In China, the government is still ramping up regulations with regard to personal information protection. On October 1, 2020, the Information Security Technology-Personal Information Security Specification (GB/T 35273-2020), or the "2020 Specification," took effect. Although the 2020 Specification is a recommended guideline, and it is not enforceable by law, the authority will use this standard to evaluate our compliance with China's legal guidelines and regulations regarding personal information protection. On August 20, 2021, the Standing Committee of the National People's Congress, or "SCNPC," promulgated the Personal Information Protection Law of the PRC, or the "Personal Information Protection Law," which integrates various rules with respect to personal information rights and privacy protection. The Personal Information Protection Law, which took effect on November 1, 2021, seeks to protect the personal information rights and interests, regulating the processing of personal information, ensuring the orderly and free flow of personal information in accordance with the law and promoting the reasonable use of personal information. The Personal Information Protection Law applies to the processing of personal information within China, as well as certain personal information processing activities conducted by entities outside China for natural persons within China, including those for the provision of products and services to natural persons within China or for the analysis and assessment of acts of natural persons within China. The Personal Information Protection Law provides severe punishment for violations of the regulations relating to the processing of personal information.
The relevant regulatory authorities in China continue to monitor websites and networks in relation to the protection of personal data, privacy and information security, and may impose additional requirements from time to time. For example, the SCNPC promulgated the PRC Data Security Law, which took effect on September 1, 2021. The Data Security Law provides for a security review procedure for data that may affect national security. Furthermore, on December 28, 2021, the Cyberspace Administration of China, or the "CAC," the NDRC, the Ministry of Industry and Information Technology, or the "MIIT," and several other administrations jointly published the Measures for Cybersecurity Review, which became effective on February 15, 2022. The Measures for Cybersecurity Review provide that certain operators of critical information infrastructure engaged in the purchasing of network products and services, and certain network platform operators carrying out data processing activities that affect or may affect national security, must apply with the Cybersecurity Review Office to conduct a cybersecurity review. On July 30, 2021, the State Council issued the Security Protection Regulations for Critical Information Infrastructure, or the "Regulation for CII," which became effective on September 30, 2021. The Regulation for CII specifies that CII refers to important Internet facilities and information systems in significant industries, such as public communication, information services, energy, traffic, hydraulic engineering, financing, public services, e-government, national defense technology, and other facilities that once destroyed, lost function or data leakage, may seriously endanger national security, national economy, people's livelihood, and public interest. However, the scope of operators of "critical information infrastructure" under the current regulatory regime remains unclear and is subject to further decisions of competent PRC regulatory authorities.
On November 14, 2021, the CAC published a draft version of the Administrative Measures for Internet Data Security, or the "Draft Measures for Internet Data Security," which propose that data processors conducting the following activities would also need to apply for cybersecurity review procedures: (i) mergers, reorganizations or divisions of Internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests that affect or may affect national security; (ii) overseas listings, if the data processor processes an amount of personal information relating to over one million users; (iii) listings in Hong Kong which affect or may affect national security; or (iv) other data processing activities that affect or may affect national security. There currently is no public timetable as to when or whether the Draft Measures for Internet Data Security will be enacted. As such, substantial uncertainties still exist with respect to the potential timing of obligations, the regulation's final content, as well as its interpretation and implementation. Regardless of such uncertainties, if in the future these or other regulations were to require us to perform a cybersecurity review, then any failure to obtain approval or clearance from the regulatory authorities with respect to our cybersecurity review could materially constrain our liquidity and have a material adverse impact on our business operations and financial results, especially if any additional capital or financing were to be needed.
The PRC regulatory authorities have also undertaken recent efforts to enhance the supervision and regulation of cross-border data transmissions. On July 7, 2022, the CAC promulgated the Measures for the Security Assessment of Cross-border Data Transmission, which came into effect on September 1, 2022 and regulate security assessment procedures with respect to cross-border data transfers by data processors of important data and personal information that is collected and generated during operations within the PRC. The Measures for the Security Assessment of Cross-border Data Transmission provide a six-month transition period (beginning from the regulation's effective date) for data processors to rectify their compliance with the security assessment requirements with regard to cross-border data transfers carried out before these measures take effect (September 1, 2022). On March 22, 2024, the CAC issued the long-awaited Provisions on Facilitating and Regulating Cross-Border Data Transfers, effective as of the same date. The CAC simultaneously updated the Guidelines to Applications for Security Assessment of Outbound Data Transfers and the Guidelines for Filing the Standard Contract for Outbound Cross-Border Transfer of Personal Information to harmonize the current rules applicable to cross-border data transfers. These regulations benefit many multinational companies that are involved in the transfer of personal information and other data out of China. The essence of these regulations consists of exceptions to existing data compliance requirements (such as the need to conduct "security assessments" and to complete "standard contracts") set out under pre-existing laws and regulations concerning outbound cross-border data transfers.
Regulatory requirements on cybersecurity and data privacy are constantly evolving and can be subject to varying interpretations or significant changes, resulting in uncertainties about the scope of our responsibilities in that regard. In particular, the Draft Measures for Internet Data Security are still uncertain and in a draft state, and we cannot assure that, once implemented (if they are ever implemented), relevant governmental authorities will not interpret or implement this and other laws or regulations in ways that may negatively affect us. Security breaches and other disruptions of our information and technology networks could compromise our information and expose us to liability, reputational harm and significant remediation costs, which could cause material harm to our business and financial results. In the ordinary course of our business, we collect and store sensitive data, including our proprietary business information, and information relating to our customers and information of our employees, contractors and vendors, in our networks. Despite our security measures, and those of our third-party service providers, our information technology and infrastructure may be vulnerable to attacks by third parties or breached due to employee error, malfeasance or other disruptions. A significant theft, loss, corruption, exposure, fraudulent use or misuse of customer, employee or other personally identifiable or proprietary business data, noncompliance with our contractual or other legal obligations regarding such data could result in significant remediation and other costs, fines, litigation or regulatory actions against us. Such an event could additionally disrupt our operations, harm our relationships with contractors and vendors, damage our reputation, result in the loss of a competitive advantage, which could adversely affect our business, revenue, competitive position and investor confidence. Additionally, we rely on third parties to support our information and technology networks, and as a result have less direct control over our data and information technology systems. These third parties are also vulnerable to security breaches and compromised security systems, for which we may not be indemnified and which could materially adversely affect us.