The Group is subject to various regulatory requirements relating to the security and privacy of data, including restrictions on the collection, storage and use of personal information and requirements to take steps to prevent personal data from being divulged, stolen, or tampered with. See "Item 4. Information on the Company-4.B. Business Overview-Regulation-Regulations Relating to Internet Information Security and Privacy Protection." Regulatory requirements regarding the protection of data are constantly evolving and can be subject to differing interpretations or significant change, making the extent of the Group's responsibilities in that regard uncertain. For example, the Cyber Security Law of the PRC became effective in June 2017, but there are great uncertainties as to the interpretation and application of the law. It is possible that those regulatory requirements may be interpreted and applied in a manner that is inconsistent with the Group's practices. In addition, the Office of the Central Cyberspace Affairs Commission, the MIIT, the Ministry of Public Security, and the SAMR jointly issued an announcement on January 23, 2019 regarding carrying out special campaigns against mobile internet application programs collecting and using personal information in violation of applicable laws and regulations, which prohibits business operators from collecting personal information irrelevant to their services, or forcing users to give authorization in disguised manner. In addition, the PRC regulatory authorities have recently taken steps to strengthen the regulation on data protection and conducted several rounds of relevant inspections recently. The Group has been taking and will continue to take reasonable measures to comply with such announcement, provisions and inspection requirements.
On June 10, 2021, the Standing Committee of the National People's Congress promulgated the PRC Data Security Law, effective on September 1, 2021. On July 30, 2021, the State Council promulgated the Regulations on Critical Information Infrastructure Security Protection, which became effective on September 1, 2021. On August 20, 2021, the Standing Committee of the National People's Congress promulgated the PRC Personal Information Protection Law, which came into effect on November 1, 2021. In addition, on January 4, 2022, the CAC announced the adoption of the Revised Cybersecurity Review Measures, which became effective on February 15, 2022 and repealed the Cybersecurity Review Measures promulgated on April 13, 2020. Such Measures further restate and expand the applicable scope of the cybersecurity review. Pursuant to the Revised Cybersecurity Review Measures, critical information infrastructure operators that procure internet products and services, and network platform operators engaging in data processing activities, must be subject to the cybersecurity review if their activities affect or may affect national security. In addition, network platform operators holding over one million users' personal information shall apply with the Cybersecurity Review Office for a cybersecurity review before listing abroad. On January 4, 2022, the CAC published the Administrative Provisions on Internet Information Service Algorithm Recommendation on its website, which became effective on March 1, 2022. Furthermore, on July 7, 2022, the CAC promulgated the Security Assessment Measures for Outbound Data Transfer, effective from September 1, 2022, to regulate outbound data transfer activities, protect the rights and interests of personal information, safeguard national security and social public interests, and promote the cross-border security and free flow of data. On March 22, 2024, the CAC published the Provisions on Promoting and Regulating Cross-bound Data Flows, which streamline and provide clarity to the governance framework for outbound data transfer.
These newly promulgated laws and regulations reflect PRC government further attempts to strengthen the legal protection for the national network security, data security, the security of critical information infrastructure and the security of personal information protection. For details on regulations over cybersecurity, data protection and privacy in the PRC, see "Item 4. Information on the Company-4.B. Business Overview-Regulation-Regulations Relating to Internet Information Security and Privacy Protection."
