Our business involves collecting and retaining large volumes of internal and customer data, including credit card numbers and other personal information as our various information technology systems enter, process, summarize and report such data. We also maintain information about various aspects of our operations as well as regarding our employees. The integrity and protection of our customer, employee and company data is critical to our business. Our customers and employees expect that we will adequately protect their personal information. We are required by applicable laws to keep strictly confidential of the personal information that we collect, and to take adequate security measures to safeguard such information.
The Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (general data protection regulation, "GDPR"), imposes certain requirements on the processing of personal data relating to natural persons. GDPR requirements will apply both to companies established in the EU and to companies, such as us, that are not established in the EU but process personal data of individuals who are in the EU (and in the European Economic Area subject to the enactment of implementation procedures), where the processing activities relate to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the EU; or (b) the monitoring of their behavior as far as their behavior takes place within the EU. See "item 4. Information on the Company - 4.B. Business Overview - Regulation - Regulation on Information Protection on Networks." Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business, and the failure to comply with the GDPR could expose us to sanctions from both a financial and business operations perspective. In addition, in case of control, non-compliance with the GDPR may expose us to damage to our reputation.
On February 1, 2013, China's first set of personal data protection guidelines, the Guidelines for Personal Information Protection in Information Security Technology Public and Commercial Service Systems, came into effect, which set forth detailed personal information protection requirements on data collection, data processing, data transfer and data creation. Although these guidelines are voluntary and non-binding, we believe that growing regulatory oversight of data privacy in China is inevitable. In addition, Amendment 7 to the PRC Criminal Law prohibits institutions, companies and their employees in the telecommunications and other industries from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services or obtaining such information through theft or other illegal ways. On November 7, 2016, the Standing Committee of the PRC National People's Congress issued the Cyber Security Law of the PRC, which became effective on June 1, 2017. Pursuant to the Cyber Security Law of the PRC, providers of network products and services shall provide security maintenance for their products and services and shall comply with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations. Moreover, the Provisions on Protection of Personal Information of Telecommunication and Internet Users is the specific regulation governing the collection, use, disclosure and security of personal information. Complying with these PRC laws and regulations may cause us to incur substantial costs or require us to change our business practices. See "Item 4. Information on the Company - B. Business Overview - Regulation - Regulation on Information Protection on Networks".
While we take various measures to comply with all applicable data privacy and protection laws and regulations, our current security measures and those of our third-party service providers may not be adequate for the protection of our customer, employee or company data. In addition, computer hackers, foreign governments or cyber terrorists may attempt to penetrate our network security and our website. Unauthorized access to our proprietary internal and customer data may be obtained through break-ins, sabotage, breach of our secure network by an unauthorized party, computer viruses, computer denial-of-service attacks, employee theft or misuse, breach of the security of the networks of our third-party service providers, or other misconduct. Because the techniques used by computer programmers who may attempt to penetrate and sabotage our proprietary internal and customer data change frequently and may not be recognized until launched against a target, we may be unable to anticipate these techniques. Unauthorized access to our proprietary internal and customer data may also be obtained through inadequate use of security controls. For instance, in August 2018, online reports alleged that we had become the subject of potential information leak. A proposed class action complaint was filed in the United States District Court in the Central District of California against us and our management alleging violations of the U.S. securities laws in relation to this possible data breach. This case was voluntarily dismissed by the plaintiffs on February 27, 2019. We may face similar litigations in the future. Any of such proceedings may harm our reputation and adversely affect our business and results of operations. The laws and regulations applicable to security and privacy are becoming increasingly important in China. Any theft, loss, fraudulent, unlawful use or disclosure of customer, employee or company data could harm our reputation or result in remedial and other costs, liabilities, fines or lawsuits.