Though our Cheers e-Mall internet platform, we collect and retain large volumes of internal and customer data, including personal information as our various information technology systems enter, process, summarize and report such data. We also maintain information about various aspects of our operations as well as regarding our employees. The integrity and protection of our customer, employee and company data is critical to our business. Our customers and employees expect that we will adequately protect their personal information. Our VIEs and their subsidiaries are required by applicable laws to keep strictly confidential the personal information that we collect, and to take adequate security measures to safeguard such information.
According to the applicable PRC laws and regulations in relation to cybersecurity and data security, data processing includes, in a broad sense, among others, the collection or access, processing, transmission and related data activities.
The PRC Criminal Law, as amended by its Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits institutions, companies and their employees from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services or obtaining such information through theft or other illegal ways. On November 7, 2016, the Standing Committee of the PRC National People's Congress issued the Cyber Security Law of the PRC, or Cyber Security Law («????????????»), which became effective on June 1, 2017. Pursuant to the Cyber Security Law, network operators must not, without users' consent, collect their personal information, and may only collect users' personal information necessary to provide their services. Providers are also obliged to provide security maintenance for their products and services and shall comply with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations. The Civil Code of the PRC (issued by the PRC National People's Congress on May 28, 2020 and effective from January 1, 2021) provides main legal basis for privacy and personal information infringement claims under the Chinese civil laws. PRC regulators, including the Cyberspace Administration of China, MIIT, and the Ministry of Public Security have been increasingly focused on regulation in the areas of data security and data protection. The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various regulatory bodies in China, including the Cyberspace Administration of China, the Ministry of Public Security and the SAMR, have enforced data privacy and protection laws and regulations with varying and evolving standards and interpretations. In December 28, 2021, the Chinese government promulgated Cybersecurity Review Measures, which came into effect on February 15, 2022. According to the Cybersecurity Review Measures, the procurement of any network product or service by an operator of critical information infrastructure or the conducting of data processing activities by a network platform operator, that affects or may affect national security, shall be subject to a cybersecurity review under the Measures. A network platform operator that possess personal information of more than one million users must apply to the Cybersecurity Review Office set up under the CAC for a cybersecurity review when it seeks to list overseas.
As advised by our PRC legal counsel, and based on its understanding of the Measures for Cybersecurity Review (2021) which became effective on February 15, 2022 and replace the Measures for Cybersecurity Review promulgated on April 13, 2020, our VIEs and their subsidiaries are currently not required to apply for a cybersecurity review with the Cyberspace Administration of China, or the "CAC," under Article 7 of the measures, pursuant to which online platform operators possessing personal information of more than 1 million users which intend to go public abroad shall apply to the CAC for a cybersecurity review, because we listed our ordinary shares on the Nasdaq before the effective date of the measures on February 15, 2022. Under the Measures for Cybersecurity Review (2021), our VIEs and their subsidiaries could be subject to cybersecurity review with the CAC if it is determined that our VIEs or their subsidiaries constitute critical information infrastructure operators and intend to procure a network product or service that affects or could affect national security. Further, as the measures are newly revised and there remains uncertainty as to the interpretation and implementation thereof, we are uncertain whether our VIEs or their subsidiaries would be subject to a cybersecurity review when we offer or list new shares or carry out other financing activities in the capital market. As of the date of this annual report, our VIEs and their subsidiaries have not been informed by any PRC governmental authority of any requirement that we file for a cybersecurity review. Our VIEs and their subsidiaries may also be subject to network data security review by the CAC if the Draft Regulations on the Network Data Security Administration (Draft for Comments) (the "Draft Regulation") are enacted as proposed, if our VIEs or their subsidiaries are recognized as online platform operators which possess massive data resources in connection with national security, economic development and public interests and carry out merger, restructuring, split that affects or could affect national security or carry out other data processing activities that affects or may affect national security.
