The PRC has implemented or is implementing rules and is considering a number of additional proposals relating to data protection. The PRC's new Data Security Law took effect in September 2021. The Data Security Law provides that the data processing activities must be conducted based on "data classification and hierarchical protection system" for the purpose of data protection and prohibits entities in the PRC from transferring data stored in the PRC to foreign law enforcement agencies or judicial authorities without prior approval by the authorized PRC governmental authority.
Additionally, the PRC's Cyber Security Law requires companies to take some organizational, technical and administrative measures and other necessary measures to ensure the security of their networks and data stored on their networks. Specifically, the Cyber Security Law provides that the PRC adopt a multi-level protection scheme, or MLPS, under which network operators are required to perform obligations of security protection to ensure that the network is free from interference, disruption or unauthorized access, and prevent network data from being disclosed, stolen or tampered.
In 2022, the Cyberspace Administration of China or the CAC took action against several PRC internet companies in connection with their initial public offerings on U.S. securities exchanges, for alleged national security risks and improper collection and use of the personal information of PRC data subjects. In April 2020, the Chinese government promulgated the Cybersecurity Review Measures or the "2020 Cybersecurity Review Measures, which came into effect on June 1, 2020. In July 2021, the CAC and other related authorities released a draft amendment to the 2020 Cybersecurity Review Measures for public comments. On December 28, 2021, the Chinese government promulgated amended Cybersecurity Review Measures, or the 2022 Cybersecurity Review Measures, which came into effect and replaced the 2020 Cybersecurity Review Measures on February 15, 2022.
According to the 2022 Cybersecurity Review Measures, (i) critical information infrastructure operators, or CIIOs that purchase network products and services and internet platform operators that conduct data processing activities are subject to cybersecurity review in accordance with the 2022 Cybersecurity Review Measures if such activities affect or may affect national security; and (ii) internet platform operators holding personal information of more than one million users and seeking to have their securities list on a stock exchange in a foreign country shall file for cybersecurity review with the Cybersecurity Review Office. The 2022 Cybersecurity Review Measures remain unclear on whether the relevant requirements will be applicable to the follow-on offerings of companies that have completed initial public offerings on stock exchanges outside the PRC. As of the date of this annual report, we have not been informed by any PRC government agency that we qualify as a CIIO or internet platform operator, and we are not a data processor in possession of more than one million users' personal information. Further, we have not been involved in any cybersecurity-related investigation initiated by the CAC or any other PRC government authority, and have not received any cybersecurity-related warning or sanction from the PRC government authorities, or any notice from relevant authorities requesting that we file for the cybersecurity review. Therefore, based on our understanding of the current PRC laws and regulations, we are of the view that we are unlikely to be subject to such cybersecurity review arising from our continued listing on a U.S. stock exchange or offerings of our securities thereon. The CAC, however, has the discretion to initiate cybersecurity review on data processing activities which are deemed to affect or may affect national security. Thus, we cannot preclude the possibility that we would be subject to ex officio cybersecurity reviews by the CAC, and it is uncertain whether being listed in the United States would increase such possibility. If we are subject to such cybersecurity review, we may be ordered to suspend business or discontinue the development of new product candidates or business partnerships, among other things, pending completion of the review. If we fail to pass the cybersecurity review, we may face penalties such as fines, suspension of business, closure of websites, or revocation of relevant business licenses and permits, any of which could have a material adverse effect on our business and results of operations.
On November 14, 2021, the CAC released the draft Administrative Regulation on Network Data Security, or the Draft Administrative Regulation, for public comments through December 13, 2021. Under the Draft Administrative Regulation, foreign listed data processors shall carry out annual data security evaluation and submit the evaluation report to the municipal cyberspace administration authority.
On July 7, 2022, the CAC promulgated the Security Assessment Measures for Outbound Data Transfer, or the Security Assessment Measures, which came into effect on September 1, 2022. Pursuant to the Security Assessment Measures, a data processor shall apply to competent authorities for security assessment prior to transferring any data outside of the PRC if the transfer involves (i) important data; (ii) personal information transferred outside the PRC by a CIIO and a data processor that processes personal information of more than one million individuals; (iii) personal information transferred by a data processor outside the PRC who has already provided personal information of 100,000 persons or sensitive personal information of 10,000 persons outside the PRC since January 1 of the previous year; or (iv) other circumstances as requested by the CAC.
