On December 8, 2022, the CAC promulgated the Administrative Measures on Data Security in the Field of Industry and Information Technology (for Trial Implementation), or the Administrative Measures, which became effective on January 1, 2023. According to the Administrative Measures, the data in the field of industry and information technology are divided into three levels, namely general data, important data and core data, based on the degree of hazard caused to national security, public interests or the legitimate rights and interests of individuals and organizations due to the tampering, destruction, leakage or illegal acquisition or illegal use of data. The data for the degree of hazard meeting any of the following conditions is important data: (i) posing threats to politics, land, military, economy, culture, society, science and technology, electromagnetism, network, ecology, resources, nuclear security, etc., and affecting overseas interests, biology, outer space, polar region, deep sea, artificial intelligence and other key fields related to national security; (ii) having a serious impact on the development, production, operation and economic interests of the field of industry and information technology; (iii) causing major data security incidents or work safety accidents, with a serious impact on public interests or the legitimate rights and interests of individuals and organizations, with great adverse social impact; (iv) triggering obvious cascading effects, with the scope of impact involving multiple industries, regions or multiple enterprises within an industry, or the impact lasting for a long time, and having a serious impact on the industrial development, technological progress, industrial ecology, etc.; and (v) other important data evaluated and determined by the MIIT. The data for the degree of hazard meeting any of the following conditions is core data: (i) posing serious threats to politics, land, military, economy, culture, society, science and technology, electromagnetism, network, ecology, resources, nuclear security, etc., and seriously affecting overseas interests, biology, outer space, polar region, deep sea, artificial intelligence and other key fields related to national security; (ii) having a significant impact on the field of industry and information technology and the important backbone enterprises, critical information infrastructure, important resources, etc. thereof; (iii) causing material damage to industrial production and operation, operation services of telecommunications network and Internet, development of radio business, etc., resulting in large-scale shutdown and production suspension, large-scale radio business interruption, large-scale network and service breakdown, loss of large amount of business handling capacity, etc.; and (iv) other core data evaluated and determined by the MIIT. The data handlers in the field of industry and information technology, refer to industrial enterprises, software and information technology service providers, telecommunications business operators obtaining a license for operation of telecommunications business, entities using radio frequencies and stations and other subjects in the field of industry and information technology that independently determine handling purposes and handling methods in the data handling activities, shall file their catalogues of important data and core data with the local industrial regulatory authorities for the record.
The Group has been making constant efforts to comply with the above PRC laws and regulations on cybersecurity and censorship. Any failure or delay in the completion of the cybersecurity review procedures or any other non-compliance with the related laws and regulations may result in fines or other penalties, including suspension of business, website closure, removal of the Group’s app from app stores, and revocation of licenses, as well as reputational damage or legal proceedings or actions against the Group, which may have a material adverse effect on the Group’s business, financial condition or results of operations. See “Item 3. Key Information — D. Risk Factors — Risks Relating to Our Industry and Business — We may be subject to cybersecurity review by regulatory authorities of the PRC in the future.”
Regulation on Privacy Protection
On December 28, 2012, the SCNPC enacted the Decision to Enhance the Protection of Network Information, or the Information Protection Decision, to enhance the protection of User Personal Information in electronic form. The Information Protection Decision provides that Internet services providers must expressly inform their users of the purpose, manner and scope of the Internet services providers’ collection and use of User Personal Information, publish the Internet services providers’ standards for their collection and use of User Personal Information, and collect and use User Personal Information only with the consent of the users and only within the scope of such consent. The Information Protection Decision also mandates that Internet services providers and their employees must keep strictly confidential User Personal Information that they collect, and that Internet services providers must take such technical and other measures as are necessary to safeguard the information against disclosure.
Under the Several Provisions on Regulating the Market Order of Internet Information Services, issued by the MIIT on December 29, 2011 and became effective on March 15, 2012, an Internet information service provider may not collect any user personal information or provide any such information to third parties without the consent of a user, unless otherwise provided by laws or regulations. And the Internet information service provider must expressly inform the users of the method, content and purpose of the collection and processing of such user’s personal information and may only collect and use such information as necessary for the provision of its services. An Internet information service provider is also required to properly maintain the user’s personal information, and in case of any leak or possible leak of the user’s personal information, the Internet information service provider must take immediate remedial measures and, in severe circumstances, make an immediate report to the relevant telecommunications regulatory authority.
96