Even though, currently, we are not subject to PRC laws relating to the collection, use, sharing, retention, security, and transfer of confidential and private information, such as personal information and other data, these laws continue to develop, and the PRC government may adopt other rules and restrictions in the future. Non-compliance could result in penalties or other significant legal liabilities.
The Cybersecurity Law, which was adopted by the National People's Congress on November 7, 2016 and came into force on June 1, 2017, and the Cybersecurity Review Measures, or the "Review Measures," which were promulgated on April 13, 2020, provide that personal information and important data collected and generated by a critical information infrastructure operator in the course of its operations in China must be stored in China, and if a critical information infrastructure operator purchases internet products and services that affect or may affect national security, it should be subject to cybersecurity review by the CAC. In addition, a cybersecurity review is required where critical information infrastructure operators, or the "CIIOs," purchase network-related products and services, which products and services affect or may affect national security. Due to the lack of further interpretations, the exact scope of what constitute a "CIIO" remains unclear. Further, the PRC government authorities may have wide discretion in the interpretation and enforcement of these laws.
On June 10, 2021, the Standing Committee of the National People's Congress promulgated the Data Security Law which took effect on September 1, 2021. The Data Security Law requires that data shall not be collected by theft or other illegal means, and it also provides that a data classification and hierarchical protection system. The data classification and hierarchical protection system protects data according to its importance in economic and social development, and the damages it may cause to national security, public interests, or the legitimate rights and interests of individuals and organizations if the data is falsified, damaged, disclosed, illegally obtained or illegally used, which protection system is expected to be built by the state for data security in the near future. In addition, the Office of the Central Cyberspace Affairs Commission and the Office of Cybersecurity Review under the CAC, published the Cybersecurity Review Measures (Revised Draft for Comments), or the "Review Measures Draft," on July 10, 2021, which provides that, aside from CIIOs that intend to purchase internet products and services, data processing operators engaging in data processing activities that affect or may affect national security must be subject to the cybersecurity review by the Cybersecurity Review Office. According to the Review Measures Draft, a cybersecurity review is conducted by the CAC, to assess potential national security risks that may be brought about by any procurement, data processing, or overseas listing. According to the latest amended Cybersecurity Review Measures, which was promulgated on December 28, 2021 and became effective on February 15, 2022, and replaced the Cybersecurity Review Measures promulgated on April 13, 2020, online platform operators holding more than one million users/users' individual information shall be subject to cybersecurity review before listing abroad. Since the Cybersecurity Review Measures is new, the implementation and interpretation thereof is not yet clear. As of the date of this Annual Report, we have not been informed by any PRC governmental authority of any requirement that we file for approval for the initial offering.
On July 7, 2022, the CAC promulgated the Security Assessment Measures for Outbound Data Transfers which became effective on September 1, 2022. The Security Assessment Measures for Outbound Data Transfers requires that a data processor to declare security assessment for its outbound data transfer to the competent authority of cyberspace administration through the local cyberspace administration at the provincial level, in the circumstances where (1) the data processor provides important data abroad; (2) the critical information infrastructure operator or the data processor processing the personal information of more than one million people provides personal information abroad; (3) the data processor that has provided the personal information of over 100,000 individuals or the sensitive personal information of over 10,000 individuals cumulatively since January 1 of the previous year or (4) other circumstances prescribed by the CAC for which declaration for security assessment for outbound data transfers is require. Since the Security Assessment Measures for Outbound Data Transfers became into force very recently, the "other circumstances" thereof are not yet clear. The "important data" under the Security Assessment Measures for Outbound Data Transfers refers to any data that, once tampered with, destroyed, leaked, illegally obtained or illegally used, may endanger national security, economic operation, social stability, public health and security, etc.
As the PRC operating entities' business is engaged in CRF profile manufacturing in China and do not engage in any operation of information in infrastructure or involve the collection of personal data of at least 1,000,000 users, or implicate cybersecurity, do not involve the process of more than 1,000,000 individual's personal information, have not provided over 100,000 individual's personal information or over 10,000 individual's sensitive personal information since January 1 of the last years abroad, and have not involved the "important data" under the Security Assessment Measures for Outbound Data Transfer. Therefore, we believe that we, our subsidiaries, or the VIE are not subject to the cybersecurity review of the CAC under the Cybersecurity Review Measure and the security assessment of outbound data transfer under the Security Assessment Measures for Outbound Data Transfers. As of the date of this Annual Report, we have not received any notice from any authorities identifying us as a CIIO or requiring us to undertake a cybersecurity review by the CAC. Further, we have not been subject to any penalties, fines, suspensions, investigations from any competent authorities for violation of the regulations or policies that have been issued by the CAC to date. However, there remains uncertainty as to how the Cybersecurity Review Measure will be interpreted or implemented and whether the PRC regulatory agencies, including the CAC, may adopt new laws, regulations, rules, or detailed implementation and interpretation related to the Cybersecurity Review Measure. If any such new laws, regulations, rules, or implementation and interpretation come into effect, we expect to take all reasonable measures and actions to comply. We cannot assure you that PRC regulatory agencies, including the CAC, would take the same view as we do, and there is no assurance that we can fully or timely comply with such laws should they be deemed applicable to our operations. There is no certainty as to how such review or prescribed actions would impact our operations and we cannot guarantee that any clearance can be obtained or any actions that may be required for our listing on the Nasdaq capital market and the offering as well can be taken in a timely manner, or at all.