On March 22, 2024, the CAC promulgated the Provisions on Promoting and Regulating Cross-border Data Transfer, which narrow the scope of conditions that shall apply for a security assessment. Pursuant to the Provisions on Promoting and Regulating Cross-border Data Transfer, any data processor which exports personal information shall apply for a security assessment before transferring any personal information abroad if it satisfies any of the following conditions: (1) personal information and important data will be provided overseas by any operator of critical information infrastructure; (2) important data will be provided overseas by any data processor other than an operator of critical information infrastructure, or personal information of more than 1,000,000 individuals in aggregate (excluding sensitive personal information) or sensitive personal information of more than 10,000 individuals in aggregate has been provided overseas since January 1 of the current year. If personal information of more than 100,000 individuals but less than 1,000,000 individuals in aggregate (excluding sensitive personal information) or sensitive personal information of less than 10,000 individuals in aggregate has been provided overseas by any data processor other than an operator of critical information infrastructure since January 1 of the current year, standard contracts for personal information transfer shall be entered into with the overseas receivers or the certification of personal information protection shall be passed in accordance with the law. Despite the above, where a data processor transfers data abroad, it may be exempted from applying for a cross-border transfer security assessment, concluding a standard contract for personal information to be provided abroad or passing a security certificate for personal information protection if it satisfies any of the following conditions: (1) where it is really necessary to provide personal information abroad for the purpose of concluding or performing a contract to which an individual concerned is a party, such as cross-border shopping, cross-border delivery, cross-border remittance, cross-border payment, cross-border account opening, air ticket and hotel reservation, visa handling and examination services; (2) where it is really necessary to provide employees' personal information abroad for the purpose of conducting cross-border human resources management in accordance with the employment rules and regulations and collective contracts formulated in accordance with the law; (3) where it is really necessary to provide personal information abroad in an emergency to protect the life, health and property safety of a natural person; or (4) where a data processor other than a critical information infrastructure operator provides abroad the personal information (excluding sensitive personal information) of not more than 100,000 persons accumulatively as of January 1 of the current year. As of the date of this annual report, we have not processed more than 1,000,000 persons' personal information or 10,000 persons' sensitive personal information outside the PRC since January 1, 2024. In addition, as of the date of this annual report, we have not been informed by any PRC government agency that we qualify as a CIIO, and the Information Security Technology-Guidance for Identifying Important Data are only drafts for comments and have not been officially adopted.
Also, the National People's Congress released the Personal Information Protection Law, which became effective on November 1, 2021. The Personal Information Protection Law provides a comprehensive set of data privacy and protection requirements that apply to the processing of personal information and expands data protection compliance obligations to cover the processing of personal information of persons by organizations and individuals in the PRC, and the processing of personal information of persons in the PRC outside of the PRC if such processing is for purposes of providing products and services to, or analyzing and evaluating the behavior of, persons in the PRC. The Personal Information Protection Law also provides that critical information infrastructure operators and personal information processing entities who process personal information meeting a volume threshold to be set by PRC cyberspace regulators are also required to store in the PRC personal information generated or collected in the PRC, and to pass a security assessment administered by PRC cyberspace regulators for any export of such personal information. Lastly, the Personal Information Protection Law provides for significant fines for serious violations of up to RMB 50 million or 5% of annual revenues from the prior year and may also be ordered to suspend any related activity or be revoked the relevant business permits or business license by competent authorities. We do not maintain, nor do we intend to maintain, personally identifiable health information of patients in the PRC. We do, however, collect and maintain de-identified health data for clinical trials in compliance with local regulations.
China's National Information Security Standardization Technical Committee issued the Practice Guidelines for Cybersecurity Standards - Security Certification Specifications for Cross-border Processing of Personal Information on June 24, 2022 and issued Version 2.0 of such guidelines on December 16, 2022, or collectively, the Security Certification Specifications. The Security Certification Specifications serve as guidance for how personal information security certification should be conducted for cross-border transfer of personal information. However, the Security Certification Specifications are only recommended guidelines and compliance is not mandatory.
