We collect, store and process certain personal and other sensitive data from our customers. The massive data that we have processed and stored makes us or the third-party service providers who host our servers a target and potentially vulnerable to cyber-attacks, computer viruses, physical or electronic break-ins, or similar disruptions. The secure transmission of confidential information over the Internet is essential in maintaining customer confidence in us. We conduct a significant portion of our transactions through our website. We utilize digital certificates to help us conduct secure communications and transactions. In addition, sensitive customer information, such as password and payment information, is stored with encryption, and our data servers are secured with firewalls. However, advances in technology or other developments could result in a compromise or breach of the technology that we use to protect customer and transaction data. Any failure or perceived failure by us to prevent information security breaches or to comply with privacy policies or privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of personally identifiable information or other customer data, could cause our customers to lose trust in us, expose us to legal claims, and adversely affect our operating results. In addition, our security measures may not be sufficient to prevent security breaches. Any systems failure or compromise of our security that results in the unauthorized access to or release of our customers' data could significantly limit the delivery of our products and services, as well as harm our reputation and brand and, therefore, our business. We spend significant resources on technology and product development to protect against leakage of user information and other security breaches. Nonetheless, given its great commercial value, our customer data may still likely to be misused by third-parties, which could expose us to legal and regulatory risks and seriously harm our business.
There are numerous laws governing privacy and the storage, sharing, use, disclosure and protection of personally identifiable information and user data. Specifically, personally identifiable and other confidential information is increasingly subject to legislation and regulations in numerous domestic and international jurisdictions. On November 7, 2016, the Standing Committee of the National People's Congress issued the Cyber Security Law, which came into effect on June 1, 2017. The Cyber Security Law stipulates that a network operator, including internet information service provider among others, must adopt technical measures and other necessary measures in accordance with the applicable laws and regulations as well as compulsory national and industrial standards to safeguard the safety and stability of network operations, effectively respond to network security incidents, prevent illegal and criminal activities, and maintain the integrity, confidentiality and availability of network data. Although we take measures to comply with the Cyber Security Law and the applicable laws, regulations and standards, and we believe our current business operation is in line with the requirements under the Cyber Security Law and the applicable laws, regulations and standards, there can be no assurance that our measures will be effective and sufficient under the Cyber Security Law and the applicable laws, regulations and standards. If we were found by the regulatory authorities to have violated the Cyber Security Law and the applicable laws, regulations and standards, we would be subject to warnings, fines, confiscation of illegal revenue, revocation of licenses, cancellation of filings, shutdown of our platform or even criminal liability and our business, results of operations and financial condition would be materially adversely affected. In addition, the regulatory framework for privacy protection in China and worldwide is currently evolving and is likely to remain uncertain for the foreseeable future. For example, the Cyber Security Law sets high requirements for the operational security of facilities deemed to be part of the PRC's "critical information infrastructure." New laws or regulations concerning data protection, or the interpretation and application of existing consumer and data protection laws or regulations, which is often uncertain and in flux, may be inconsistent with our practices. If so, in addition to the possibility of violation of laws and fines imposed by regulatory authorities, this could result in an order requiring that we change our practices, which could have an adverse effect on our business and operating results. Complying with new laws and regulations could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business.
In December 2012, the Standing Committee of the National People's Congress enacted the Decision to Enhance the Protection of Network Information, or the Information Protection Decision, to further enhance the protection of users' personal information in electronic form. The Information Protection Decision provides that Internet information services providers must expressly inform their users of the purpose, manner and scope of the collection and use of users' personal information by Internet information services providers, publish the Internet information services providers standards for their collection and use of users' personal information, and collect and use users' personal information only with the consent of the users and only within the scope of such consent. The Information Protection Decision also mandates that Internet information services providers and their employees keep users' personal information that they collect strictly confidential, and that they must take such technical and other measures as are necessary to safeguard the information against disclosure, damages and loss. Pursuant to the Ninth Amendment to the Criminal Law issued by the Standing Committee of the National People's Congress in August 2015 and becoming effective in November 2015, any internet service provider that fails to fulfill the obligations related to internet information security administration as required by applicable laws and refuses to rectify upon orders, shall be subject to criminal penalty for the result of (i) any dissemination of illegal information in large scale; (ii) any severe effect due to the leakage of the client's information; (iii) any serious loss of criminal evidence; or (iv) other severe situation, and any individual or entity that (i) sells or provides personal information to others in a way violating the applicable law, or (ii) steals or illegally obtain any personal information, shall be subject to criminal penalty in severe situation. In August 2019, Cyberspace Administration of China promulgated Provisions on Online Protection of Children's Personal Information, or the Children Personal Information Provisions, which came into effect in October 2019. The Children Personal Information Provisions impose higher requirements on network operators in terms of protection of children's personal information, such as requiring network operators to adopt personal information protection rules and user agreements specifically for children's personal information and appoint persons dedicated to be responsible for the protection of children's personal information. In November 2019, Cyberspace Administration of China, together with other competent government authorities, published the Guidelines for Identifying Illegal Collection and Use of Personal Information via Apps, which describes 31 specific types of illegal collection or use of user's personal information, divided into six categories. See "Item 4.B. Information on the Company-Business Overview-PRC Regulation-Regulations on Internet Privacy". In July 2020, the Standing Committee of the National People's Congress of China released a draft data security law, or the Draft Data Security Law, for public comment. The Draft Data Security Law provides for data security and privacy obligations on entities and individuals carrying out data activities. The Draft Data Security Law also introduces a national security review procedure for those data activities which may affect national security and imposes export restrictions on certain data information. In October 2020, the Standing Committee of the National People's Congress of China released a draft personal information protection law, or the Draft Personal Information Protection Law, for public comment. The Draft Personal Information Protection Law provides for various requirements on personal information protection, including legal bases for data collection and processing, requirements on data localization and cross-border data transfer, requirements for consent and requirements on processing of sensitive personal information. As the Draft Data Security Law and Draft Personal Information Protection Law have not been formally adopted and the requirements in the final adopted laws remain subject to change, we may be required to make further adjustments to our business practices to comply with the enacted form of the laws. Compliance with current regulations and regulations that may come into effect in these areas may increase our expenses related to regulatory compliance, which could have an adverse effect on our financial condition and results of operations.
In addition to laws, regulations and other applicable rules regarding privacy and privacy advocacy, industry associations or other organizations may propose new privacy standards. Because the interpretation and application of privacy and data protection laws and privacy standards are still uncertain, it is possible that these laws or privacy standards may be interpreted and applied in a manner that is inconsistent with our practices. Any inability to adequately address privacy concerns, even if unfounded, or to comply with applicable privacy or data protection laws, regulations and privacy standards, could result in additional cost and liability to us, damage our reputation, inhibit the use of our platform and harm our business.