Our business generates and processes a large amount of data. We face risks inherent in handling and protecting them. In particular, we face a number of challenges relating to data from transactions and other activities on our platforms, including:
- protecting the data in and hosted on our system, including against attacks on our system by outside parties or fraudulent behavior or improper use by our employees;- addressing concerns related to privacy and sharing, safety, security and other factors; and - complying with applicable laws and regulations relating to the collection, use, storage, transfer, disclosure and security of personal data, including any requests from regulatory and government authorities relating to these data.
The PRC regulatory and enforcement regime relating to data security and data protection is evolving and may be subject to different interpretations or substantive changes. Moreover, different PRC regulatory bodies, including the Standing Committee of the NPC, the Ministry of Industry and Information Technology, or the MIIT, the CAC, the Ministry of Public Security, or the MPS, and the SAMR, have enforced data privacy and protections laws and regulations with varying standards and applications. See "Item 4. Information on the Company-B. Business Overview-Regulation-Regulations Relating to Internet Information Security and Privacy Protection." The following are examples of certain recent PRC regulatory activities in this area:
Cybersecurity and Data Security - PRC authorities have promulgated a number of laws and regulations relating to cybersecurity and data security in the past year. In June 2021, the Standing Committee of the NPC promulgated the Data Security Law, which took effect on September 1, 2021. In July 2021, the state council promulgated the Regulations on the Protection of Critical Information Infrastructure, which became effective on September 1, 2021. In December 2021, the CAC, together with other authorities, jointly promulgated the Cybersecurity Review Measures, which became effective on February 15, 2022. These laws and regulations impose cybersecurity review obligations on critical information infrastructure operators and network platform operators. Under the Regulations on the Protection of Critical Information Infrastructure, "critical information infrastructure" is defined as those network facilities or information systems that may endanger national security, people's livelihoods and the public interest if such facilities or systems were to experience data breaches, damage, or system malfunctions. In particular, the network facilities or information systems used in certain critical industries or sectors (such as telecommunications, energy, transportation, finance, public services and national defense) are considered critical information infrastructure. Critical information infrastructure operators, as determined and notified by the applicable governing authorities, are required to undergo cybersecurity reviews if they procure network products and services which could affect the security of their information infrastructure, network or data. As of the date of this annual report, we have not received any notice that we are a critical information infrastructure operator by any government authority. Under the Cybersecurity Review Measures, any network platform operator that holds personal data of more than one million users must apply for a cybersecurity review before it makes any public offering on a foreign stock exchange. As these laws and regulations are relatively new, certain concepts thereunder, including the exact scope of the term "critical information infrastructure operators" and "network platform operators," remain subject to further clarification. Therefore, it is uncertain whether we would be deemed to be a critical information infrastructure operator or a network platform operator under PRC law and become subject to the relevant PRC cybersecurity laws and regulations.
- In addition to the currently effective laws and regulations described above, PRC authorities may adopt additional laws and regulations in the future that further heighten the regulation of data security. For example, in November 2021, the CAC released a consultation draft of the Regulations on Network Data Security Management, or the Draft Network Data Security Regulations, for public comment. These regulations create cybersecurity review obligations for data processors, which are broadly defined as individuals or organizations that have discretion in deciding the objectives and means of their data processing activities, such as data collection, storage, utilization, transmission, publication and deletion. In particular, pursuant to the Draft Network Data Security Regulations, a data processor must apply for cybersecurity review if, among others, it (i) seeks a public offering on a foreign stock exchange and processes the data of more than one million users, (ii) it seeks a Hong Kong listing that affects or may affect national security, or (iii) otherwise conducts data processing activities that affect or may affect national security. However, as of the date of this annual report, there have been no clarifications from the relevant authorities as to the standards for determining whether an activity is one that "affects or may affect national security." In addition to the foregoing cybersecurity review obligations, the Draft Network Data Security Regulations also proposed to create a system of annual data security self-assessments, whereby data processors that (i) process "important data" or (ii) are listed overseas must conduct an annual data security assessment, and submit the annual assessment report to the applicable municipal cybersecurity department by the end of January in the following year. As of the date of this annual report, the Draft Network Data Security Regulations have only been released for public comment, and their respective provisions and anticipated adoption or effective date remain subject to change with substantial uncertainty. However, if such regulations were to be adopted in their current form, we would be subject to additional regulatory obligations with respect to data security, and may face challenges in addressing their requirements and amending our internal data processing policies and practices to ensure compliance therewith.