On February 22, 2023, the CAC issued the Measures for the Standard Contract for Cross-Border Transfer of Personal Information, or the Standard Contract Measures, along with the formal version of the standard contractual clauses for cross-border transfer of personal information stipulated under the Personal Information Protection Law. The Standard Contract Measures came into effect on June 1, 2023, and provide a six-month grace period. It specifies the applicable scope of, conditions to enter into and detailed filing requirements for standard contracts on cross-border transfer of personal information, which become a part of the compliance mechanism for personal information protection. Any violation of the Standard Contract Measures shall be punished in accordance with the Personal Information Protection Law and other laws and regulations. The Personal Information Protection Law provides punishment measures such as ordering corrections, warnings, etc. which would be applied based on the severity of the violation. On March 22, 2024, the CAC promulgated Personal Information Export Standard Contract Filing Guidelines (Second Edition), which is to match the Provisions on Promoting and Regulating Cross-border Data Transfer promulgated on the same day. Personal Information Export Standard Contract Filing Guidelines (Second Edition) further clarify the applicable scope of, conditions to enter into and detailed filing requirements for standard contracts on cross-border transfer of personal information. In December 2023, the Implementing Guidelines for Contracts on Cross-border Flow of Personal Information in the Guangdong-Hong Kong-Macau Greater Bay Area (Mainland, Hong Kong) jointly formulated by the CAC and the Innovation, Technology and
Industry Bureau of Hong Kong, provides that the personal information processors and recipients of the Guangdong-Hong Kong-Macau Greater Bay Area ("GBA") may, in accordance with the requirements of the Implementing Guidelines, carry out the cross-border flow of personal information between the Mainland and Hong Kong within the GBA by entering into a standard contract, except for personal information notified by the relevant authorities or regions or publicly announced as important data.
Interpretation, application and enforcement of these laws, rules and regulations evolve from time to time and their scope may continually change, through new legislation, amendments to existing legislation or changes in enforcement. Compliance with such laws, rules and regulations could significantly increase the cost of our operations, require significant changes to our operations or even prevent us from operating in jurisdictions in which we currently operate or in which we may operate in the future. Despite our efforts to comply with applicable laws, rules, regulations and other obligations relating to privacy, data protection and information security, it is possible our operations could fail to meet all of the requirements imposed on us. Any failure on our part to comply, or any compromise of security that results in unauthorized access, use or release of personal information or other data, or the perception or allegation that any failure or compromise has occurred, could damage our reputation, discourage new and existing partners, vendors or other parties from contracting with us or result in investigations, fines, suspension or other penalties by governmental authorities and private claims or litigation, any of which could materially adversely affect our business, financial condition and results of operations. Even if our operations are not subject to legal challenge, the perception of privacy concerns, whether or not valid, may harm our reputation and adversely affect our business, financial condition and results of operations. Moreover, the legal uncertainty created by such laws, rules and regulations and the recent PRC government actions could materially adversely affect our ability to raise capital, or to do so on favorable terms, including engaging in public or private equity or debt financings in the U.S. market.
Our PRC subsidiaries have obtained all necessary licenses and approvals to conduct our operations in the PRC and, to date, no application for any such licenses and approvals has been denied. If we fail to receive any requisite permission or approval from the CSRC, CAC or other PRC regulatory authorities for any offering of our securities or the continued listing of our securities on a U.S. stock exchange or for our operations, or obtain the waiver of such permission or approval, in a timely manner, or at all, or wrongly conclude that such permissions or approvals are not required, or if applicable laws, regulations, or interpretations change and obligate us to obtain such permission or approvals in the future, we may be subject to fines and penalties, suspension or limitations on our business activities in the PRC, revocation of our business licenses, website closure, delay or restrictions on the contribution of proceeds from any offering into the PRC, or other sanctions that could have a material adverse effect on our business, financial condition, results of operations, reputation and prospects.