For the protection of personal information, network operators like us may not disclose or tamper with personal information that we have collected, and we are obligated to store the personal information and important business data collected or generated in the course of operations within the country within PRC territory, to remove unlawfully collected information and to amend incorrect information. Moreover, we may not provide personal information to third parties without prior consent. See “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—Our business generates and processes a large amount of data, and we are required to comply with PRC laws relating to cyber security. The improper use or disclosure of data could have a material and adverse effect on our business and prospects.”
Regulations on Mobile Applications
The APP Provisions provide that mobile Internet application providers and app store service providers shall not use the apps to (i) conduct any unlawful activity that jeopardizes the national security, disrupts the social order, infringes others’ legitimate rights and interests, or (ii) produce, duplicate, publish or disseminate any information content prohibited by laws and regulations.
On December 16, 2016, the MIIT promulgated the Interim Administrative Provisions on the
Pre-installation
and Distribution of Mobile Smart Terminal Application Software, or the
Pre-installation
Provisions, effective as of July 1, 2017. The
Pre-installation
Provisions stipulate a set of compliance requirements related to
pre-installation
apps (i.e., mobile smart terminal application software). For example, provider of internet information services shall, according to laws and regulations, provide the apps, and take effective measures to safeguard network security, in order to effectively protect the legitimate rights and interests of users and ensure that the apps other than the basic functional software can be uninstalled.
Regulations on Account Names of Internet Users
On February 4, 2015, the CAC promulgated the Administrative Provisions on the Account Names of Internet Users, which became effective as of March 1, 2015. These provisions strengthened the administration of the account names of internet users. In addition to the authentication requirement for the real identity of internet users by requiring users to provide real name in backstage during the registration process, these provisions specifically require that any internet information service provider shall enhance security administration, perfect the user service agreement, purge any illegal or malicious information from account names, photos, personal profiles and user registration information. Service providers must employ specialized personnel in proportion to its service scale, to (i) review account names, photos, personal profile and all relevant user registration information of internet users, (ii) deregister account names containing illegal and malicious information, and (iii) protect the information of the users, accept the supervision from the public, and purge the illegal and malicious information in account names, photos, self-introductions and other registration-related information reported by the public in a timely manner.
On August 31, 2018, the SCNPC promulgated the PRC
E-Commerce
Law, or the
E-Commerce
Law, which became effective on January 1, 2019. The
E-Commerce
Law establishes the regulatory framework for the
e-commerce
sector in the PRC for the first time by laying out certain requirements on
e-commerce
operators, including
e-commerce
platform operators like us. Pursuant to the
E-Commerce
Law,
e-commerce
platform operators are required to (i) take necessary actions or report to relevant competent government authorities when such operators notice any illegal production or services provided by merchants on the
e-commerce
platforms; (ii) verify the identity of the business operators on the platforms; (iii) provide identity and tax related information of merchants to local branches of State Administration of Market Regulation and tax bureaus; or (iv) record and preserve goods and service information and transaction information on the
e-commerce
platform. The
E-Commerce
Law also specifically stipulates that
e-commerce
platform operators shall not impose unreasonable restrictions or conditions on the transactions of their business operators on the platforms. According to the
E-Commerce
Law, failures to comply with these requirements may subject the
e-commerce
platform operators to administrative penalties, fines and/or suspension of business. In addition, for goods and services provided via
e-commerce
platforms and pertinent to the life and health of consumers,
e-commerce
platform operators shall bear relevant responsibilities, which may give rise to civil or criminal liabilities if the consumers suffered damages due to the
e-commerce
platform operators’ failure to duly verify the qualifications or the licenses of the business operators on the platforms or to duly perform their safety protection obligations as required by the
E-Commerce
Law.
Moreover, the
E-Commerce
Law imposes a requirement on operators of
e-commerce
platforms to assist in tax collection with respect to income generated by sellers from transactions conducted on
e-commerce
platforms, including among others, submitting to the tax authority information on the identities of sellers on
e-commerce
platforms and other information relating to tax payment. Failure to comply with the requirement may result in operators of
e-commerce
platform being subject to fines and, in severe circumstances, suspension of business operations of
e-commerce
platforms.