We may become subject to a variety of laws and regulations in the PRC regarding privacy, data security, cybersecurity, and data protection. These laws and regulations are continuously evolving and developing. The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, particularly with respect to foreign laws. In particular, there are numerous laws and regulations regarding privacy and the collection, sharing, use, processing, disclosure, and protection of personal information and other user data. Such laws and regulations often vary in scope, may be subject to differing interpretations, and may be inconsistent among different jurisdictions.
We expect to obtain information about various aspects of our operations as well as regarding our employees and third parties. We also maintain information about various aspects of our operations as well as regarding our employees. The integrity and protection of our customer, employee and company data is critical to our business. We do not collect personal information from our customers. Our employees expect that we will adequately protect their personal information. We are required by applicable laws to keep strictly confidential the personal information that we collect and to take adequate security measures to safeguard such information.
The PRC Criminal Law, as amended by its Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits institutions, companies and their employees from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services or obtaining such information through theft or other illegal ways. On November 7, 2016, the Standing Committee of the PRC National People's Congress issued the Cyber Security Law of the PRC, or Cyber Security Law, which became effective on June 1, 2017.
Pursuant to the Cyber Security Law, network operators must not, without users' consent, collect their personal information, and may only collect users' personal information necessary to provide their services. Providers are also obliged to provide security maintenance for their products and services and shall comply with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations.
The Civil Code of the PRC (issued by the PRC National People's Congress on May 28, 2020 and effective from January 1, 2021) provides the main legal basis for privacy and personal information infringement claims under China's civil laws. PRC regulators, including the Cyberspace Administration of China, the Ministry of Industry and Information Technology ("MIIT"), and the Ministry of Public Security, have been increasingly focused on regulation in the areas of data security and data protection.
The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various regulatory bodies in China, including the Cyberspace Administration of China, the Ministry of Public Security and the SAMR, have enforced data privacy and protection laws and regulations with varying and evolving standards and interpretations. In April 2020, the Chinese government promulgated Cybersecurity Review Measures, which came into effect on June 1, 2020. According to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services that do or may affect national security.
In November 2016, the Standing Committee of China's National People's Congress passed China's first Cybersecurity Law ("CSL"), which became effective in June 2017. The CSL is the first PRC law that systematically lays out the regulatory requirements on cybersecurity and data protection, subjecting many previously under-regulated or unregulated activities in cyberspace to government scrutiny. The legal consequences of violation of the CSL include penalties of warning, confiscation of illegal income, suspension of related business, winding up for rectification, shutting down the websites, and revocation of business licenses or relevant permits. In April 2020, the Cyberspace Administration of China and certain other PRC regulatory authorities promulgated the Cybersecurity Review Measures, which became effective in June 2020. Pursuant to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services that do or may affect national security.
On June 10, 2021, the Standing Committee of the NPC promulgated the PRC Data Security Law, which took effect on September 1, 2021. The Data Security Law sets forth the data security protection obligations for entities and individuals handling personal data, including that no entity or individual may acquire such data by stealing or other illegal means, and the collection and use of such data should not exceed the necessary limits. The costs of compliance with, and other burdens imposed by, CSL and any other cybersecurity and related laws may limit the use and adoption of our products and services and could have an adverse impact on our business.
On July 10, 2021, the CAC issued a revised draft of the Measures for Cybersecurity Review for public comments. Further, on January 4, 2022, thirteen PRC regulatory agencies, namely, the CAC, the NDRC, the Ministry of Industry and Information Technology, the Ministry of Public Security, the Ministry of State Security, the Ministry of Finance, MOFCOM, SAMR, CSRC, the People's Bank of China, the National Radio and Television Administration, National Administration of State Secrets Protection and the National Cryptography Administration, jointly adopted and published the Measures for Cybersecurity Review (2021), which will become effective on February 15, 2022. The Measures for Cybersecurity Review (2021) authorized the relevant government authorities to conduct a cybersecurity review on a range of activities that affect or may affect national security and required that, among others, in addition to "operator of critical information infrastructure" any "operator of network platform" holding personal information of more than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review. The Measures for Cybersecurity Review (2021) further elaborated on the factors to be considered when assessing the national security risks of the relevant activities, including, among others, (i) the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the country; (ii) the risk of critical information infrastructure, core data, important data or a large amount of personal information being affected, controlled, or maliciously used by foreign governments if going public; and (iii) the risks of network information security. The cybersecurity review will also look into the potential national security risks from overseas IPOs.
On November 14, 2021, the CAC published the Regulations on Network Data Security (draft for public comments), or the draft Regulations on Network Data Security, which reiterates that data processors that process the personal information of more than one million users who intend to list overseas should apply for a cybersecurity review. In addition, data processors that process important data or are listed overseas shall carry out an annual data security assessment on their own or by engaging a data security services institution, and the data security assessment report for the prior year should be submitted to the local cyberspace affairs administration department before January 31 of each year. Currently, the draft Regulations on Network Data Security has been released for public comment only, and its implementation provisions and anticipated adoption or effective date remains substantially uncertain and may be subject to change. We do not know what regulations will be adopted or how such regulations will affect us and our listing on Nasdaq. If the CAC determines that we are subject to these regulations, we may be required to delist from Nasdaq and we may be subject to fines and penalties.
We do not expect to be subject to the cybersecurity review by the CAC as of the date of this annual report, given that: (i) using our products and services does not require users to provide any personal information; (ii) we do not possess any personal information from users in our business operations; and (iii) data processed in our business does not have a bearing on national security and thus may not be classified as core or important data by the authorities. However, if the draft Regulations on Network Data Security is adopted into law and we become listed on Nasdaq, our PRC operating entities likely will be required to perform annual data security assessments either by themselves or retaining a third-party data security service provider and submit such data security assessment report to the local agency every year. Neither the CAC nor any other PRC regulatory agency or administration has contacted the Company in connection with the PRC operating entities. Neither Mingteng International nor the PRC operating entities are currently required to obtain regulatory approval from the CAC nor any other PRC authorities. However, there remains uncertainty as to how the Measures for Cybersecurity Review (2021) will be interpreted or implemented and whether the PRC regulatory agencies, including the CAC, may adopt new laws, regulations, rules, or detailed implementation and interpretation related to the Measures for Cybersecurity Review (2021). We cannot assure you that PRC regulatory agencies, including the CAC, would take the same view as we do, and there is no assurance that we can fully or timely comply with such laws. Our PRC Subsidiaries currently have obtained all permissions and approvals required for our operations in compliance with the relevant PRC laws and regulations in the PRC, including the business license. In the event that the applicable laws, regulations or interpretations change such that we are subject to any mandatory cybersecurity review and other specific actions required by the CAC, we cannot guarantee whether we can complete the registration process in a timely manner, or at all. If we inadvertently conclude that such approval is not required, fail to obtain and maintain such approvals, licenses or permits required for our business or respond to changes in the regulatory environment, we could be subject to liabilities, penalties and operational disruption, which may materially and adversely affect our business, operating, significantly limit or completely hinder our ability to offer or continue to offer securities to investors, or cause such securities to significantly decline in value or become worthless.