We are subject to complex and evolving statutory and regulatory requirements relating to cybersecurity, information security, privacy and data protection. Regulatory authorities in mainland China have enhanced data protection and cybersecurity regulatory requirements. These laws continue to develop, and the PRC government may adopt other rules and restrictions in the future. Non-compliance could result in penalties or other significant legal liabilities.
The PRC Cybersecurity Law, which became effective in June 2017, created China's first national-level data protection framework for "network operators." It is relatively new and subject to interpretations by the regulator. It requires, among others, that network operators take security measures to protect the network from unauthorized interference, damage and unauthorized access and prevent data from being divulged, stolen or tampered with. Network operators are also required to collect and use personal information in compliance with the principles of legitimacy, properness and necessity, and strictly within the scope of authorization by the subject of personal information unless otherwise prescribed by laws or regulations. Significant capital, managerial and human resources are required to comply with legal requirements, enhance information security and address any issues caused by security failures.
In addition, numerous regulations, guidelines and other measures have been and are expected to be adopted under the PRC Cybersecurity Law. For example, the PRC government promulgated the Measures for Cybersecurity Review in April 2020, which became effective in June 2020. Under these measures, critical information infrastructure operators must pass a cybersecurity review when purchasing network products and services which do or may affect national security. On December 28, 2021, the CAC, together with certain other PRC governmental authorities, jointly released the Revised Cybersecurity Review Measures, which took effect on February 15, 2022. Pursuant to the Revised Cybersecurity Review Measures, operators of critical information infrastructure that intend to purchase network products and services that affect or may affect national security must apply for a cybersecurity review. The cybersecurity review will evaluate, among others, the risk of critical information infrastructure, core data, important data, or the risk of a large amount of personal information being influenced, controlled or maliciously used by foreign governments after going public, and cyber information security risk. The Revised Cybersecurity Review Measures set out certain general factors which would be the focus in assessing the national security risk during a cybersecurity review. However, as advised by our PRC counsel, the scope of network product or service or data processing activities that will or may affect national security is still unclear, and the PRC government authorities may have wide discretion in the interpretation and enforcement of these laws, rules and regulations. As of the date of this annual report, we have not been involved in any investigations or become subject to a cybersecurity review initiated by the CAC, and we have not received any inquiry, notice, warning, sanctions in such respect or any regulatory objections to our listing status from the CAC.
On August 17, 2021, the PRC State Council promulgated the Regulations on Security Protection of Critical Information Infrastructure, which became effective on September 1, 2021. Pursuant to such regulations, "critical information infrastructure" shall mean any important network facilities or information systems of important industries or fields such as public communication and information service, energy, communications, water conservation, finance, public services, e-government affairs and national defense science, and any other important network facilities or information systems which may endanger national security, people's livelihood and public interest in case of damage, function loss or data leakage. In addition, relevant administration departments of each critical industry and sector, or Protection Departments, shall be responsible to formulate eligibility criteria and determine the critical information infrastructure operator in the respective industry or field. The operators shall be informed about the final determination as to whether they are categorized as critical information infrastructure operators. As of the date hereof, no detailed rules or implementation has been issued by any Protection Departments, and we have not been informed as a critical information infrastructure operator by any governmental authorities. As this regulation is newly issued and the governmental authorities, including Protection Departments, may further formulate detailed rules or explanations with respect to the interpretation and implementation of this regulation, the exact scope of "critical information infrastructure operators" under the current regulatory regime remains unclear, and the PRC governmental authorities may have wide discretion in the interpretation and enforcement of these laws. Therefore, it is uncertain whether we would be deemed as a critical information infrastructure operator under PRC law. It also remains uncertain whether the future regulatory changes would impose additional restrictions on companies like us. If we are not able to comply with the cybersecurity and data privacy requirements in a timely manner, or at all, we may be subject to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our app, including mobile and smart TV apps, from the relevant application stores, among other sanctions, which could materially and adversely affect our business and results of operations. As of the date of this annual report, we have not been involved in any investigations on cybersecurity review made by the Cyberspace Administration of China on such basis, and we have not received any inquiry, notice, warning, or sanctions in such respect.
The PRC Personal Information Protection Law, or the PIPL, took effect in November 2021. The PIPL sets forth detailed rules on processing personal information, clarifies the relevant rights of the individuals and the obligations of the personal information processors, and further strengthens the liabilities for illegal process of personal information. In addition to other rules and principles of personal information processing, the PIPL specifically provides rules for processing sensitive personal information. Sensitive personal information refers to personal information that, once leaked or illegally used, could easily lead to the infringement of human dignity or harm to the personal or property safety of an individual, including biometric recognition, religious belief, specific identity, medical and health, financial account, personal whereabouts and other information of an individual, as well as any personal information of a minor under the age of 14. Only where there is a specific purpose and sufficient necessity, and under circumstances where strict protection measures are taken, may personal information processors process sensitive personal information. A personal information processor shall inform the individual of the necessity of processing such sensitive personal information and the impact thereof on the individual's rights and interests. Some information we collect, such as location and mobile numbers, may be deemed to be sensitive personal information under the PIPL. The PIPL also strengthens the supervision of automatic decision making to protect the rights of individuals to obtain fair transaction terms and the supervision of mobile applications. As uncertainties remain regarding the interpretation and implementation of the PIPL, we cannot assure you that we will comply with the PIPL in all respects, or that regulatory authorities will not order us to rectify or terminate our current practice of collecting and processing sensitive personal information. We may also become subject to fines and other penalties which may have material adverse effect on our business, operations and financial condition.