Recently, certain internet platforms in China have been reportedly subject to heightened regulatory scrutiny in relation to cybersecurity matters. As of the date of this annual report, we, our subsidiaries, and our VIEs and their subsidiaries have not been informed by any PRC governmental authority of any requirement that we file for a cybersecurity review. However, as there remains significant uncertainty in the interpretation and enforcement of relevant PRC cybersecurity laws and regulations, we cannot assure you that we would not be subject to such cybersecurity review requirement, and if so, that we would be able to pass such review. In addition, we could become subject to enhanced cybersecurity review or investigations launched by PRC regulators in the future. Any failure or delay in the completion of the cybersecurity review procedures or any other non-compliance with the related laws and regulations may result in fines or other penalties, including suspension of business, website closure, removal of our app from the relevant app stores, and revocation of prerequisite licenses, as well as reputational damage or legal proceedings or actions against us, which may have material adverse effect on our business, financial condition or results of operations.
The PRC governmental authorities have promulgated, among others, the Personal Information Protection Law of the People's Republic of China(«??????????????»), Data Security Law of the People's Republic of China(«????????????»), Measures for Cyber Security Review («????????») and Measures for the Security Assessment for Cross-border Transfer of Data «??????????»)to ensure cyber security, data and personal information protection and cross-border data transmission. Recently, the CAC had further proposed Draft Regulations on the Network Data Security Administration (Draft for Comments) («??????????(?????)») (the "Draft Regulation") for public comments, which provided guidance on the potential cybersecurity review scope.
We attach great importance to data security, cyber security and personal information protection, and the evolvement of applicable PRC laws and regulations therewith. As of the date of this annual report, Horgos, our main PRC operating entity, has implemented comprehensive internal policies and measures on protection of cyber security, data privacy and personal information to make sure its compliance with relevant PRC laws and regulations.
As of the date of this annual report, (i) there had been no material incident of data or personal information leakage, infringement of data protection and privacy laws and regulations or investigation or other legal proceeding, pending or threatened against us initiated by competent government authorities or third parties, that will materially and adversely affect the business of us; (ii) we have not received any investigation, notice, warning, penalty or sanction from applicable government authorities (including the CAC) with regard to our business operations concerning any issues related to cybersecurity and data security; (iii) we have not been involved in any suits, judicial review, enquiry, or other legal proceedings initiated by applicable governmental authorities in relation to any violation of applicable regulations or policies that have been issued by the CAC.
While we take various measures to comply with all applicable data privacy and protection laws and regulations, there is no guarantee that our current security measures and those of our third-party service providers may always be adequate for the protection of our customer, employee or company data; and like all companies, we have experienced data incidents from time to time. In addition, given the size of our customer base and the types and volume of personal data on our system, we may be a particularly attractive target for computer hackers, foreign governments or cyber terrorists. Unauthorized access to our proprietary internal and customer data may be obtained through break-ins, sabotage, breach of our secure network by an unauthorized party, computer viruses, computer denial-of-service attacks, employee theft or misuse, breach of the security of the networks of our third-party service providers, or other misconduct. Because the techniques used by computer programmers who may attempt to penetrate and sabotage our proprietary internal and customer data change frequently and may not be recognized until launched against a target, we may be unable to anticipate these techniques. Unauthorized access to our proprietary internal and customer data may also be obtained through inadequate use of security controls. Any of such incidents may harm our reputation and adversely affect our business and results of operations. In addition, we may be subject to negative publicity about our security and privacy policies, systems, or measurements from time to time.
Any failure to prevent or mitigate security breaches, cyber-attacks or other unauthorized access to our systems or disclosure of our customers' data, including their personal information, could result in loss or misuse of such data, interruptions to our service system, diminished customer experience, loss of customer confidence and trust, impairment of our technology infrastructure, and harm our reputation and business, resulting in significant legal and financial exposure and potential lawsuits and could cause the value of such securities to significantly decline or be worthless. In addition, any violation of the provisions and requirements under relevant laws and regulations with respect to cyber security, data security and personal information protection may subject us to rectifications, warnings, fines, confiscation of illegal gains, suspension of the related business, revocation of licenses, cancellation of qualifications being entered into the relevant credit record or even criminal liabilities.
As for the Draft Regulation issued by CAC recently, as advised by our PRC legal counsel, since effective version of the Draft Regulation (especially its operative provisions) has not been officially issued as of the date of this annual report, its anticipated adoption or effective date are subject to further changes with substantial uncertainty. We will continue to pay close attention to the legislative and regulatory developments in data security and comply with the latest regulatory requirements.