Personal Data and Privacy - The Anti-monopoly Guidelines for the Platform Economy Sector published by the Anti-monopoly Committee of the State Council, effective February 7, 2021, prohibit collection of user information through coercive means by online platforms operators.
- In August 2021, the Standing Committee of the NPC promulgated the Personal Information Protection Law, which unified a number of hitherto separate rules with respect to personal information rights and privacy protection, and took effect on November 1, 2021. The Personal Information Protection Law strengthened the protection of personal information. As a general principle, the processing of personal data must be directly related to a specific and reasonable purpose and the related collection of personal information must be tailored to what is necessary to meet that purpose. The Personal Information Protection Law also created a number of specific requirements for the processing of personal data. For example, the law prohibits any person that processes personal data from engaging in price discrimination or otherwise applying unreasonable differential treatment to individuals based on automated analysis of collected personal information. To meet the latest regulatory requirements of the PRC authorities, we update our privacy policies from time to time and adopt technical measures to protect data and ensure that we systematically protect personal information rights. However, many of the specific requirements of the Personal Information Protection Law remain to be clarified by the CAC, other regulatory authorities, and courts in practice. We may be required to make further adjustments to our business practices to comply with personal information protection laws and regulations.
There are uncertainties with respect to how such PRC laws and regulations will be implemented and interpreted in practice. Many data-related laws and regulations are relatively new and certain concepts thereunder remain subject to interpretation by the regulators. We are subject to heightened scrutiny and required to adopt stricter measures to protect and manage certain categories of data, such as sensitive personal information as defined under Personal Information Protection Law. Some of the provisions under the Cybersecurity Review Measures and the Draft Network Data Security Regulations remain unclear on whether they are, or will be, applicable to companies that are already listed in the United States, such as us. However, if the Cybersecurity Review Measures and the enacted version of the Draft Network Data Security Regulations mandate that issuers like us must clear cybersecurity review or obtain other regulatory approvals for their previous issuances of securities in the United States or future offerings, it is unclear whether we would be able to complete such regulatory procedures in a timely fashion, or at all. Failure to do so may subject us to government actions, investigations, fines, penalties, suspension of our operations or removal of our apps from the relevant application stores, which could have a material and adverse effect on our business and results of operations. In sum, complying with PRC laws and regulations relating to data security and personal information protection may be costly and result in additional expenses to us, and may subject us to negative publicity and harm our reputation and business operations.
In addition to regulations in the PRC, regulatory authorities around the world have adopted or are considering a number of legislative and regulatory proposals concerning data protection. These legislative and regulatory proposals, if adopted, and the uncertain interpretations and application thereof could, in addition to the possibility of fines, result in an order requiring that we change our data practices and policies, which could have an adverse effect on our business and results of operations. For example, the European Union General Data Protection Regulation ("GDPR"), which came into effect on May 25, 2018, includes operational requirements for companies that receive or process personal data of residents of the European Economic Area. The GDPR establishes new requirements applicable to the processing of personal data, affords new data protection rights to individuals and imposes penalties for serious data breaches. Individuals also have a right to compensation under the GDPR for financial or non-financial losses. Although we do not conduct any business in the European Economic Area, in the event that residents of the European Economic Area access our website or our mobile platform and input protected information, we may become subject to provisions of the GDPR.