Regulatory authorities in China have enhanced regulatory requirements to cybersecurity, data security and personal information protection, and the PRC government may adopt other rules and restrictions in the future. As we generate and process a large amount of data through the FTA platform, we face risks inherent in handling and protecting large volumes of data, including protecting the data hosted in our system, detecting and prohibiting unauthorized data share and transfer, preventing attacks on our system by outside parties or fraudulent behavior or improper use by our employees, and maintaining and updating our database. Any privacy or data security breach or failure to comply with these laws and regulations could have a material adverse impact on the Group's reputation, brand, business and results of operations.
In April 2020, the Cyberspace Administration of China, or CAC, and eleven other regulatory authorities of the PRC jointly promulgated the Rules on Cybersecurity Review. Pursuant to the Rules on Cybersecurity Review, if an operator of critical information infrastructure purchases internet products and services that implicate or may implicate national security, such operator should be subject to cybersecurity review by the Cybersecurity Review Office of the CAC, or CRO.
The CRO announced the initiation of a cybersecurity review of the Yunmanman and Huochebang apps on July 5, 2021. During the cybersecurity review, the Yunmanman and Huochebang apps were required to suspend new user registration. The Group fully cooperated with the CRO to facilitate its review process. Based on notification by the CRO, we have resumed new user registration on the Yunmanman and Huochebang apps since June 29, 2022.
On July 10, 2021, the CAC and other related authorities released the draft amendment to the Rules on Cybersecurity Review for public comments through July 25, 2021. On December 28, 2021, the CAC and certain other government authorities promulgated the Revised Cybersecurity Review Measures that replaced the last version and took effect from February 15, 2022. Pursuant to the Revised Cybersecurity Review Measures, online platform operator holding over one million users' information must apply for a cybersecurity review before listing abroad, and operators of "critical information infrastructure" that intend to purchase internet products and services that will or may affect national security must apply for a cybersecurity review. Furthermore, the competent government authorities may also initiate a cybersecurity review against the relevant operators where the authorities believe that the network product or service or data processing activities affect or may affect national security.
On November 14, 2021, the CAC published the Draft Regulations on Network Data Security Management, which provides that data processors conducting the following activities shall apply for cybersecurity reviews: (i) merger, reorganization or division of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests, which affects or may affect national security; (ii) listing abroad of data processors that process over one million users' personal information; (iii) listing in Hong Kong which affects or may affect national security; or (iv) other data processing activities that affect or may affect national security. The CAC has solicited comments on this draft until December 13, 2021, but there is no definite timetable as to when it will be enacted. As such, substantial uncertainties exist with respect to the enactment timetable, final content, interpretation and implementation of such measures. We cannot predict the impact of the Draft Regulations on Network Data Security Management, if any, at this stage, and we will closely monitor and assess future development in the rule-making process. If the enacted versions of the Draft Regulations on Network Data Security Management mandate clearance of cybersecurity review and other specific actions to be completed by China-based companies listed on a U.S. stock exchange, including us, we face uncertainties as to whether such clearance can be timely obtained, or at all.
On July 30, 2021, the PRC State Council promulgated the Regulations on Security Protection of Critical Information Infrastructure, which became effective on September 1, 2021. Pursuant to such regulations, critical information infrastructure, or the CII, refers to any important network facilities or information systems of the important industry or field, such as public communication and information service, energy, transportation, water conservancy, finance, public services, e-government affairs and national defense science, which may endanger national security, people's livelihood and public interest in the case of damage, function loss or data leakage. Relevant administration departments of each critical industry and sector are required to formulate detailed guidance to recognize the CII in the respective sectors, and a critical information infrastructure operator, or a CIIO, must take the responsibility to protect the security of CII by performing certain prescribed obligations. As of the date of this annual report, no detailed implementation rules have been formally issued by the relevant governmental authorities. However, as this regulation was newly issued, the relevant governmental authorities may formulate further detailed rules or explanations with respect to the interpretation and implementation of this regulation. As of the date of this annual report, we have not been informed by any governmental authority that we are a critical information infrastructure operator.
On August 23, 2022, the PRC Ministry of Transport published the Administrative Measures for the Security Protection of Highway and Waterway Critical Information Infrastructure (Draft for comments), or the Draft Measures, which stipulates that the Ministry of Transport shall formulate and improve the rules for identification of highway and waterway critical information infrastructure, considering following factors: (i) the degree of importance of network facilities and information systems for key core business of highway and waterway; (ii) the possible degree of harm in the event of destruction or disfunction of network facilities and information systems, or data leakage; and (iii) the relevant impact to other industries and fields. As of the date of this annual report, the Draft Measures were released for public comment only and it is still uncertain when the final versions of these new provisions and measures will be issued and take effect, how they will be enacted, interpreted or implemented, and whether they will affect us. As of the date of this annual report, we have not been informed by relevant governmental authority that we are a highway and waterway critical information infrastructure operator.
On July 7, 2022, the CAC promulgated the Security Assessment Measures for Outbound Data Transfer, or the Security Assessment Measures, effective from September 1, 2022 to regulate outbound data transfer activities, protect the rights and interests of personal information, safeguard national security and social public interests, and promote the cross-border security and free flow of data. The Provisions on Promoting and Regulating Cross-border Data Flows, or the Provisions on Cross-border Data Flows, issued and become effective on March 22, 2024, further clarify and elaborate the relevant provisions of the Security Assessment Measures. The Security Assessment Measures and the Provisions on Cross-border Data Flows require the data processor providing data overseas and falling under certain circumstances to apply for the security assessment of cross-border data transfer with the local provincial-level counterparts of the national cybersecurity authority. For details, see "Item 4. Information on the Company. - B. Business Overview - Regulatory Matters - Regulations Related to Internet Security and Privacy Protection." As of the date of this annual report, we believe the Group is not involved in outbound data transfers in its daily operations, and therefore, we do not currently expect the Security Assessment Measures or the Provisions on Cross-border Data Flows to have a material impact on the Group's daily operations. However, if we engage in any capital markets transaction in overseas markets in the future, we may need to transfer certain data outside of the PRC, and such outbound data transfer may be subject to the restrictions under the Security Assessment Measures. Moreover, given the Security Assessment Measures were recently promulgated, there are substantial uncertainties as to the interpretation of such measures, and the PRC government authorities have discretion in the interpretation and enforcement of the applicable laws. Therefore, it is uncertain whether we would be required to report any security assessment for cross-border data transfers to the CAC.
Non-compliance with cybersecurity and personal information protection laws and regulations could result in administrative penalties, such as warnings, fines, service suspension, removal of the Group's apps from the relevant app stores, revocation of relevant business permits and/or licenses, or penalties of other nature that may cause a material adverse impact on the Group's business, results of operations and financial condition.