Law, network operators shall, among others, take security measures to protect networks from unauthorized interference, damage and unauthorized access to prevent data from being divulged, stolen or tampered with. On September 12, 2022, the CAC published the Decision of Amending PRC Cyber Security Law (Draft for Comments), or the Draft Amendment to Cybersecurity Law, which, among other things, aggravated legal liabilities for violations of cybersecurity obligations and critical information infrastructure operators' obligations. As of the date of this annual report, the Draft Amendment to Cybersecurity Law was released for public comment only, and its respective provisions and anticipated adoption or effective date may be subject to change with substantial uncertainty. Since 2019, the CAC and other relevant authorities further issued detailed implementation rules and measures to refine these information security and privacy protection related regulations. On August 20, 2021, the Standing Committee of the NPC promulgated the Personal Information Protection Law, which took effect on November 1, 2021. The Personal Information Protection Law aims at protecting personal information rights and interests, regulating the processing of personal information, ensuring the orderly and free flow of personal information in accordance with the law, and promoting the reasonable use of personal information. Our business is facing and/or may face significant challenges regarding information security and privacy protection, particularly with regard to the collection, storage, transmission and sharing of confidential information, among others. As part of our service offerings, we may collect, process, transmit and store the personal information of students. We and the VIE have adopted various security measures pertaining to the collection, processing, transmission or storage of user information, and have not experienced any material cyber-attacks on our and the VIE's cyber systems. We cannot assure you, however, that our current security measures will be adequate or sufficient to prevent any theft, misuse, or unauthorized interference, damage, or unauthorized or inappropriate disclosure of personal data of our students. In case of any misuse of information collected from our students or any unauthorized interference, damage, or unauthorized or inappropriate disclosure of such information due to our failure to protect it, we could be subject to negative publicity, liability or regulatory penalties. Any such negative publicity, liability or regulatory penalties could cause us to lose students, expose us to costly litigation and have a material adverse impact on our business and results of operations.
On the other hand, pursuant to the Personal Information Protection Law, personal information processors, who need to transfer personal information out of mainland China for business and other needs, shall satisfy one of the following conditions: (i) passing the security assessment by the national cyberspace authorities; (ii) being certified by professional organizations for personal information protection; (iii) entering into contracts providing the rights and obligations of both parties with overseas recipients in accordance with the standard contract formulated by the national cyberspace authorities; and (iv) other conditions specified by laws, administration regulations and the national cyberspace authorities. The personal information processors shall take necessary measures to ensure that the activities of the overseas recipients handling personal information meet the standards of personal information protection stipulated in the Personal Information Protection Law. If a personal information processor provides personal information cross the border of mainland China, it shall inform the information owners the name and contact information of the overseas recipients, the purpose and manner of information processing, the type of personal information, and the manner and procedure for the information owners to exercise their rights under the Personal Information Protection Law over the overseas recipients, and obtain consent of the information owners. On July 7, 2022, the CAC issued the Measures on Security Assessment of the Cross-border Transfer of Data, which took effect on September 1, 2022. The measures provide that four types of cross-border transfers of critical data or personal information generated from or collected in mainland China should be subject to a security assessment, which include: (i) a data processor to transfer important data overseas; (ii) either a critical information infrastructure operator, or a data processor processing personal information of more than 1 million individuals, transfers personal information overseas; (iii) a data processor who has, since January 1 of the previous year, transferred personal information of more than 100,000 individuals overseas cumulatively, or transferred sensitive personal information of more than 10,000 individuals overseas cumulatively; or (iv) other circumstances under which security assessment of data cross-border transfer is required as prescribed by the national cyberspace administration. As of the date of this annual report, the amount of personal information (including sensitive personal information) transmitted by the Company, its subsidiaries and the VIE across the border is relatively small, and none of them has received any notice from the national cyberspace authorities requiring them to conduct security assessment. However, if the relevant laws, regulations or interpretations change in the future and the Company, its subsidiaries and the VIE are subject to security assessment, we will face uncertainty as to whether any required actions can be timely completed, or at all. Under the Personal Information Protection Law, the Company, its subsidiaries and the VIE may meet the requirements by either completing personal information protection certification or entering into the standard contract formulated by the national cyberspace authorities as the amount of personal information we or the VIE transfer across the border is relatively small. On November 4, 2022, the CAC and the State Administration for Market Regulation jointly issued the Announcement in relation to the Implementation of Personal Information Protection Certification with an exhibit of Implementation Rules for Personal Information Protection Certification, according to which, the professional organizations authorized to conduct personal information protection certification shall comply with the Implementation Rules for Personal Information Protection Certification. On February 22, 2023, the CAC issued the Model Contract Provision with an exhibit of model contract, which came into effect on June 1, 2023. According to the Model Contract Provision, the personal information processor meeting all of the following four conditions may transfer personal information out of mainland China by way of entering into the model contract: (i) non-critical information infrastructure operator; (ii) possessing personal information of less than one million users; (iii) a personal information processor who has, since January 1 of the previous year, transferred personal information of less than 100,000 individuals overseas cumulatively; and (iv) a personal information processor who has, since January 1 of the previous year, transferred