When conducting our business, we may need to store, transmit and process certain data of our patients, and therefore face risks inherent in handling large volumes of data and in protecting the security and privacy of such data. In recent years, privacy and data protection has become an increasing regulatory focus of government authorities across the world. The PRC government has enacted a series of laws, regulations and governmental policies for the protection of personal data in the past few years. Such regulatory requirements on data privacy are constantly evolving and can be subject to varying interpretations, or significant changes, resulting in uncertainties about the scope of our responsibilities in that regard.
For instance, on June 10, 2021, the Standing Committee of the National People's Congress ("SCNPC") promulgated the PRC Data Security Law, which took effect on September 1, 2021. The PRC Data Security Law, among other things, requires data collection to be conducted in a legitimate and proper manner, and stipulates that, for the purpose of data security, data processing activities must be conducted based on data classification and hierarchical protection system. Furthermore, along with the promulgation of the Opinions on Strictly Combating Illegal Securities Activities, overseas-listed China-based companies are experiencing a heightened scrutiny over their compliance with laws and regulations regarding data security, cross-border data flow and management of confidential information from PRC regulatory authorities.
On August 20, 2021, the SCNPC issued the Personal Information Protection Law, which has been effective from November 1, 2021 and reiterates the circumstances under which a personal information processor could process personal information and the requirements for such circumstances. The Personal Information Protection Law clarifies the scope of application, the definition of personal information and sensitive personal information, the legal basis of personal information processing and the basic requirements of notice and consent.
On October 29, 2021, the CAC publicly solicited opinions on the Measures for the Security Assessment of Data Cross-border Transfer (Draft for Comments), which requires that any data processor who provides to an overseas recipient important data collected and generated during operations within the territory of the PRC or personal information that should be subject to security assessment shall conduct security assessment. The Measures for the Security Assessment of Data Cross-border Transfer (the "Security Assessment Measures") was adopted on July 7, 2022 with the effect from September 1, 2022.
On November 14, 2021, the Cyberspace Administration of China (the "CAC") publicly solicited opinions on the Regulations on the Administration of Cyber Data Security (Draft for Comments) ("Draft Data Security Regulations"). According to the Draft Data Security Regulations, data processors shall, in accordance with relevant state provisions, apply for cyber security review when carrying out the following activities: (1) the merger, reorganization or separation of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests, which affects or may affect national security, (2) data processors that handle the personal information of more than one million people intends to be listed abroad, (3) the data processor intends to be listed in Hong Kong, which affects or may affect national security, and (4) other data processing activities that affect or may affect national security. However, the Draft Data Security Regulations provides no further explanation or interpretation for "affects or may affect national security." The PRC government authorities may have wide discretion in the interpretation of "affects or may affect national security." However, we are not certain whether such draft measures will apply to our company, or whether the scope of financing activities that are subject to such draft measures may change in the future. Furthermore, if such draft measures is adopted into law in the future, we may become subject to enhanced cybersecurity review, or regulatory bodies in China may retroactively apply and implement such draft measures. As such, substantial uncertainties exist with respect to the enactment timetable, final content, interpretation and implementation.
