The regulatory framework for the collection, use, safeguarding, sharing, transfer and other processing of personal information and important data worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. For example, regulatory authorities in China have implemented and are considering a number of legislative and regulatory proposals concerning cybersecurity and data protection.
The PRC Cyber Security Law, which took effective in June 2017, created China's first national-level data protection regime for "network operators," which may include all organizations in China that provide services over the internet or another information network. Specifically, the Cyber Security Law provides that China adopts a multi-level protection scheme, under which network operators are required to perform obligations of security protection to ensure that the network is free from interference, disruption or unauthorized access, and prevent network data from being disclosed, stolen or tampered.
In addition, the PRC Data Security Law, which was promulgated by the Standing Committee of the National People's Congress on June 10, 2021 and took effect on September 1, 2021. The Data Security Law establishes a tiered system for data protection in terms of their importance, data categorized as "important data," which will be determined by governmental authorities in the form of catalogs, are required to be treated with higher level of protection. Specifically, the Data Security Law provides that operators processing "important data" are required to appoint a "data security officer" and a "management department" to take charge of data security. In addition, such operator is required to evaluate the risk of its data activities periodically and file assessment reports with relevant regulatory authorities.
Numerous regulations, guidelines and other measures have been or are expected to be adopted under the umbrella of, or in addition to, the Cyber Security Law and Data Security Law. For example, Regulations on the Security Protection of Critical Information Infrastructure, or the CII Protection Regulations, was promulgated by the State Council of the PRC on July 30, 2021 and became effective on September 1, 2021. According to the CII Protection Regulations, critical information infrastructure, or the CII, refers to any important network facilities or information systems of the important industry or field such as public communication and information service, energy, transportation, water conservancy, finance, public services, e-government affairs and national defense science, which may endanger national security, people's livelihood and public interest in the case of damage, function loss or data leakage. Regulators supervising specific industries are required to formulate detailed guidance to recognize the CII in the respective sectors, and a critical information infrastructure operator, or a CIIO, must take the responsibility to protect the CII's security by performing certain prescribed obligations. For example, CIIOs are required to conduct network security test and risk assessment, report the assessment results to relevant regulatory authorities, and timely rectify the issues identified at least once a year.
Additionally, in November 2021, the CAC issued the Cyber Data Security Administration Regulations (Draft for Comments), which, among other things, stipulates that a data processor that process "important data" or listed overseas must conduct an annual data security review by itself or by engaging a data security service provider and submit the annual data security review report for a given year to the relevant municipal counterpart of the CAC before January 31 of the following year. As of the date of this annual report, such administration regulations have not been adopted. In January 2022, the CAC and several other administrations also jointly promulgated the amended Cybersecurity Review Measures, or the Cybersecurity Review Measures, which became effective on February 15, 2022, and supersede and replace the current cybersecurity review measures that became effective since June 2020. Pursuant to the Cybersecurity Review Measures, a "critical information infrastructure operator", or a CIIO, that purchases network products and services, or conducts data process activities, which affect or may affect national security will be subject to the cybersecurity review. The Cybersecurity Review Measures also expands the cybersecurity review to "internet platform operators" in possession of personal information of over one million users if such operators intend to list their securities in a foreign country. See "-Risks Related to Doing Business in China-The approval, filing or other requirements of the CSRC or other PRC government authorities may be required under PRC law in connection with our issuance of securities overseas." Alternatively, relevant governmental authorities in the PRC may initiate cybersecurity review if they determine an operator's network products or services or data processing activities affect or may affect national security.
Furthermore, the recently issued Opinions on Strictly Cracking Down on Illegal Securities Activities requires (i) speeding up the revision of the provisions on strengthening the confidentiality and archives management relating to overseas issuance and listing of securities and (ii) improving the laws and regulations relating to data security, cross-border data flow, and management of confidential information. The Personal Information Protection Law, which was promulgated by the Standing Committee of the National People's Congress on August 20, 2021 and took effect on November 1, 2021, integrates the various rules with respect to personal information rights and privacy protection and applies to the processing of personal information within mainland China as well as certain personal information processing activities outside mainland China, including those for the provision of products and services to natural persons within China or for the analysis and assessment of acts of natural persons within China.
We may have access to confidential or personal information in certain of our businesses. Although we endeavor to comply with our privacy policies and other documentation regarding the protection of personal information, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees or contractors fail to comply with these policies and documentation.
Moreover, the Cyber Security Law, Data Security Law and relevant regulations are relatively new, uncertainties still exist in relation to their interpretation and implementation. Any change in laws and regulations relating to privacy, data protection and information security and any enhanced and scrutinized governmental enforcement action of such laws and regulations could greatly increase our cost in providing our products and services, limit their use or adoption or require certain changes to be made to our operations. We cannot assure you that we will be compliant with these new laws and regulations described above in all respects, and we may be ordered to rectify and terminate any actions that are deemed illegal by the government authorities and become subject to fines and other government sanctions, which may materially and adversely affect our business, financial condition, and results of operations.
Specifically, given the uncertainties surrounding the interpretation and implementation of the Cyber Security Law, Data Security Law and relevant regulations, we cannot rule out the possibility that we, or certain of our customers or suppliers may be deemed as a CIIO, or an operator processing "important data." First, if we are deemed as a CIIO, our purchase of network products or services, if deemed to be affecting or may affect national security, will need to be subject to cybersecurity review, before we can enter into agreements with relevant customers or suppliers, and before the conclusion of such procedure, these customers will not be allowed to use our products or services, and we are not allowed to purchase products or services from our suppliers. There can be no assurance that we would be able to complete the applicable cybersecurity review procedures in a timely manner, or at all, if we are required to follow such procedures. Any failure or delay in the completion of the cybersecurity review procedures may prevent us from using certain network products and services, and may result in fines of up to ten times the purchase price of such network products and services being imposed upon us, if we are deemed a CIIO using network products or services without having completed the required cybersecurity review procedures. If the reviewing authority is of the view that the use of such network products or services by us, or by certain of our customers or suppliers, involves risk of disruption, is vulnerable to external attacks, or may negatively affect, compromise, or weaken the protection of national security, we may not be able to provide such products or services to relevant customers, or purchase products or services from relevant suppliers. This could have a material adverse effect on our results of operations and business prospects. Second, the notion of "important data" is not clearly defined by the Cyber Security Law or the Data Security Law. In order to comply with the statutory requirements, we will need to determine whether we possess important data, monitor the important data catalogs that are expected to be published by local governments and departments, perform risk assessments and ensure we are complying with reporting obligations to applicable regulators. We may also be required to disclose to regulators business-sensitive or network security-sensitive details regarding our processing of important data, and may need to pass the government security review or obtain government approval in order to share important data with offshore recipients, which can include foreign licensors, or share data stored in China with judicial and law enforcement authorities outside of China. If judicial and law enforcement authorities outside China require us to provide data stored in China, and we are not able to pass any required government security review or obtain any required government approval to do so, we may not be able to meet the foreign authorities' requirements. The potential conflicts in legal obligations could have adverse impact on our operations in and outside of China.