We routinely collect, store and use personal information and other data during the ordinary course of our business. If we are unable to protect such personal information and other data from unauthorized access, use, disclosure, disruption, modification, or destruction, such security breaches or issues may subject us to economic losses, legal liabilities to the owners or subjects of compromised information or data, or fines and other penalties. In addition, complying with various laws and regulations could cause us to incur substantial costs or require us to change our business practices, including our data practices, in a manner adverse to our business.
In general, we expect that data security and data protection compliance will receive greater attention and focus from regulators, both domestically and globally, as well as attract continued or greater public scrutiny going forward, which could increase our compliance costs and subject us to heightened risks and challenges associated with data security and protection. If we are unable to manage these risks, we could become subject to penalties, including fines, suspension of business and revocation of required licenses, and our reputation and results of operations could be materially and adversely affected.
The regulatory and enforcement regime of China with regard to data security and data protection is evolving and may be subject to different interpretations or significant changes. Moreover, various PRC legislative and regulatory bodies, including the Standing Committee of the PRC National People's Congress, or the NPC, the MIIT, the CAC, the Ministry of Public Security and the SAMR have enforced data privacy and protections laws and regulations with varying standards and applications. We are subject to PRC laws and regulations governing the collection, storing, sharing, using, processing, disclosure and protection of personal information and other data on the internet and mobile platforms including, without limitation, the PRC Civil Code, the PRC Cybersecurity Law, the PRC Data Security Law and the PRC Personal Information Protection Law. See "Item 4. Information on the Company-B. Business Overview-PRC Regulations-Laws of Protection of Personal Information of Citizen" and "-Cybersecurity and Data Security." The following are examples of certain recent PRC regulatory activities in this area:
Cybersecurity and Data Security - In June 2021, the Standing Committee of the NPC promulgated the PRC Data Security Law, which took effect in September 2021. The PRC Data Security Law, among other things, provides for security review procedures for data-related activities that may affect national security. In January 2022, the CAC, together with other government authorities, jointly promulgated the Revised Cybersecurity Review Measures, which became effective on February 15, 2022 and replaces its predecessor regulation. Pursuant to the Revised Cybersecurity Review Measures, CIIOs that procure internet products and services and network platform operators engaging in data processing activities must be subject to the cybersecurity review if their activities affect or may affect national security. The Cybersecurity Review Measures further stipulates that any network platform operator that holds personal information of over one million users shall apply with the Cybersecurity Review Office for a cybersecurity review before listing abroad. In August 2021, the state council promulgated the Regulations on Critical Information Infrastructure Security Protection, which became effective on September 1, 2021. Pursuant to this regulation, critical information infrastructure means key network facilities or information systems of critical industries or sectors, such as public communications and information services, energy, transportation, water conservation, finance, public services, e-government affairs and national defense science, the damage, malfunction or data leakage of which may endanger national security, national economy and public interests. Relevant government authorities for each critical industry and sector shall be responsible for formulating eligibility criteria and determining the scope of CIIOs in the respective industry or sector, and such operators will be informed of the final determinations as to whether they are categorized as CIIOs. As of the date of this annual report, no implementation rules have been issued by any government authority, and we have not been informed by any government authority that we are a CIIO. Furthermore, the exact scope of CIIOs under the current regulatory regime remains unclear, and the PRC government authorities have wide discretion in the interpretation and enforcement of applicable laws and regulations. We cannot assure you that we will not be deemed to be a CIIO under PRC laws. If we were so deemed, we may be subject to additional obligations and incur additional compliance costs under the cybersecurity PRC laws and regulations.
