We are subject relating various risks and costs associated with to the collection, use, sharing, retention, security, and transfer of confidential and private information, such as personal information and other data. This data is wide ranging and relates to our customers and any other third parties. Our compliance obligations include those relating to the Data Protection Act (As Revised) of the Cayman Islands and the relevant PRC laws in this regard. These PRC laws apply not only to third-party transactions, but also to transfers of information among us and our PRC subsidiaries, and other parties with which we have commercial relations. These laws continue to develop, and the PRC government may adopt other rules and restrictions in the future. Non-compliance could result in penalties or other significant legal liabilities.
Pursuant to the PRC Cybersecurity Law, which was promulgated by the Standing Committee of the National People's Congress on November 7, 2016 and took effect on June 1, 2017, personal information and important data collected and generated by a critical information infrastructure operator in the course of its operations in China must be stored in China, and if a critical information infrastructure operator purchases internet products and services that affects or may affect national security, it should be subject to cybersecurity review by the CAC. Due to the lack of further interpretations, the exact scope of "critical information infrastructure operator" remains unclear. On December 28, 2021, the CAC and other relevant PRC governmental authorities jointly promulgated the Cybersecurity Review Measures (the "new Cybersecurity Review Measures") to replace the original Cybersecurity Review Measures. The new Cybersecurity Review Measures took effect on February 15, 2022. Pursuant to the new Cybersecurity Review Measures, if critical information infrastructure operators purchase network products and services, or network platform operators conduct data processing activities that affect or may affect national security, they will be subject to cybersecurity review. A network platform operator holding more than one million users/users' individual information also shall be subject to cybersecurity review before listing abroad. The cybersecurity review will evaluate, among others, the risk of critical information infrastructure, core data, important data, or a large amount of personal information being influenced, controlled or maliciously used by foreign governments and risk of network data security after going public overseas. In the opinion of our PRC counsel, Hebei Changjun Law Firm we are not subject to cybersecurity review, because: (i) we do not collect or maintain personal information in our business operations and (ii) data processed in our business does not have a bearing on national security and thus may not be classified as core or important data by the authorities. However, Hebei Changjun Law Firm has also advised us that since the regulatory authorities have discretion in this regard, whether an entity is subject to cybersecurity review shall still subject to the regulatory authorities' view. In addition, we currently do not have over one million users' personal information and do not anticipate to collect over one million users' personal information in the foreseeable future. If we ever became subject to the cybersecurity review of CAC in the future as the applicable rules, regulations, policies or the interpretation thereof change, during such review, we may be required to suspend our operation or experience other disruptions to our operations. Cybersecurity review could also result in negative publicity with respect to our company and diversion of our managerial and financial resources.
Furthermore, if we were found to be in violation of applicable laws and regulations in China during such review, we could be subject to administrative penalties, such as warnings, fines, or service suspension. Therefore, cybersecurity review could materially and adversely affect our business, financial condition, and results of operations.
In addition, the PRC Data Security Law, which was promulgated by the Standing Committee of the National People's Congress on June 10, 2021 and took effect on September 1, 2021, requires data collection to be conducted in a legitimate and proper manner, and stipulates that, for the purpose of data protection, data processing activities must be conducted based on data classification and hierarchical protection system for data security. As the Data Security Law was recently promulgated, we may be required to make further adjustments to our business practices to comply with this law. If our data processing activities were found to be not in compliance with this law, we could be ordered to make ‘corrections, and under certain serious circumstances, such as severe data divulgence, we could be subject to penalties, including the revocation of our business licenses or other permits. Furthermore, the recently issued Opinions on Strictly Cracking Down Illegal Securities Activities in Accordance with the Law require (i) speeding up the revision of the provisions on strengthening the confidentiality and archives management relating to overseas issuance and listing of securities and (ii) improving the laws and regulations relating to data security, cross-border data flow, and management of confidential information. As there remain uncertainties regarding the further interpretation and implementation of those laws and regulations, we cannot assure you that we will be compliant such new regulations in all respects, and we may be ordered to rectify and terminate any actions that are deemed illegal by the regulatory authorities and become subject to fines and other sanctions. As a result, we may be required to suspend our relevant businesses, shut down our website, take down our operating applications, or face other penalties, which may materially and adversely affect our business, financial condition, and results of operations.
On August 20, 2021, the Standing Committee of the National People's Congress of China promulgated the PIPL, which took effect in November 2021. As the first systematic and comprehensive law specifically for the protection of personal information in the PRC, the PIPL provides, among others, that (i) an individual's consent shall be obtained to use sensitive personal information, such as biometric characteristics and individual location tracking, (ii) personal information operators using sensitive personal information shall notify individuals of the necessity of such use and impact on the individual's rights, and (iii) where personal information operators reject an individual's request to exercise his or her rights, the individual may file a lawsuit with a People's Court. As uncertainties remain regarding the interpretation and implementation of the PIPL, we cannot assure you that we will comply with the PIPL in all respects, we may become subject to fines and/or other penalties which may have material adverse effect on our business, operations and financial condition.
While we take measures to comply with all applicable data privacy and protection laws and regulations, we cannot guarantee the effectiveness of the measures undertaken by us. However, compliance with any additional laws could be expensive, and may place restrictions on our business operations and the manner in which we interact with our users. In addition, any failure to comply with applicable cybersecurity, privacy, and data protection laws and regulations could result in proceedings against us by government authorities or others, including notification for rectification, confiscation of illegal earnings, fines, or other penalties and legal liabilities against us, which could materially and adversely affect our business, financial condition, results of operations and the value of our ADSs. In addition, any negative publicity on our website or platform's safety or privacy protection mechanism and policy could harm our public image and reputation and materially and adversely affect our business, financial condition, and results of operations.