Based on the Group's understanding of the above PRC laws and regulations and assessment of our cybersecurity, data protection, and privacy practices, the Group's business operations do not violate any of the above PRC laws and regulations currently in force in all material aspects except for the uncertainties as disclosed in this annual report. The Group has not relied upon the opinion of PRC legal counsel with respect to its conclusion that the Group is compliant with PRC laws and regulations regarding cybersecurity, data protection, and privacy. As advised by Tian Yuan Law Firm, our PRC legal counsel, the Group is not legally required under PRC laws and regulations to engage an external legal counsel to conduct a review of its cybersecurity, data protection, and privacy practices in the PRC. The PRC laws and regulations impose enhanced compliance requirements for critical information infrastructure operators; however, as of the date of this annual report, the Group has not been identified by the PRC regulators as a "critical information infrastructure operator" under the relevant cybersecurity laws and regulations. Nevertheless, the Group strives to adhere to heightened standards of cybersecurity and data privacy for the interests of its users and shareholders, and accordingly the Group has established compliance procedures and programs to identify and mitigate risks in this regard. As a result, the Group's portal system, operation system and major mobile app have achieved scores of approximately 80 / 100 on tests conducted by independent third-party institutions, which speaks to effective measures adopted by the Group in compliance with applicable cybersecurity and data privacy laws and regulations. Therefore, we believe that the business operations of the Group do not violate any of the laws and regulations over cybersecurity and data privacy currently in force in any material aspect. However, should it become necessary or required under PRC laws and regulations, the Group will promptly engage external legal counsel to assess and provide an opinion on its compliance status with respect to cybersecurity and data privacy and disclose the findings of such review in accordance with SEC rules.
The Group has been taking and will continue to take reasonable measures to comply with the aforementioned laws, regulations, announcement, provisions and inspection requirements; however, as these laws, regulations, announcements and provisions are relatively new, and the related implementation rules have not yet been promulgated, it remains uncertain how these laws, regulations, announcements and provisions will be implemented. For example, there have been no clarifications from the relevant authorities as to the detailed standards for determining whether an activity is one that "affects or may affect national security", thus uncertainties remain as to whether the Groups' data processing activities shall be subject to a cybersecurity review. We cannot assure you the Group can adapt the operations to these laws, regulations, announcement and provisions in a timely manner. Evolving interpretations of such laws, regulations, announcements and provisions or any future regulatory changes might impose additional restrictions on or obligations of the Group generating and processing personal information and other data. The Group may be subject to additional regulations, laws and policies adopted by the PRC government to apply more stringent social and ethical standards in cybersecurity and data privacy resulting from the increased global focus on this area. To the extent that the Group needs to alter the Group's business model or practices to adapt to these announcement and provisions and future regulations, laws and policies, the Group could incur additional expenses.
Any failure, or perceived failure by the Group, or by third-party partners to maintain the security of students' data and other confidential information or to comply with applicable privacy, cybersecurity, data security and personal information protection laws, regulations, policies, contractual provisions, industry standards, and other requirements, may result in civil or regulatory liability, including governmental or data protection authority enforcement actions and investigations, fines, penalties, enforcement orders requiring the Group to cease operating in a certain way, litigation, or adverse publicity, and may require the Group to expend significant resources in responding to and defending allegations and claims. Moreover, claims or allegations that the Group has failed to adequately protect users' data, or otherwise violated applicable privacy, cybersecurity, data security and personal information protection laws, regulations, policies, contractual provisions, industry standards, or other requirements, may result in damage to the Group's reputation and a loss of confidence in the Group by users or partners, potentially causing the Group to lose users, business partners and revenues, which could have a material adverse effect on the Group's business, financial condition and results of operations. Furthermore, the PRC regulatory and enforcement regime with regard to privacy, cybersecurity, data security and personal information protection is still evolving. PRC regulators have been increasingly focused on regulation in the areas of cybersecurity, data security and data protection. We cannot assure you that relevant regulators will not interpret or implement these laws or regulations in ways that negatively affect the Group. It is possible that the Group may become subject to additional or new laws and regulations, policies and interpretations, which may result in additional expenses to the Group and subject the Group to potential liability and negative publicity. The Group expects that these areas will receive greater attention and focus from regulators, and attract continued or greater public scrutiny and attention going forward, which could increase compliance costs and subject the Group to heightened risks and challenges associated with data security and protection. If the Group is unable to manage these risks, the Group could become subject to penalties, fines, suspension of business and revocation of required licenses, and the Group's reputation and results of operations could be materially and adversely affected.