- In November 2021, the CAC released the Draft Data Security Regulations, which provides that data processors refer to individuals or organizations that, during their data processing activities such as data collection, storage, utilization, transmission, publication and deletion, have autonomy over the purpose and manner of data processing. In accordance with the Draft Data Security Regulations, data processors shall apply for a cybersecurity review for certain activities, including, among other things, (i) the listing abroad of data processors that process the personal information of more than one million individuals and (ii) any data processing activity that affects or may affect national security. However, there have been no clarifications from the relevant authorities as of the date of this annual report as to the standards for determining whether an activity is one that "affects or may affect national security." In addition, the Draft Data Security Regulations requires that data processors that process "important data" or are listed overseas must conduct an annual data security assessment by itself or commission a data security service provider to do so, and submit the assessment report of the preceding year to the municipal cybersecurity department by the end of January each year. As of the date of this annual report, the Draft Data Security Regulations was released for public comment only, and their respective provisions and anticipated adoption or effective date may be subject to changes with substantial uncertainty.
- On July 7, 2022, the CAC promulgated the Security Assessment Measures for Outbound Data Transfer, or the Outbound Data Transfer Measures, effective from September 1, 2022, to regulate outbound data transfer activities, protect the rights and interests of personal information, safeguard national security and social public interests, and promote the cross-border security and free flow of data. On March 22, 2024, the CAC published the Provisions on Promoting and Regulating Cross-border Data Flow, which streamline and provide clarity to the governance framework for outbound data transfer.
Personal Information and Privacy - The Anti-Monopoly Guidelines for the Platform Economy Sector published by the Anti-monopoly Committee of the State Council, effective on February 7, 2021, prohibits the collection of user information through coercive means by operators of online platforms.
- In August 2021, the Standing Committee of the NPC promulgated the PRC Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights and privacy protection and took effect on November 1, 2021. The Personal Information Protection Law elevates the protection requirements for personal information processing, and many specific requirements of this law remain to be clarified by the CAC, other regulatory authorities, and courts in practice. We may be required to make further adjustments to our business practices to comply with applicable laws and regulations concerning the protection of privacy and personal information.
Many of the data-related legislations are relatively new and certain concepts thereunder remain subject to interpretations by the regulators. If any data that we possess belongs to data categories that are subject to heightened regulatory scrutiny, we may be required to adopt stricter measures for protecting and managing such data. The Revised Cybersecurity Review Measures and the Draft Data Security Regulations remain unclear on whether relevant requirements will be applicable to companies that are already listed in the United States, such as us. We continue to closely monitor and assess any development in the rule-making processes, we cannot predict the impact of the Revised Cybersecurity Review Measures or the Draft Data Security Regulations, if any, at this stage. If the Cybersecurity Review Measures and the enacted version of the Draft Data Security Regulations mandate clearance of cybersecurity reviews and other specific actions to be taken by issuers like us, we face uncertainties as to whether these additional procedures can be completed by us in a timely manner, or at all, which may subject us to government enforcement actions and investigations, fines, penalties, or orders to suspend non-compliant operations or remove our mobile apps from relevant app stores, and materially and adversely affect our business and results of operations. As of the date of this annual report, we have not been involved in any formal investigations or cybersecurity reviews conducted by the CAC on such basis.
In general, compliance with existing PRC laws and regulations, as well as additional laws and regulations that PRC government authorities may enact in the future, related to data security, cybersecurity and personal information protection, may subject us to additional costs and negative publicity, which could harm our reputation and business operations. As advised by our PRC counsel, there are uncertainties with respect to how such PRC laws and regulations will be implemented and interpreted in practice as they are relatively new. We may need to adjust our business or take additional measures to comply with the evolving laws and regulations concerning data security, cybersecurity and personal information protection.
In addition, government authorities around the world have adopted or are considering legislative and regulatory proposals concerning data protection. These legislative and regulatory proposals, if adopted, and the uncertain interpretations and applications thereof could subject us to fines, penalties or government orders requiring that we change our data practices and policies, which could have a material adverse effect on our business and results of operations. For example, the GDPR, which came into effect on May 25, 2018, includes operational requirements for companies that receive or process personal data of residents of the European Economic Area, which primarily covers members states of the European Union and certain countries of the European Free Trade Association. The GDPR establishes new requirements applicable to the processing of personal data, affords new data protection rights to individuals and imposes penalties for serious data breaches. Individuals also have a right to compensation under the GDPR for financial or non-financial losses. In the event that residents of the European Economic Area access our websites or mobile apps and input protected information, we may become subject to provisions of the GDPR.