On December 28, 2021, 13 governmental departments of the PRC, including the CAC, jointly promulgated the Cybersecurity Review Measures, which became effective on February 15, 2022. The Cybersecurity Review Measures provide that, in addition to critical information infrastructure operators ("CIIOs") that intend to purchase Internet products and services, net platform operators engaging in data processing activities that affect or may affect national security must be subject to cybersecurity review by the Cybersecurity Review Office of the PRC. According to the Cybersecurity Review Measures, a cybersecurity review assesses potential national security risks that may be brought about by any procurement, data processing, or overseas listing. The Cybersecurity Review Measures require that an online platform operator which possesses the personal information of at least one million users must apply for a cybersecurity review by the CAC if it intends to be listed in foreign countries.
The Regulations on the Administration of Cyber Data Security (the "Data Security Regulations") was promulgated by SCNPC on September 24, 2024 and took effect on January 1, 2025. According to the Data Security Regulations, data processors shall, in accordance with relevant state provisions, apply for cybersecurity review when carrying out the following activities: (i) the merger, reorganization, or separation of internet platform operators that have acquired a large number of data resources related to national security, economic development, or public interests, which affect or may affect national security; (ii) data processors that handle personal data of more than one million individuals intend to list on a foreign stock exchange; (iii) data processors intend to list on Hong Kong exchange, which affects or may affect national security; and (iv) other data processing activities that affect or may affect national security.
The PRC Data Security Law, which was promulgated by the Standing Committee of the National People's Congress (the "SCNPC") on June 10, 2021 and took effect on September 1, 2021, requires data collection to be conducted in a legitimate and proper manner, and stipulates that, for the purpose of data protection, data processing activities must be conducted based on data classification and hierarchical protection system for data security.
On August 20, 2021, the SCNPC promulgated the Personal Information Protection Law of the People's Republic of China, or the Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights and privacy protection and took effect on November 1, 2021.
In addition, the PRC regulatory authorities have taken steps to strengthen the regulations on data protection and conducted several rounds of relevant inspections. The Rules on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications, which came into effect on May 1, 2021 (the "Necessary Personal Information Rules"), require that the operators of mobile apps shall not deny the users who do not consent to the collection of unnecessary personal information from using the basic functions and services of such apps. In addition, under the Necessary Personal Information Rules, "necessary personal information" refers to personal information necessary for ensuring the normal operation of an app's basic functional services. The basic functional services of the operating entities' apps are providing instant messaging services through texts, pictures, voice, and video, where the necessary personal information includes mobile phone numbers and account numbers of registered users and lists of accounts of instant messaging contact persons.
As advised by our PRC legal counsel, AllBright Law Offices (Fuzhou), neither we nor the operating entities are subject to cybersecurity review by the CAC, since neither we nor the operating entities currently have over one million users' personal information and do not anticipate that we will be collecting over one million users' personal information in the foreseeable future, which we understand might otherwise subject us to the Cybersecurity Review Measures. As of the date of this annual report, we have not received any notice from any authorities identifying the operating entities as CIIOs or requiring us or the operating entities to undergo a cybersecurity review or network data security review by the CAC.
There remains uncertainty as to how the Cybersecurity Review Measures and the Data Security Regulations will be interpreted or implemented and whether the PRC regulatory agencies, including the CAC, may adopt new laws, regulations, rules, or detailed implementation and interpretation related to the Cybersecurity Review Measures and the Data Security Regulations. If any such new laws, regulations, rules, or implementation and interpretation come into effect, we will take all reasonable measures and actions to comply and to minimize the adverse effect of such laws on us. Furthermore, many specific requirements of the Personal Information Protection Law and other laws related to data securities remain to be clarified by the CAC, other regulatory authorities, and the courts, for practical application. We may be required to adjust business practices to comply with the personal information protection laws and regulations. There is no assurance that PRC regulatory agencies, including the CAC, would take the same view as we do, and there is no assurance that we can fully or timely comply with such laws should they be deemed to be applicable to the operations of the operating entities. There is no certainty as to how such review or prescribed actions would impact such operations and we cannot guarantee that any clearance can be obtained, or maintained, if approved, or any actions that may be required can be taken in a timely manner, or at all.