cybersecurity, data privacy, data protection and other laws and regulations related to data, including those relating to the collection, use, sharing, retention, security, disclosure, and transfer of confidential and private information, such as personal information and other data. These laws and regulations apply not only to third-party transactions, but also to transfers of information within our organization. These laws and regulations may restrict our business activities and require us to incur increased costs and efforts to comply, and any breach or noncompliance may subject us to proceedings against us, damage our reputation, or result in penalties and other significant legal liabilities, and thus may materially and adversely affect our business, financial condition, and results of operations.
Our customers, suppliers and staff have a high expectation that we will adequately protect their personal information. Such collection, use and/or transmission of personal data are governed by privacy laws and regulations and such laws and regulations change often, vary significantly by jurisdiction and often are newly enacted. For example, the European Union (EU)’s General Data Protection Regulation (“GDPR”), which became effective in May 2018, requires companies to meet new and more stringent requirements regarding the handling of personal data. The GDPR may also capture data processing by non-EU firms with no EU establishment if, for example, they conduct direct marketing that specifically targets individuals in the EU. As GDPR is a newly enacted law, there is limited precedence on the interpretation and application of GDPR.
In some jurisdictions, including mainland China where we do not currently have operations, the cybersecurity, data privacy, data protection, or other data-related laws and regulations are relatively new and evolving, and their interpretation and application may be uncertain. For example, on July 10, 2021, the Cybersecurity Administration of China, or CAC, publicly issued the Measures for Cybersecurity Censorship (Revised Draft for Comments), which aims to, upon its enactment, replace the existing Measures for Cybersecurity Censorship. The draft measures extend the scope of cybersecurity review to data processing operators engaging in data processing activities that affect or may affect national security, including overseas listings. Specifically, the draft measures require “critical information infrastructure” or data processors holding over one million users’ personal information to apply for a cybersecurity review before any public offering at a foreign stock exchange. Currently, the period for public comment on the draft measures has ended, and the draft measures’ implementation provisions and anticipated adoption or effective date remain substantially uncertain. We cannot predict the impact of the draft measures on us, if any, at this stage, and we will closely monitor and assess any development in the rule-making process. If the enacted version of the draft measures mandates clearance of cybersecurity review and other specific actions to be completed by companies operating in Macau like us, we face uncertainties as to whether such clearance can be timely obtained, or at all.
As of the date of this prospectus, we do not have any operations or maintain any office or personnel in mainland China. We have not collected, stored, or managed any personal information in mainland China. As such, we currently do not expect the draft measures by the CAC or other recent regulations will have an impact on our business or results of operations. However, we still face uncertainties regarding the interpretation and implementation of these laws and regulations in the future. Cybersecurity review could result in disruption in our operations, negative publicity with respect to our company, and diversion of our managerial and financial resources. Therefore, potential cybersecurity review, if applicable to us, could materially and adversely affect our business, financial condition, and results of operations.
In addition, the PRC Data Security Law, which was promulgated by the Standing Committee of the National People’s Congress on June 10, 2021 and took effect on September 1, 2021, requires data collection to be conducted in a legitimate and proper manner, and stipulates that, for the purpose of data protection, data processing activities must be conducted based on data classification and hierarchical protection system for data security. Furthermore, the recently issued Opinions on Strictly Cracking Down Illegal Securities Activities
12