Shanghai Xianzhui may become subject to a variety of laws and regulations in the PRC regarding privacy, data security, cybersecurity, and data protection. These laws and regulations are continuously evolving and developing. The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, particularly with respect to foreign laws. In particular, there are numerous laws and regulations regarding privacy and the collection, sharing, use, processing, disclosure, and protection of personal information and other user data. Such laws and regulations often vary in scope, may be subject to differing interpretations, and may be inconsistent among different jurisdictions.
We expect to obtain information about various aspects of our operations as well as regarding our employees and third parties. We also maintain information about various aspects of our operations as well as regarding our employees. The integrity and protection of our customer, employee and company data is critical to our business. Our customers and employees expect that we will adequately protect their personal information. We are required by applicable laws to keep strictly confidential the personal information that we collect, and to take adequate security measures to safeguard such information.
The PRC Criminal Law, as amended by its Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits institutions, companies and their employees from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services or obtaining such information through theft or other illegal ways. On November 7, 2016, the Standing Committee of the PRC National People's Congress issued the Cyber Security Law of the PRC, or Cyber Security Law, which became effective on June 1, 2017.
Pursuant to the Cyber Security Law, network operators must not, without users' consent, collect their personal information, and may only collect users' personal information necessary to provide their services. Providers are also obliged to provide security maintenance for their products and services and shall comply with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations.
The Civil Code of the PRC (issued by the PRC National People's Congress on May 28, 2020 and effective from January 1, 2021) provides main legal basis for privacy and personal information infringement claims under the Chinese civil laws. PRC regulators, including the CAC, MIIT, and the Ministry of Public Security have been increasingly focused on regulation in the areas of data security and data protection.
The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various regulatory bodies in China, including the CAC, the Ministry of Public Security and the SAMR, have enforced data privacy and protection laws and regulations with varying and evolving standards and interpretations. In April 2020, the Chinese government promulgated Cybersecurity Review Measures, which came into effect on June 1, 2020. According to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security.
In November 2016, the Standing Committee of China's National People's Congress passed China's first Cybersecurity Law ("CSL"), which became effective in June 2017. The CSL is the first PRC law that systematically lays out the regulatory requirements on cybersecurity and data protection, subjecting many previously under-regulated or unregulated activities in cyberspace to government scrutiny. The legal consequences of violation of the CSL include penalties of warning, confiscation of illegal income, suspension of related business, winding up for rectification, shutting down the websites, and revocation of business license or relevant permits. In April 2020, the CAC and certain other PRC regulatory authorities promulgated the Cybersecurity Review Measures, which became effective in June 2020. Pursuant to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security. On June 10, 2021, the Standing Committee of the NPC promulgated the PRC Data Security Law, which took effect on September 1, 2021. The Data Security Law also sets forth the data security protection obligations for entities and individuals handling personal data, including that no entity or individual may acquire such data by stealing or other illegal means, and the collection and use of such data should not exceed the necessary limits The costs of compliance with, and other burdens imposed by, CSL and any other cybersecurity and related laws may limit the use and adoption of our products and services and could have an adverse impact on our business. On January 4, 2022, thirteen PRC regulatory agencies, namely, the CAC, the NDRC, the Ministry of Industry and Information Technology, the Ministry of Public Security, the Ministry of State Security, the MOF, MOFCOM, SAMR, CSRC, the People's Bank of China, the National Radio and Television Administration, National Administration of State Secrets Protection and the National Cryptography Administration, jointly adopted and published the Measures for Cybersecurity Review (2021), which became effective on February 15, 2022. The Measures for Cybersecurity Review (2021) required that, among others, in addition to "operator of critical information infrastructure" any "operator of network platform" holding personal information of more than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review.
On July 10, 2021, the CAC issued a revised draft of the Measures for Cybersecurity Review for public comments (the "Review Measures"), and on December 28, 2021, the CAC jointly with the relevant authorities published Measures for Cybersecurity Review (2021) which took effect on February 15, 2022 and replace the Review Measures, which required that, operators of critical information infrastructure purchasing network products and services, and data processors (together with the operators of critical information infrastructure, the "Operators") carrying out data processing activities that affect or may affect national security, shall conduct a cybersecurity review, any operator who controls more than one million users' personal information must go through a cybersecurity review by the cybersecurity review office if it seeks to be listed in a foreign country. We do not know what regulations will be adopted or how such regulations will affect us and our listing on Nasdaq. In the event that the CAC determines that we are subject to these regulations, we may be required to delist from Nasdaq and we may be subject to fines and penalties.
Under the Data Security Law enacted on September 1, 2021 and the Measures for Cybersecurity Review (2021) implemented on February 15, 2022, given that (i) Shanghai Xianzhui is not an Operator, (ii) Shanghai Xianzhui does not possess more than one million users' personal information, and (iii) data processed in Shanghai Xianzhui's business does not have a bearing on national security and thus may not be classified as core or important data by the authorities. However, if the CSRC, CAC or other regulatory agencies later promulgate new rules or explanations requiring that we obtain their approvals for any follow-on offering, we may be unable to obtain such approvals and we may face sanctions by the CSRC, CAC or other PRC regulatory agencies for failure to seek their approval which could significantly limit or completely hinder our ability to offer or continue to offer securities to our investors and the securities currently being offered may substantially decline in value and be worthless.
We cannot assure you that PRC regulatory agencies, including the CAC, would take the same view as we do, and there is no assurance that we can fully or timely comply with such laws. In the event that we are subject to any mandatory cybersecurity review and other specific actions required by the CAC, we face uncertainty as to whether any clearance or other required actions can be timely completed, or at all. Given such uncertainty, we may be further required to suspend our relevant business, shut down our website, or face other penalties, which could materially and adversely affect our business, financial condition, and results of operations.