sensitive personal information of less than 10,000 individuals overseas cumulatively. Also, the personal information processor shall conduct personal information protection influence assessment before transferring any personal information out of mainland China. The personal information processor shall file the signed model contract within ten days after the effective date of such model contract with the local competent authority. The Model Contract Provision stipulates a six-month period starting from June 1, 2023 to rectify noncompliance prior to June 1, 2023. On September 28, 2023, the CAC published the Draft Provisions for Cross-border Data Flow, which, among other things, provides that there is no need to pass the security assessment for outbound transfer of data, enter into the model contract or obtain personal information protection certification if one is expected to transfer personal information of less than 10,000 individuals overseas in one year, however, the consent from the personal information owner shall be obtained if the outbound transfer of personal information is based on such consent. As of the date of this annual report, the Draft Provisions for Cross-border Data Flow was released for public comment only, and its respective provisions and anticipated adoption or effective date may be subject to change with substantial uncertainty. As the relevant rules were recently issued and the regulations are still evolving, we are still evaluating and monitoring whether and how to complete the personal information protection certification or enter into the standard contract formulated by the national cyberspace authorities. As of the date of this annual report, we have not received any inquiries, notices, warnings, sanctions, denials, or regulatory objections from the CAC or any other regulatory authority in relation to the foregoing issues. In the event of any failure to comply with the Personal Information Protection Law, the Company, its subsidiaries and the VIE may be subject to non-compliance rectification, warning, confiscation of illegal income or fines, or if the non-compliance is deemed serious by the regulators, suspension of relevant business and revocation of relevant business operation permissions or business licenses, which could materially and adversely affect our business, financial condition, and results of operations, and/or the value of our ADSs.
On July 1, 2015, the Standing Committee of the NPC promulgated the National Security Law (the "New National Security Law"), which took effect on the same date and replaced the former National Security Law promulgated in 1993. Under the New National Security Law, we are obligated to safeguard national security by, for example, providing evidence related to activities endangering national security, providing assistance for national security work and providing necessary support for national security institutions, public security institutions and military institutions. As such, we may have to provide data to PRC government authorities and military institutions to ensure compliance with the New National Security Law. Complying with such regulations could cause us to incur substantial costs, require us to change our data practices in a manner adverse to our business, or even subject us to negative publicity which could harm our reputation with users and negatively affect our business operations and the trading price of our ADSs.
On December 28, 2021, the CAC published the Cybersecurity Review Measures, which became effective on February 15, 2022. Under the Cybersecurity Review Measures, critical information infrastructure operators purchasing network products and services and internet platform operators engaging in data processing activities that affect or may affect national security shall be subject to cybersecurity review. The Cybersecurity Review Measures further requires that any internet platform operator applying for listing on a foreign exchange must go through cybersecurity review if it possesses personal information of more than one million users. The review focuses on several factors, including, among others, (i) the risk of theft, leakage, corruption, illegal use or export of any core or important data, or a large amount of personal information, and (ii) the risk of any critical information infrastructure, core or important data, or a large amount of personal information being affected, controlled or maliciously exploited by a foreign government after a company is listed. We believe we would not be subject to the cybersecurity review by the CAC, given that: (i) we do not possess a large amount of personal information in our business operations; and (ii) data processed in our business does not have a bearing on national security and thus may not be classified as core or important data by the authorities. However, we cannot assure you that PRC regulatory agencies, including the CAC, would take the same view as we do, and there remains uncertainty as to how the Cybersecurity Review Measures will be interpreted or implemented and whether the PRC regulatory agencies, including the CAC, may adopt new laws, regulations, rules, or detailed implementation and interpretation related to the Cybersecurity Review Measures. In the event that we are subject to any mandatory cybersecurity review and other specific actions required by the CAC, we will face uncertainty as to whether any clearance or other required actions can be timely completed, or at all. Given such uncertainty, we may be further required to suspend our relevant business, shut down our website, or face other penalties, which could materially and adversely affect our business, financial condition, and results of operations, and/or the value of our ADSs or could significantly limit or completely hinder our ability to offer or continue to offer securities to investors. As of the date of this annual report, we have not received any notice from such authorities requiring us to go through cybersecurity review by the CAC.
On January 8, 2021, the CAC published the Amended Measures for the Administration of Internet Information Services (Draft for Comments), which requires that any organization or individual within the territory of mainland China that provides internet information services to users in mainland China using network resources at home and abroad shall abide by the provisions of these measures. To engage in internet information services, which belong to the operation of telecommunications business, an ICP license from the competent telecommunications department shall be obtained. Internet information service providers shall establish an information release review system. On November 14, 2021, the CAC published the Internet Data Security Regulations (Draft for Comments), or the Draft Data Security Regulations, which provides that data processors that handle personal information of more than one million people intending to be listed abroad should apply for a cybersecurity review.
As the Amended Measures for the Administration of Internet Information Services (Draft for Comments) and the Internet Data Security Regulations (Draft for Comments) have not been adopted, and it remains unclear whether the formal versions to be adopted in the future will have any further material changes, and it is uncertain how such regulations will be enacted, interpreted, or implemented or how they will affect us.