We are subject to laws in China relating to the collection, use, sharing, retention, security and transfer of confidential and private information, such as personal information and other data. These laws are continuing to develop, and the PRC government may adopt other rules and restrictions in the future. Non-compliance could result in penalties or other significant legal liabilities.
According to the Cybersecurity Law of the People's Republic of China, or Cybersecurity Law, which was promulgated by the National People's Congress Standing Committee on November 7, 2016, and took effect on June 1, 2017, we, as a network operator, are obligated to provide technical assistance and support to public security and national security authorities in order to protect national security or assist with criminal investigations. In addition, the Cybersecurity Law provides that personal information and important data collected and generated by an operator of critical information infrastructure in the course of its operations in the PRC must be stored in the PRC. On September 12, 2022, the Cyberspace Administration of China, or the CAC, issued the Decision on Amending the Cybersecurity Law of the People's Republic of China (Draft for Comments), focusing on the following four aspects: (i) to improve the legal liability system for violating the general provisions on the security of cyber operation; (ii) to amend the legal liability system for the security protection of critical information infrastructure; (iii) to adjust the legal liability system for network information security; and (iv) to amend the legal liability system for the protection of personal information. As of the date of this annual report, the Cybersecurity Law of the People's Republic of China (Draft for Comments) has not been formally adopted.
On December 28, 2021, the CAC and other twelve PRC regulatory authorities jointly issued the Cybersecurity Review Measures, which became effective from February 15, 2022. The Cybersecurity Review Measures require that, (i) any procurement of network products and services by critical information infrastructure operators, which affects or may affect national security, (ii) any data processing activities by network platform operators, which affects or may affect national security, or (iii) any network platform operators, which has personal information of more than one million users and is going to be listed abroad, shall be subject to cybersecurity review.
In anticipation of the strengthened implementation of cybersecurity laws and regulations and the continued expansion of our business, we face potential risks if we are deemed as a "critical information infrastructure operator" or a "network platform operator" that affects or may affect national security under the Cybersecurity Review Measures and would be required to follow cybersecurity review procedures. During such review, we may be required to suspend new user registration in China and/or experience other disruptions of our operations. Furthermore, if we were found to be in violation of applicable laws and regulations of the PRC during such review, we could be subject to administrative penalties, such as warnings, fines, service suspension or removal of our apps from the relevant app stores. Therefore, cybersecurity review may have a material and adverse impact on our business, results of operations and financial condition. Since the measures were recently promulgated, there exists uncertainties with respect to their interpretation and implementation.
On June 10, 2021, the Standing Committee of the National People's Congress, or the SCNPC, promulgated the PRC Data Security Law, which has come into effect on September 1, 2021. The PRC Data Security Law imposes data security and privacy protection obligations on entities and individuals, which carry out data activities, and introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, and the degree of harm it might cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, illegally acquired or used. The PRC Data Security Law also provides a national security review procedure for data activities that may affect national security and imposes export restrictions on certain data and information.
On November 14, 2021 the CAC issued the Draft Data Security Regulations for public comments, pursuant to which, data processors carrying out the following activities must, in accordance with the relevant national regulations, apply for a cybersecurity review: (i) the merger, reorganization or spin-off of internet platform operators that possess a large number of data resources related to national security, economic development and public interests that affects or may affect national security; (ii) listing in a foreign country of data processors that process the personal information of more than one million users; (iii) listing in Hong Kong of data processors that affects or may affect national security; and (iv) other data processing activities that affect or may affect national security. The scope of and threshold for determining what "affects or may affect national security" is still subject to uncertainty and further elaboration by the CAC.
