Outside of the EU, we continue to see increased regulation of privacy cybersecurity and data protection, including the adoption of more strict laws with more stringent subject matter specific state laws in the United States and with a broader scope in the PRC. For example, in 2018, California enacted the CCPA, which took effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Additionally, a new privacy law, the California Privacy Rights Act, or CPRA, was approved by California voters in the November 3, 2020 election. The CPRA will generally take effect on January 1, 2023 and significantly modify the CCPA, including by expanding consumers’ rights with respect to certain personal information and creating a new state agency to oversee implementation and enforcement efforts, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. Aspects of the CCPA, the CPRA, and their interpretation remain uncertain. The CCPA, CPRA, and similar laws may increase our compliance costs and potential liability, and we may be required to modify our practices and take additional steps in an effort to comply with them. Some observers have noted that the CCPA and CPRA could mark the beginning of a trend toward more stringent state privacy legislation in the United States, which could increase our potential liability and adversely affect our business. For example, on March 2, 2021, Virginia enacted the Virginia Consumer Data Protection Act, or CDPA, a comprehensive privacy statute that shares similarities with the CCPA, CPRA and legislation proposed in other states. The CDPA will require us to incur additional costs and expenses in an effort to comply with it before it becomes effective on January 1, 2023. Broad federal privacy legislation also has been proposed in the United States. Recent and new state and federal legislation relating to privacy may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment in resources to compliance programs, could impact strategies and availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.
In recent years, the PRC government has increasingly tightened the regulation of data privacy and data protection. The laws, regulations and governmental policies in the PRC for the data privacy and data protection are constantly evolving. For example, in June 2017, the PRC Cybersecurity Law promulgated by the Standing Committee of the National People’s Congress, or the SCNPC, took effect. The PRC Cybersecurity Law requires network operators to perform certain functions related to cybersecurity protection. In addition, the PRC Cybersecurity Law provides that the critical information infrastructure operators generally shall, during their operations in the PRC, store the personal information and important data collected and produced within the territory of PRC, and shall conduct security assessment for cross-border data transfer. On June 10, 2021, the SCNPC promulgated the PRC Data Security Law, which took effect in September 2021. The Data Security Law imposes data security and privacy obligations on entities and individuals carrying out data activities, including but not limited to the collection, storage, use, processing, transmission, provision, and public disclosure of data. The PRC Data Security Law, among other things, provides for a security review procedure for the data activities that may affect national security and imposes export restrictions on certain data and information. On July 30, 2021, the State Council of the PRC promulgated the Provisions on Protection of the Security of Critical Information Infrastructure, which took effect on September 1, 2021. Pursuant to the Provisions on Protection of the Security of Critical Information Infrastructure, critical information infrastructure shall mean any important network facilities or information systems of the important industry or field such as public communication and information service, energy, communications, water conservation, finance, public services,
e-government
affairs and national defense science, which may endanger national security, people’s livelihood and public interest in case of damage, function loss or data leakage. In addition, relevant administration departments of each critical industry and sector, which are referred to as the “Protection Departments,” shall be responsible for formulating eligibility criteria and identifying the critical information infrastructure operator, or the CIIO, in the respective industry or sector. The CIIOs shall take the responsibility to protect the CII’s security by performing certain prescribed obligations, including conducting network security test and risk assessment, reporting the assessment results to relevant regulatory authorities. On August 20, 2021, the SCPNC adopted the Personal Information Protection Law, which became effective on November 1, 2021. The Personal Information Protection Law reiterates the circumstances under which a personal information processor could process personal information and the requirements for such circumstances. The Personal Information Protection Law clarifies the scope of application, the definition of personal information and sensitive personal information, the legal basis of personal information processing and the basic requirements of notice and consent. On October 29, 2021, the draft Measures on Security Assessment of Cross-Border Transfer of Data was released by the CAC, which stipulates that data processors shall make self-assessment of the risks before cross-border data transfer, and shall apply for security assessment for cross-border data transfer under certain circumstances. These laws and regulations require, among others, that the personal information and important data generated and collected during the operations in the PRC should be stored within the PRC unless, prior to the intended data transfer, certain specified criteria has been satisfied, such as a completed official security assessment carried out by the PRC government authorities. While we do not believe current business provided in our name involves any transmission, use and exchange of information that comes under the definition of “cross-border transfer of personal information and important data” under the PRC Cybersecurity Law, we cannot assure you that the PRC regulatory authorities will not take a view contrary to ours, thus requiring us to comply with the data localization, security assessment and other requirements under these proposed laws and regulations. As our business continues to grow, there may arise circumstances where we engage in such cross-border transfer of personal data or and important data, including in order to satisfy the legal and regulatory requirements, in which case we may need to comply with the foregoing requirements as well as any other limitations under PRC laws then applicable. Complying with these laws and requirements could cause us to incur substantial expenses or require us to alter or change our practices in ways that could harm our business. Additionally, to the extent we are found to be not in compliance with these laws and requirements, we may be subject to fines, regulatory orders to suspend our operations or other regulatory and disciplinary sanctions, which could materially and adversely affect our business, financial condition and results of operations.