Our business collects, generates and processes a large amount of data. We face risks inherent in handling and protecting them. Concerns about the collection, use, or security of personal information or other privacy-related matters, even for those without merit, could damage our reputation, cause us to lose users and adversely affect our business and results of operations. In particular, we face a number of challenges relating to data from transactions and other activities on our app and mini programs, including:
- protecting the data in and hosted on our system, including against attacks on our system by outside parties or fraudulent behavior by our employees;- addressing concerns related to privacy and safety, security and other factors; and - complying with applicable laws, rules and regulations relating to the collection, use, disclosure or security of personal information, including any requests from regulatory and government authorities relating to such data.
We are required by privacy and data protection laws in China and other jurisdictions, including, without limitation, the PRC Cybersecurity Law, the PRC Data Security Law and Personal Information Protection Law, to ensure the confidentiality, integrity and availability of the information of our users, members, and suppliers, which is also essential to maintaining their confidence in our services. However, the interpretation and implementation of such laws in mainland China and elsewhere are often uncertain and in flux.
In November 2016, the Standing Committee of the National People's Congress promulgated the PRC Cybersecurity Law, which provides that network operators must meet their cybersecurity obligations and must take technical measures and other necessary measures to protect the safety and stability of their networks. Although we only gain access to user information that is necessary for, and relevant to, the services provided, the data we obtain and use may include information that is deemed as "personal information" under the PRC Cybersecurity Law and related data privacy and protection laws and regulations. See "Item 4. Information on the Company-B. Business Overview-Regulation-Regulations Relating to Internet Privacy." In addition, on June 10, 2021, the Standing Committee of the National People's Congress promulgated the PRC Data Security Law, which took effect on September 1, 2021. The PRC Data Security Law provides for a data security review procedure for the data processing activities that affect or may affect national security. It also imposes data security obligations on persons and entities conducting data processing activities and requires data processors to take necessary measures to protect data security. Furthermore, on August 20, 2021, the Standing Committee of the National People's Congress issued the Personal Information Protection Law, which provides the basic regime for personal information protection and sets forth detailed obligations and responsibilities for personal information handlers in their collecting and processing personal information. Although we follow our long-standing policy that is to only access and process users' personal information that is necessary for, and relevant to provision of our services and we update our privacy policies and practices from time to time for compliance with regulatory developments, we may be required to make further adjustments to our data processing practices as the PRC Data Security Law and PRC Personal Information Protection Law are newly promulgated and the interpretation of many of their specific requirements remain to be clarified by the government authorities or is otherwise subject to uncertainties.
While we take measures to comply with all applicable data privacy and protection laws and regulations, we cannot guarantee the effectiveness of the measures undertaken by us and our business partners. The activities of third parties, such as our users, suppliers, and other business partners are beyond our control. If any of these parties violate the applicable data privacy and protection and related laws and regulations, or fail to fully comply with the service agreements with us, or if any of our employees fails to comply with our internal control measures and misuses the information, we may be subject to regulatory actions. Any failure or perceived failure to comply with all applicable data privacy and protection laws and regulations, or any failure or perceived failure of our business partners to do so, or any failure or perceived failure of our employees to comply with our internal control measures, may result in negative publicity and legal proceedings or regulatory actions against us, and could damage our reputation, discourage current and potential users and business partners from using our services and subject us to claims, fines, and damages, which could have a material adverse effect on our business and results of operations.
New laws or regulations concerning data protection, or the interpretation and implementation of existing data security and privacy protection laws or regulations may be announced, published for public consultations, issued, or promulgated from time to time on November 14, 2021, the CAC published the Regulations on the Administration of Cyber Data Security (Draft for Comments), or the Draft Cyber Data Regulations. The Draft Cyber Data Regulations provides that data processor conducting the following activities shall apply for conducting the following activities shall apply for cybersecurity review: (i) merger, reorganization, or division of internet platform operators that have acquired a large number of data resources related to national security, economic development, or public interests, which affects or may affect national security; (ii) a foreign listing by a data processor processing personal information of over one million users; (iii) a listing in Hong Kong which affects or may affect national security; or (iv) other data processing activities that affect or may affect national security. As of the date of this annual report, there has been no further clarifications from the authorities as to the standards for determining such activities that "affects or may affect national security." The period for which the CAC solicited comments on the Draft Cyber Data Regulations ended on December 13, 2021, but there is no timetable as to when the draft regulations will be enacted. As such, substantial uncertainties exist with respect to the enactment timetable, final content, interpretation, and implementation of the Draft Cyber Data Regulations. As of the date of this annual report, the Draft Cyber Data Regulations is still in draft form and has not come into force.
As at the date of this annual report, we believe we are compliant with the requirements under applicable regulations and policies that have been issued by the CAC to date, on the basis that (i) we have established a comprehensive security system, supported by our risk management system that spans from the individual end users across our entire network, covering our mobile app and mini-programs, data, services, our internal office, and R&D environments. we have established internal rules, policies and protocols covering cybersecurity, data security and personal information protection according to applicable laws and standards, to provide clear guidance on the safeguards of our network, the business data and personal information originated, collected and processed by us during our operation and govern how we may access and use such data, (ii) we adopted organizational and technical measures to ensure the security of such data against unauthorized access, disclosure, leakage, or tempering, (iii) we have established internal management bodies responsible for information security, data security and personal information protection respectively in accordance with the requirements of applicable laws and regulations and have appointed persons in charge of those matters,(iv) we had not been subject to any fines or other penalties due to non-compliance with data privacy and security laws or regulations; and (v) we maintain good communication and interaction with the relevant regulators in this regard.
New laws or regulations concerning data protection and cyber security, or the interpretation and implementation of such new laws or regulations, which is often uncertain and in flux, may be inconsistent with our practices. The introduction of new products or other actions that we may take may subject us to additional laws, regulations, or other government scrutiny. Complying with new laws and regulations could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business. We continue to closely monitor and assess further developments regarding laws and regulations on cybersecurity, data security and protection of personal information, particularly those laws and regulations issued by CAC and be prepared to comply with the newly issued regulatory requirements.