Personally identifiable and other confidential information is increasingly subject to legislation and regulations in China and numerous foreign jurisdictions. The PRC governmental authorities have enacted a series of laws and regulations relating to the protection of personal information and/or the supervision over data processing activities, under which certain information or data processors are required to comply with an array of personal information and data protection requirements, including for example, to clearly indicate the purposes, methods and scope of any information collection and usage, to obtain appropriate user consent and to establish user information protection systems with appropriate remedial measures. However, this regulatory framework for privacy issues in China and worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. For example, on June 10, 2021, the Standing Committee of the PRC National People's Congress issued the Data Security Law to regulate data processing activities and security supervision in mainland China, which came into effect on September 1, 2021. The Data Security Law provides a national data security review system, under which data processing activities that affect or may affect national security shall be reviewed. Moreover, on August 20, 2021, the Standing Committee of the PRC National People's Congress promulgated the Personal Information Protection Law, effective on November 1, 2021, which further detailed the general rules and principles on personal data processing and further increase the potential liability of personal data processor. Given that many of the laws and regulations of mainland China regarding data privacy and cybersecurity are constantly evolving, it is uncertain how they will be interpreted or enforced. For more information, see "Item 4. Information on the Company-B. Business Overview-Regulations."
Furthermore, the PRC government has taken steps to limit the method and manner that the internet companies may apply when using the algorithms. For instance, the CAC, together with eight other government authorities, jointly issued the Guidelines on Strengthening the Comprehensive Regulation of Algorithms for Internet Information Services on September 17, 2021, which provides that daily monitoring of data use, application scenarios and effects of algorithms shall be carried out by the regulators, and security assessments of algorithms shall be conducted by the regulators. The guidelines also provide that an algorithm filing system shall be established, and classified security management of algorithms shall be promoted. In addition, on December 31, 2021, the CAC, the Ministry of Industry and Information Technology, or the MIIT, the Ministry of Public Security and the Ministry of State Security promulgated the Administrative Provisions on Internet Information Service Algorithm Recommendation, which came into effect on March 1, 2022. These provisions stipulate that algorithm recommendation service providers shall inform users of their provision of algorithm recommendation services in a conspicuous manner, and publicize the basic principles, purpose intentions and main operating mechanisms of algorithm recommendation services in an appropriate manner. For more information, see "Item 4. Information on the Company-B. Business Overview-Regulations."
In addition, on November 14, 2021, the CAC released the Regulations on the Network Data Security for public comments, which stipulate, among others, that a prior cybersecurity review is required for listing abroad of data processors which process over one million users' personal information, and the listing of data processors in Hong Kong which affects or may affect national security. On December 28, 2021, the CAC and other twelve PRC regulatory authorities jointly revised and promulgated the Measures for Cybersecurity Review, or the Cybersecurity Review Measures, which came into effect on February 15, 2022. Pursuant to the Cybersecurity Review Measures, besides the procurement of network products and services by critical information infrastructure operators, any data processing activities by network platform operators that affects or may affect national security shall be subject to the cybersecurity review as well. In accordance with the Cybersecurity Review Measures, operators mastering personal information of more than one million users must apply to the Cybersecurity Review Office for cybersecurity review when they seek for listing in a foreign country. However, the Cybersecurity Review Measures and the Regulations on the Network Data Security remain unclear on whether the requirements will be applicable to companies that have been listed in the United States. We cannot predict the impact of the Cybersecurity Review Measures and the Regulations on the Network Data Security, if any, at this stage, and we will closely monitor and assess any development in the rule-making process. Furthermore, on July 7, 2022, the CAC promulgated the Measures on Security Assessment of Cross-border Data Transfer, or the Data Export Measures, which became effective on September 1, 2022. The Data Export Measures require that any data processor which processes or exports personal information exceeding certain volume threshold under such measures shall apply for security assessment by the CAC before transferring any personal information abroad. The security assessment requirement also applies to any transfer of important data outside of China. Additionally, on November 18, 2022, the CAC and the SAMR issued the Implementation Rules for Personal Information Protection Certification, which came into immediate effect. These rules provide important guidance on obtaining a personal information certification for the lawful cross-border transfer of personal information under the Personal Information Protection Law. The CAC also published various regulations in 2023 that offer important guidance on relying on standard contracts for transferring personal information out of the PRC, as well as on the applicable filing requirements. Due to changes in the cross-border data transfer regulatory landscape, we have been required to continuously review our existing data protection compliance framework. This review encompasses conducting data mapping exercises, obtaining separate consents from individuals, applying for security assessments with the CAC, and entering into standard contracts with our overseas affiliates for the transfer of personal information outside of the PRC. The CAC has also issued the First Edition and the Second Edition of Guidelines for Application for Security Assessment of Outbound Data Transfer successively on August 31, 2022 and March 22, 2024, respectively, illustrating the specific requirements for declaration of the cross-border data security assessment, such as methods, processes and materials, and optimizes and simplifies the relevant materials that data processors need to submit. As of the date of this annual report, we have not been involved in any investigations, security assessment or cybersecurity reviews by the CAC, and we had not received any inquiry, notice, warning, or sanction in such respect. If a cybersecurity review for any of our activities is required, we will actively cooperate with the CAC to conduct such cybersecurity review.
Any failure, or perceived failure, by us, our employees or partners to maintain the security of our user data or to comply with applicable PRC or foreign privacy, data security and personal information protection laws, regulations, policies, contractual provisions, industry requirements and other requirements may result in civil or regulatory liability. The ensuing consequences may include governmental or data protection authority enforcement actions and investigations, fines, penalties, enforcement orders requiring us to cease operating in a certain way, revoking our business permits or business licenses, litigation or adverse publicity, which may require us to expend significant resources in responding to and defending allegations and claims. Furthermore, claims or allegations that we have failed to adequately protect our users' data, or otherwise violated applicable privacy and data security laws, regulations, policies, contractual provisions, industry standards or other requirements, may result in damage to our reputation and a loss of confidence in us by our users or our partners, potentially causing us to lose users, other business partners and revenues, which could have a material adverse effect on our business, financial condition and results of operations.
As we gradually expand into international markets, we may be subject to laws and regulations of other countries regarding cybersecurity, information security, privacy and data protection. We strive to comply with local laws and regulations in markets where we have operations. For example, the GDPR of the European Union imposes obligations on companies regarding the handling of personal data and provides certain individual privacy rights to persons whose data is stored. The GDPR requires companies to submit personal data breach notifications to designated European privacy regulator in each country they have business operations, and provides significant penalties for non-compliance with the notification obligation as well as other requirements of the GDPR. For another instance, some countries are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements, which, if adopted and implemented, could increase the cost and complexity of delivering our services. In addition, wherever we operate, we could be subject to new laws or regulations or the interpretation and application of existing consumer and data protection laws or regulations. These new laws, regulations and interpretations are often uncertain and in flux and may be inconsistent with our practices. We cannot guarantee that we will be able to maintain compliance at all times, especially in light of the fact that laws and regulations on cybersecurity and data protection are evolving. Our launch of new products that we may take may also subject us to additional laws, regulations, or other government scrutiny. Complying with these new or additional laws, regulations and requirements could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business.