The Personal Information Protection Law, or the PIPL, was released by the National People's Congress Standing Committee on August 20, 2021 and became effective on November 1, 2021. The PIPL stipulates the scope of personal information and the ways of processing personal information, establishes rules for processing personal information and for transferring personal information offshore, and clarifies the individual's rights and the processor's obligations in the process of personal information. The PIPL applies to (i) the processing within the territory of the PRC of natural persons' personal information; or (ii) the processing outside the territory of the PRC over personal information of natural persons within the PRC, provided that such information is processed (x) for the purpose of providing products or services to domestic natural persons, (y) to analyze or assess the conduct of domestic natural persons, or (z) under any other circumstances as prescribed by laws and administrative regulations. The PIPL requires, among others, that (i) the processing of personal information should have a clear and reasonable purpose, which should be directly related to the processing purpose, in a method that has the least impact on personal rights and interests, and (ii) the collection of personal information should be limited to the minimum scope necessary to achieve the processing purpose to avoid the excessive collection of personal information.
On July 7, 2022, the CAC promulgated the Measures for the Security Assessment of Data Cross-border Transfer, which took effect on September 1, 2022. The Measures for the Security Assessment of Data Cross-border Transfer requires the data processor providing data overseas and falling under any of the following circumstances to apply for the security assessment of cross-border data transfer by the national cybersecurity authority through its local counterpart: (i) where the data processor intends to provide important data overseas; (ii) where the critical information infrastructure operator and any data processor who has processed personal information of more than 1,000,000 individuals intend to provide personal information overseas; (iii) where any data processor who has provided personal information of 100,000 individuals or sensitive personal information of 10,000 individuals to overseas recipients accumulatively since January 1 of the last year intends to provide personal information overseas; and (iv) other circumstances where the security assessment of data cross-border transfer is required as prescribed by the CAC. On February 24, 2023, the CAC promulgated the Measures for Standard Contracts for Cross-border Transfers of Personal Information, together with a template of such standard contract as an annex to the Measures, which took effect on June 1, 2023. Pursuant to the Measures, a personal information processor may enter into the Standard Contract and provide it along with the personal information protection impact assessment report to relevant governmental authorities for filing to ensure the legality of a cross-border transfer of personal information outside the territory of PRC if certain conditions are satisfied pursuant to the Measures. For the outbound transfer of personal information that has already happened before the Measures takes effect, if it is found that any such transfer is not in compliance with the Measures, rectification shall be completed within six months upon the effective date of the Measures. Failure to complete such rectification within the prescribed period may result in penalties imposed by the competent governmental authorities. On March 22, 2024, the CAC promulgated the Provisions on Promoting and Regulating Cross-border Data Flows, which further clarify the implementation rules of existing systems to facilitate the cross-border flow of data.
These newly promulgated laws and regulations reflect the PRC government's further attempts to strengthen the legal protection for national network security, data security and the security of personal information protection. These laws and regulations are relatively new, and therefore there are substantial uncertainties with respect to the interpretation and implementation. We may need to adjust our business to comply with these laws and regulations regarding network security, data security and personal information from time to time. We have been making constant efforts to comply with the Cybersecurity Review Measures and other data protection laws and regulations of the PRC. Our mobile apps and websites only collect basic user information, which are necessary for the provision of the corresponding services. We update our privacy policies and adjust our data processing practices from time to time to meet the latest regulatory requirements of CAC and other authorities and adopts technical and organizational measures to protect data and cybersecurity. We could be subject to investigations launched by PRC regulators in the future. Any failure or any other non-compliance with the related laws and regulations may result in fines or other administrative penalties, including suspension of business, website closure, removal of our app from app stores, and revocation of licenses, as well as reputational damage or legal proceedings or actions against us, which may have a material adverse effect on our business, financial condition or results of operations. In addition, our ability to continue to offer our ADSs to investors could be significantly limited or completed hindered, and the value of our ADSs could significantly decline or become worthless. As of the date of this annual report, we have not been involved in any cybersecurity review initiated by the CAC or other relevant governmental regulatory authorities, and we have not received any inquiry, notice, warning, or sanction in such respect. However, we cannot rule out the possibility that we may be subject to the cybersecurity review or other investigations initiated by the CAC or the related governmental regulatory authorities.