On November 14, 2021, the CAC published a discussion draft of Regulations on the Administration of Cyber Data Security, or the Draft Measures for Internet Data Security, for public comments, which provides that data processors conducting the following activities shall apply for cybersecurity review: (i) merger, reorganization or division of internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests affects or may affect national security; (ii) listing abroad of data processors processing over one million users' personal information; (iii) listing in Hong Kong which affects or may affect national security; or (iv) other data processing activities that affect or may affect national security. The Draft Cyber Data Security Regulations also provide that operators of large internet platforms that set up headquarters, operation centers or R&D centers overseas shall report to the national cyberspace administration and competent authorities. In addition, the Draft Cyber Data Security Regulations also require that data processors processing important data or going public overseas shall conduct an annual data security self-assessment or entrust a data security service institution to do so, and submit the data security assessment report of the previous year to the local branch of the CAC before January 31 each year. As of the date of this annual report, this draft has not been formally adopted. Substantial uncertainties exist with respect to the enactment timetable, final content, interpretation and implementation.
The PRC government authorities also further enhanced the supervision and regulation of cross-border data transmission. On July 7, 2022, the CAC promulgated the Measures for the Security Assessment of Cross-border Data Transfer, which became effective on September 1, 2022. In accordance with such measures, data processors will be subject to security assessment conducted by the CAC prior to any cross-border transfer of data if the transfer involves (i) important data; (ii) personal information transferred overseas by operators of critical information infrastructure or a data processor that has processed personal data of more than one million persons; (iii) personal information transferred overseas by a data processor which has already provided personal data of 100,000 persons or sensitive personal data of 10,000 persons overseas since January 1 of the preceding year; or (iv) other circumstances as required by the CAC. In addition, any cross-border data transfer activities conducted in violation of the Measures for the Security Assessment of Cross-border Data Transfer before the effectiveness of such measures are required to be rectified within six months of the effectiveness date thereof. Since these measures are relatively new, there are still substantial uncertainties with respect to the interpretation and implementation of these measures in practice and how they will affect our business operation.
In addition, internet information in mainland China is regulated from a national security standpoint. According to the PRC National Security Law, institutions and mechanisms for national security review and administration will be established to conduct national security review on key technologies and IT products and services that affect or may affect national security. The PRC Data Security Law took effect in September 2021 and provides for a security review procedure for the data activities that may affect national security. It also introduces a data classification and hierarchical protection system based on the importance of data in economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used. The appropriate level of protection measures is required to be taken for each respective category of data. It is not clear under the Data Security Law what constitutes "important data" or "state critical data." If we are deemed to collect "important data" or "state critical data," we may need to adopt internal reforms in order to comply with the Data Security Law.
While we take measures to comply with applicable data privacy and protection laws and regulations, we cannot guarantee the effectiveness of the measures undertaken by us and business partners. The activities of third parties such as our customers and business partners are beyond our control. If our business partners violate the PRC Cybersecurity Law and related laws and regulations,or fail to fully comply with the service agreements with us, or if any of our employees fails to comply with our internal control measures and misuses the information, we may be subject to penalties. As part of the efforts by the Cyber Administration of China, MIIT and other regulators to enhance data protection, a wide number of apps and companies have been notified to enhance data privacy protection as of the date of this annual report, including certain iQIYI apps. Although we have updated the apps to comply with the requirements of the regulators to the best we can, we cannot guarantee you that we will not be subject to more similar rectification requests from the governmental authorities or that we will fully comply with all applicable rules and regulations at all times. Any failure or perceived failure to comply with all applicable data privacy and protection laws and regulations, or any failure or perceived failure of our business partners to do so, or any failure or perceived failure of our employees to comply with our internal control measures, may prevent us from using or providing certain network products and services, result in fines and other penalties such as suspension of our related business, closure of our website, mobile apps and smart TV apps and suspension of new downloads of our apps, as well as subjecting us to negative publicity and legal proceedings or regulatory actions and discouraging current and potential users and customers from using our services, which could have a material adverse effect on our business and results of operations.
As we gradually expand into overseas markets, we may be subject to laws and regulations of other countries regarding cybersecurity, information security, privacy and data protection. We strive to comply with local laws and regulations in markets where we have operations. For example, the General Data Protection Regulation, or the GDPR, of the European Union imposes obligations on companies regarding the handling of personal data and provides certain individual privacy rights to persons whose data is stored. The GDPR requires companies to submit personal data breach notifications to designated European privacy regulator in each country they have business operations, and includes significant penalties for non-compliance with the notification obligation as well as other requirements of the regulation. For another instance, some countries are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements, which, if adopted and implemented, could increase the cost and complexity of delivering our services. In addition, wherever we operate, we could be subject to new laws or regulations or the interpretation and application of existing consumer and data protection laws or regulations. These new laws, regulations and interpretations are often uncertain and in flux and may be inconsistent with our practices. We cannot guarantee that we will be able to maintain compliance at all times, especially in light of the fact that laws and regulations on cybersecurity and data protection are evolving. Our launch of new products or services or other actions that we may take may also subject us to additional laws, regulations, or other government scrutiny. Complying with these new or additional laws, regulations and requirements could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business.