On December 28, 2021, the CAC and 12 other government authorities published the Review Measures, which took effect on February 15, 2022. The Review Measures provides that certain operators of critical information infrastructure purchasing network products and services or network platform operators carrying out data processing activities, which affect or may affect national security, must apply with the Cybersecurity Review Office for a cybersecurity review. The Review Measures also provide that if a "network platform operator" holding personal information of more than one million users intends to go public in a foreign country, it must apply for a cybersecurity review. Currently, we have not been involved in any investigations on cybersecurity review initiated by the CAC or related governmental regulatory authorities, and we have not received any inquiry, notice, warning, or sanction in such respect. As a result, we currently believe we do not need to apply for a cybersecurity review pursuant to the above regulation to maintain the listing status of the ADSs in the United States, because (1) we are not in possession of personal information of over one million users and it is also very unlikely that it will reach such threshold in the near future, and (2) as of the date of the annual report, we have not received any notice or determination from applicable PRC governmental authorities identifying us as a critical information infrastructure operator or a network platform operator engaging in relevant data processing activities which affect or may affect national security of the PRC. However, the scope of operators of "critical information infrastructure" and the interpretation for "affect or may affect national security" under the current regulatory regime remain unclear and are subject to the decisions of competent PRC regulatory authorities. If we are identified as an operator of "critical information infrastructure," we would be required to fulfill various obligations as required under PRC cybersecurity laws and other applicable laws for such operators of "critical information infrastructure" thus currently not applicable to us, including, among others, setting up a special security management organization, organizing regular cybersecurity education and training, formulating emergency plans for cyber security incidents and conducting regular emergency drills, and although the internet products and services we purchase are primarily bandwidth and marketing services, we may need to follow cybersecurity review procedure and apply with Cybersecurity Review Office before making certain purchases of network products and services. Moreover, we may be required to conduct cybersecurity review by the CAC if we were regarded as a critical information infrastructure operator by the CAC, or if our data processing activities and overseas listing were regarded as having impact or potential impact on national security, and be required to make significant changes to our business practices, suspend certain business, or even be prohibited from providing certain service offerings in jurisdictions in which we currently operate or in which we may operate in the future. The cybersecurity review could also lead to negative publicity and a diversion of time and attention of our management and our other resources. It could be costly and time-consuming for us to prepare application materials and make the applications. Furthermore, there can be no assurance that we will obtain the clearance or approval for these applications from the Cybersecurity Review Office and the relevant regulatory authorities in a timely manner, or at all. If we are found to be in violation of cybersecurity requirements in China, the relevant governmental authorities may, at their discretion, conduct investigations, levy fines, request app stores to take down our apps and cease to provide viewing and downloading services related to our apps, prohibit the registration of new users on our platform, or require us to change our business practices in a manner materially adverse to our business. Any of these actions may disrupt our operations and adversely affect our business, results of operations and financial condition.
We cannot predict the impact of these new laws and regulations, if any, at this stage, and we will closely monitor and assess any development in the rule-making process. Therefore, it remains uncertain whether the proposed measures will be applicable to our business, or whether the future regulatory changes would impose additional restrictions on companies like us. Failure to comply with the cybersecurity and data privacy requirements in a timely manner, or at all, may subject us to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, among other sanctions. As a result, we may be required to upgrade or change our service offerings and other aspects of our business to comply with such laws and regulations.
We have adopted various measures to ensure compliance with privacy and data protection regulations. However, our security control may not prevent the improper leakage of personal data and confidential information. Additionally, we cannot assure you that we will be able to address any vulnerabilities in our cloud system solutions and internet hospital that we may become aware of in the future. In particular, we could be subject to attacks on our systems by external parties or fraudulent or inappropriate behaviors by our employees, third-party providers or other business partners. Third parties may also gain access to our data using computer malware, viruses, spamming, phishing attacks or other means. A security breach that leads to leakage of data and information of our users, even though anonymized, could still subject us to legal liabilities, regulatory sanctions, reputational damage and loss of user confidence. In addition, data breaches or any misconduct during the process of collection, analysis, and storage of data, could result in a violation of applicable data privacy and protection laws and regulations in China, and subject us to regulatory actions, investigations or litigations. Even if these actions, investigations or litigations do not result in any liability to us, we could incur significant costs in investigating and defending against them, and could be subject to negative publicity about our privacy and data protection practices, which may affect our reputation in the marketplace. Our potential risks related to our collection and use of data could require us to implement measures to reduce our exposure to liability, which may require us to expend substantial resources and limit the attractiveness of our services to our patients and hospital partners. As a result, our business, results of operations and financial condition could be materially and adversely affected.