We may become subject to a variety of laws and regulations in the PRC regarding privacy, data security, cybersecurity, and data protection. These laws and regulations are continuously evolving and developing. The scope and interpretation of the laws that are or may be applicable to us are often uncertain and may be conflicting, particularly with respect to foreign laws. In particular, there are numerous laws and regulations regarding privacy and the collection, sharing, use, processing, disclosure, and protection of personal information and other user data. Such laws and regulations often vary in scope, may be subject to differing interpretations, and may be inconsistent among different jurisdictions.
We expect to obtain information about various aspects of our operations as well as regarding our employees and third parties. The integrity and protection of our customers, employees and company data is critical to our business. Our customers, end users and employees expect that we will adequately protect their personal information. We are required by applicable laws to keep strictly confidential the personal information that we collect, and to take adequate security measures to safeguard such information.
The PRC Criminal Law, as amended by its Amendment 7 (effective on February 28, 2009) and Amendment 9 (effective on November 1, 2015), prohibits institutions, companies and their employees from selling or otherwise illegally disclosing a citizen's personal information obtained during the course of performing duties or providing services or obtaining such information through theft or other illegal ways. On November 7, 2016, the Standing Committee of the PRC National People's Congress issued the Cyber Security Law of the PRC, or Cyber Security Law, which became effective on June 1, 2017. Pursuant to the Cyber Security Law, network operators must not, without users' consent, collect their personal information, and may only collect users' personal information necessary to provide their services. Providers are also obliged to provide security maintenance for their products and services and shall comply with provisions regarding the protection of personal information as stipulated under the relevant laws and regulations.
The Civil Code of the PRC (issued by the PRC National People's Congress on May 28, 2020 and effective from January 1, 2021) provides main legal basis for privacy and personal information infringement claims under the Chinese civil laws. PRC regulators, including the Cyberspace Administration of China ("CAC"), MIIT, and the Ministry of Public Security have been increasingly focused on regulation in the areas of data security and data protection.
The PRC regulatory requirements regarding cybersecurity are constantly evolving. For instance, various regulatory bodies in China, including the CAC, the Ministry of Public Security and the SAMR, have enforced data privacy and protection laws and regulations with varying and evolving standards and interpretations. In April 2020, the Chinese government promulgated Cybersecurity Review Measures, which came into effect on June 1, 2020. According to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security.
In November 2016, the Standing Committee of China's National People's Congress passed China's first Cybersecurity Law ("CSL"), which became effective in June 2017. The CSL is the first PRC law that systematically lays out the regulatory requirements on cybersecurity and data protection, subjecting many previously under-regulated or unregulated activities in cyberspace to government scrutiny. The legal consequences of violation of the CSL include penalties of warning, confiscation of illegal income, suspension of related business, winding up for rectification, shutting down the websites, and revocation of business license or relevant permits. In April 2020, the CAC and certain other PRC regulatory authorities promulgated the Cybersecurity Review Measures, which became effective in June 2020. Pursuant to the Cybersecurity Review Measures, operators of critical information infrastructure must pass a cybersecurity review when purchasing network products and services which do or may affect national security. On July 10, 2021, the CAC issued a revised draft of the Measures for Cybersecurity Review for public comments ("Draft Measures"), which required that, in addition to "operator of critical information infrastructure," any "data processor" carrying out data processing activities that affect or may affect national security should also be subject to cybersecurity review, and further elaborated the factors to be considered when assessing the national security risks of the relevant activities, including, among others, (i) the risk of core data, important data or a large amount of personal information being stolen, leaked, destroyed, and illegally used or exited the country; and (ii) the risk of critical information infrastructure, core data, important data or a large amount of personal information being affected, controlled, or maliciously used by foreign governments after listing abroad. The CAC has said that under the proposed rules companies holding data on more than 1,000,000 users must now apply for cybersecurity approval when seeking listings in other nations because of the risk that such data and personal information could be "affected, controlled, and maliciously exploited by foreign governments." The cybersecurity review will also investigate the potential national security risks from overseas IPOs. We do not know what regulations will be adopted or how such regulations will affect we and our listing on Nasdaq. In the event that the Cyberspace Administration of China determines that we are subject to these regulations, we may be required to delist from Nasdaq and we may be subject to fines and penalties.
On June 10, 2021, the Standing Committee of the NPC promulgated the PRC Data Security Law, which took effect on September 1, 2021. The Data Security Law also sets forth the data security protection obligations for entities and individuals handling personal data, including that no entity or individual may acquire such data by stealing or other illegal means, and the collection and use of such data should not exceed the necessary limits. The costs of compliance with, and other burdens imposed by, CSL and any other cybersecurity and related laws may limit the use and adoption of our products and services and could have an adverse impact on our business.
Further, if the enacted version of the Measures for Cybersecurity Review mandates clearance of cybersecurity review and other specific actions to be completed by companies like us, we face uncertainties as to whether such clearance can be timely obtained, or at all.
After the new PRC Data Security Law was enacted in September, we are not subject to the cybersecurity review by the CAC, given that: (i) our products and services are offered not directly to individual users but through our business customers; (ii) we do not possess a large amount of personal information in our business operations; and (iii) data processed in our business does not have a bearing on national security and thus may not be classified as core or important data by the authorities. However, there remains uncertainty as to how the Draft Measures will be interpreted or implemented and whether the PRC regulatory agencies, including the CAC, may adopt new laws, regulations, rules, or detailed implementation and interpretation related to the Draft Measures. If any such new laws, regulations, rules, or implementation and interpretation comes into effect, we will take all reasonable measures and actions to comply and to minimize the adverse effect of such laws on us.
On August 20, 2021, the Standing Committee of the NPC approved the Personal Information Protection Law ("PIPL"), which became effective on November 1, 2021. The PIPL regulates collection of personal identifiable information and seeks to address the issue of algorithmic discrimination. Companies in violation of the PIPL may be subject to warnings and admonishments, forced corrections, confiscation of corresponding income, suspension of related services, and fines. We mainly interact with corporate clients and has limited interactions with individual end-users, which means our potential access or exposure to end-users' personal identifiable information is limited. However, in the event we inadvertently access or become exposed to end-users' personal identifiable information, through our corporate clients' end-user-facing applications which access or store end users' personal identifiable information, then we may face heightened exposure to the PIPL.
We cannot assure you that PRC regulatory agencies, including the CAC, would take the same view as we do, and there is no assurance that we can fully or timely comply with such laws. In the event that we are subject to any mandatory cybersecurity review and other specific actions required by the CAC, we face uncertainty as to whether any clearance or other required actions can be timely completed, or at all. Given such uncertainty, we may be further required to suspend our relevant business, shut down our website, or face other penalties, which could materially and adversely affect our business, financial condition, and results of operations.