We may become subject to a variety of laws and regulations in the PRC regarding privacy, data security, cybersecurity, and data protection. These laws and regulations are continuously evolving and developing. The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, particularly with respect to foreign laws. In particular, there are numerous laws and regulations regarding privacy and the collection, sharing, use, processing, disclosure, and protection of personal information and other user data. Such laws and regulations often vary in scope, may be subject to differing interpretations, and may be inconsistent among different jurisdictions.
We expect to obtain information about various aspects of our operations as well as regarding our employees and third parties. The integrity and protection of our customers, employees and company data is critical to our business. Our customers, end users and employees expect that we will adequately protect their personal information. We are required by applicable laws to keep strictly confidential the personal information that we collect, and to take adequate security measures to safeguard such information.
The PRC Criminal Law, as amended by its Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits institutions, companies and their employees from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services or obtaining such information through theft or other illegal ways.
The Civil Code of the PRC (issued by the PRC National People's Congress on May 28, 2020 and effective from January 1, 2021) provides main legal basis for privacy and personal information infringement claims under the Chinese civil laws. PRC regulators, including the CAC, Ministry of Industry and Information Technology ("MIIT"), and the Ministry of Public Security have been increasingly focused on regulation in the areas of data security and data protection.
The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various regulatory bodies in China, including the CAC, the Ministry of Public Security and the Trademark Office of the State Administration for Market Regulation ("SAMR"), have enforced data privacy and protection laws and regulations with varying and evolving standards and interpretations.
In November 2016, the Standing Committee of China's National People's Congress passed China's first Cybersecurity Law ("CSL"), which became effective in June 2017. The CSL is the first PRC law that systematically lays out the regulatory requirements on cybersecurity and data protection, subjecting many previously under-regulated or unregulated activities in cyberspace to government scrutiny. The legal consequences of violation of the CSL include penalties of warning, confiscation of illegal income, suspension of related business, winding up for rectification, shutting down the websites, and revocation of business license or relevant permits. In April 2020, the CAC and certain other PRC regulatory authorities promulgated the Cybersecurity Review Measures (2020), which became effective in June 2020. Pursuant to the Cybersecurity Review Measures (2020), operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security.
On June 10, 2021, the Standing Committee of the National People's Congress ("SCNPC") promulgated the PRC Data Security Law, which took effect on September 1, 2021. The Data Security Law also sets forth the data security protection obligations for entities and individuals handling personal data, including that no entity or individual may acquire such data by stealing or other illegal means, and the collection and use of such data should not exceed the necessary limits.
On November 14, 2021, the CAC published the Regulations on Network Data Security (draft for public comments), or the draft Regulations on Network Data Security, which reiterate that data processors that process the personal information of more than one million users and intend to list overseas should apply for a cybersecurity review. In addition, data processors that process important data or are listed overseas shall carry out an annual data security assessment on their own or by engaging a data security services institution, and the data security assessment report for the prior year should be submitted to the local cyberspace affairs administration department before January 31 of each year. Currently, the draft Regulations on Network Data Security has been released for public comment only, and its implementation provisions and anticipated adoption or effective date remains substantially uncertain and may be subject to change.
On December 28, 2021, the CAC issued the Cybersecurity Review Measures (2021), which replaced the Cybersecurity Review Measures (2020) and took into effect on February 15, 2022. The Cybersecurity Review Measures (2021) required that, in addition to "operator of critical information infrastructure," any "operator of internet platform" carrying out data processing activities that affect or may affect national security should also be subject to cybersecurity review, and further elaborated the factors to be considered when assessing the national security risks of the relevant activities, including, among others, (i) the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the country; and (ii) the risk of critical information infrastructure, core data, important data or a large amount of personal information being affected, controlled, or maliciously used by foreign governments after listing abroad. The CAC has said that under the Cybersecurity Review Measures (2021), operators of internet platforms holding data on more than 1,000,000 users must now apply for cybersecurity approval when seeking listings in other nations because of the risk that such data and personal information could be "affected, controlled, and maliciously exploited by foreign governments." The cybersecurity review will also investigate the potential national security risks from overseas IPOs. Given the recency of the issuance of the Cybersecurity Review Measures (2021), there is a general lack of guidance and substantial uncertainties exist with respect to their interpretation and implementation. For example, it is unclear whether the requirement of cybersecurity review applies to follow-on offerings by an "online platform operator" that is in possession of personal data of more than one million users where the offshore holding company of such operator is already listed overseas. We do not know what regulations will be adopted or how such regulations will affect we and our listing on Nasdaq. In the event that the CAC determines that we are subject to these regulations, we may be required to delist from Nasdaq and we may be subject to fines and penalties.
We are not subject to the cybersecurity review by the CAC, given that: (i) we do not possess a large amount of personal information in our business operations and (ii) data processed in our business does not have a bearing on national security and thus may not be classified as core or important data by the authorities. However, there remains uncertainty as to how the Cybersecurity Review Measures (2021) will be interpreted or implemented and whether the PRC regulatory agencies, including the CAC, may adopt new laws, regulations, rules, or detailed implementation and interpretation related to the Cybersecurity Review Measures (2021). If any such new laws, regulations, rules, or implementation and interpretation comes into effect, we will take all reasonable measures and actions to comply and to minimize the adverse effect of such laws on us.
On August 20, 2021, SCNPC approved the Personal Information Protection Law ("PIPL"), which became effective on November 1, 2021. The PIPL regulates collection of personal identifiable information and seeks to address the issue of algorithmic discrimination. Companies in violation of the PIPL may be subject to warnings and admonishments, forced corrections, confiscation of corresponding income, suspension of related services, and fines. We mainly interact with corporate clients and has limited direct interactions with individual customers, which means our potential access or exposure to customers' personal identifiable information is limited. However, in the event we inadvertently access or become exposed to end-users' personal identifiable information, through our corporate clients' end-user-facing applications which access or store end users' personal identifiable information, then we may face heightened exposure to the PIPL.
We cannot assure you that PRC regulatory agencies, including the CAC, would take the same view as we do, and there is no assurance that we can fully or timely comply with such laws. In the event that we are subject to any mandatory cybersecurity review and other specific actions required by the CAC, we face uncertainty as to whether any clearance or other required actions can be timely completed, or at all. Given such uncertainty, we may be further required to suspend our relevant business, shut down our website, or face other penalties, which could materially and adversely affect our business, financial condition, and results of operations.
As of the date of this annual report, our three Hong Kong subsidiaries have not collected, stored, or managed any personal information in Hong Kong. Therefore, we concluded that currently we do not expect that laws and regulations in mainland China on data security, data protection, or cybersecurity to be applied to our Hong Kong subsidiaries or that the oversight of the CAC will be extended to its operations outside of mainland China. In Hong Kong, the Personal Data (Privacy) Ordinance (Cap. 486 of Hong Kong), or the PDPO, applies to data users, that control the collection, holding, processing or use of personal data in Hong Kong. Our Hong Kong subsidiaries are subject to the general requirements under PDPO including the need to obtain the prescribed consent of the data subject and to take all practicable steps to protect the personal data held by data users against unauthorized or accidental access, loss or use. Breaches of the PDPO may lead to a variety of civil and criminal sanctions including fines and imprisonment. In addition, data subjects have a right to bring proceedings in court to seek compensation for damage. We cannot guarantee that we are, or will be, in compliance with all applicable international regulations as they are enforced now or as they evolve.