The PRC Criminal Law, as amended by its Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits institutions, companies and their employees from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services, or obtaining such information through theft or other illegal means. On November 7, 2016, the Standing Committee of the National People's Congress of the PRC issued the Cyber Security Law of the PRC, or Cyber Security Law, which became effective on June 1, 2017. Pursuant to the Cyber Security Law, network operators must not collect users' personal information without their consent and may only collect users' personal information necessary to the provision of services. Providers are also obliged to provide security maintenance for their products and services and shall comply with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations. The Civil Code of the PRC (issued by the National People's Congress of the PRC on May 28, 2020 and effective from January 1, 2021) provides the main legal basis for privacy and personal information infringement claims under PRC civil law. On September 1, 2021, the PRC Data Security Law came into effect. The Data Security Law, among other things, provides for a security review procedure for the data activities that may affect national security. On November 1, 2021, the Personal Information Protection Law came into effect. The Personal Information Protection Law requires, among other things, that the processing of personal information should have a specific and reasonable purpose, and must be conducted in a way that has the least impact on personal rights and interests, and should be limited to the minimum scope necessary to achieve the processing purpose.
PRC regulators, including the Cyberspace Administration of China (the "CAC"), the Ministry of Industry and Information Technology and the Ministry of Public Security, have been increasingly focused on regulation in areas of data security and data protection. The PRC regulatory requirements regarding cybersecurity are constantly evolving. For example, various PRC regulatory bodies, including the CAC, the Ministry of Public Security and the State Administration for Market Regulation ("SAMR"), have enforced data privacy and protection laws and regulations with varying and evolving standards and interpretations.
In April 2020, the PRC government promulgated the 2020 Cybersecurity Review Measures, which came into effect on June 1, 2020. In July 2021, the CAC and other related authorities released a draft amendment to the 2020 Cybersecurity Review Measures for public comments. On December 28, 2021, the PRC government promulgated the 2022 Cybersecurity Review Measures, which came into effect and replaced the 2020 Cybersecurity Review Measures on February 15, 2022. According to the 2022 Cybersecurity Review Measures, (i) critical information infrastructure operators that purchase network products and services and internet platform operators that conduct data processing activities shall be subject to cybersecurity review in accordance with the 2022 Cybersecurity Review Measures if such activities affect or may affect national security; and (ii) internet platform operators holding personal information of more than one million users and seeking to have their securities list on a stock exchange in a foreign country shall file for cybersecurity review with the Cybersecurity Review Office. Under the Regulation on Protecting the Security of Critical Information Infrastructure promulgated by the State Council on July 30, 2021, effective September 1, 2021, "critical information infrastructure" is defined as important network facilities and information systems in important industries and fields, such as public telecommunication and information services, energy, transportation, water conservancy, finance, public services, e-government and national defense, science, technology and industry, as well as other important network facilities and information systems that, in case of destruction, loss of function or leak of data, may severely damage national security, the national economy and the people's livelihood and public interests. As of the date of this Annual Report, neither we nor any of our PRC Subsidiaries has been informed by any PRC governmental authority that we or any of our PRC Subsidiaries is a "critical information infrastructure operator."
On November 14, 2021, the CAC released the Administrative Regulations on the Management of Network Data Security (Draft for comments) or the Draft Administrative Regulation. Under the Draft Administrative Regulation, (i) data processors, i.e., individuals and organizations who can decide on the purpose and method of their data processing activities at their own discretion, that process personal information of more than one million individuals shall apply for cybersecurity review before listing in a foreign country; (ii) foreign- listed data processors shall carry out annual data security evaluation and submit the evaluation report to the municipal cyberspace administration authority; and (iii) where the data processor undergoes merger, reorganization and subdivision that involves important data and personal information of more than one million individuals, the recipient of the data shall report the transaction to the in-charge authority at the municipal level.
According to the currently in-effect PRC laws and regulations, we believe that neither we nor any of our PRC Subsidiaries is subject to the cybersecurity review, reporting or other permission requirements by the CAC under the applicable PRC cybersecurity laws and regulations with respect to the offering of our securities or the business operations of our PRC Subsidiaries, because neither we nor any of our PRC Subsidiaries qualifies as a critical information infrastructure operator or has conducted any data processing activities that affect or may affect national security or holds personal information of more than one million users. Additionally, as of the date of this Annual Report, neither we nor any of our PRC Subsidiaries has been required by any PRC governmental authority to apply for cybersecurity review, nor have we or any of our PRC Subsidiaries received any inquiry, notice, warning, sanction in such respect or been denied permission from any PRC regulatory authority to list on U.S. exchanges. However, as PRC governmental authorities have significant discretion in interpreting and implementing statutory provisions and there remains significant uncertainty in the interpretation and enforcement of relevant PRC cybersecurity laws and regulations if the PRC regulatory authorities take a position contrary to ours, we cannot assure you that we or any of our PRC Subsidiaries will not be deemed to be subject to PRC cybersecurity review requirements under the 2022 Cybersecurity Review Measures or the Draft Administrative Regulations (if enacted), nor can we assure you that we or our PRC Subsidiaries would be able to pass such review. If we or any of our PRC Subsidiaries fails to receive any requisite permission or approval from the CAC for future offerings or the business operations of our PRC Subsidiaries, or the waiver for such permission or approval, in a timely manner, or at all, or inadvertently concludes that such permission or approval is not required, or if applicable laws, regulations or interpretations change and obligate us to obtain such permission or approvals in the future, we or our PRC Subsidiaries may be subject to fines, suspension of business, website closure, revocation of business licenses or other penalties, as well as reputational damage or legal proceedings or actions against us, which may have a material adverse effect on our business, financial condition or results of operations. In addition, we could become subject to enhanced cybersecurity review or investigations launched by PRC regulators in the future pursuant to new laws, regulations or policies.
As of the date of this Annual Report, we have not been involved in any investigations or become subject to a cybersecurity review initiated by the CAC, and we have not received any inquiry, notice, warning, sanctions in such respect or any regulatory objections with respect to our business operations or in connection with future offerings from the CAC. However, as the Cybersecurity Review Measures and the Draft Administrative Regulation were newly issued, there remain uncertainties as to how it would be interpreted and enforced, and to what extent it may affect us.