On November 7, 2016, the National People’s Congress Standing Committee promulgated the PRC Cybersecurity Law, or the Cybersecurity Law, which came into effect on June 1, 2017, and applies to the construction, operation, maintenance and use of networks as well as the supervision and administration of cybersecurity in China. The Cybersecurity Law defines “networks” as systems that are composed of computers or other information terminals and relevant facilities used for the purpose of collecting, storing, transmitting, exchanging and processing information in accordance with certain rules and procedures. “Network operators,” who are broadly defined as owners and administrators of networks and network service providers, are subject to various security protection-related obligations including, among others, security protection, user identity verification, cybersecurity emergency response planning and technical assistance.
According to the Cybersecurity Law, network service providers must inform users about and report to the relevant authorities any known security defects and bugs, and must provide continuous security maintenance services for their products and services. Network products and service providers shall not contain or provide malware. Network service providers who do not comply with the Cybersecurity Law may be subject to fines, suspension of their businesses, shutdown of their websites, and revocation of their business licenses. In addition, the Cybersecurity Law provides that personal information and important data collected and generated by operators of critical information infrastructure in the course of their operations in the PRC should be stored in the PRC, and the law imposes heightened regulation and additional security obligations on operators of critical information infrastructure.
On July 30, 2021, the State Council of the PRC promulgated the Regulations on Security Protection of Critical Information Infrastructure, effective on September 1, 2021, which provide that a “critical information infrastructure” refers to an important network facility and information system in important industries such as public communications and information services, as well as other important network facilities and information systems that may seriously endanger national security, national economy, people’s livelihood, or public interests in the event of their damage, loss of function, or data leakage. The competent governmental authorities and supervision and management authorities of the aforementioned important industries will be responsible for (i) identification of critical information infrastructures in their respective industries in accordance with relevant identification rules, and (ii) promptly notifying the identified operators and the public security department of the State Council of the PRC of the identification results. However, the exact scope of “critical information infrastructure operators” under the current regulatory regime still remains unclear, and the PRC government authorities have discretion in the interpretation and enforcement of these laws, rules and regulations.
On April 13, 2020, the Cyberspace Administration of China, the NDRC, the MIIT, and several other governmental authorities jointly issued the Measures for Cybersecurity Review, or the Cybersecurity Review Measures, which came into effect on June 1, 2020. According to the Cybersecurity Review Measures, the purchase of cyber products and services including core network equipment, high-performance computers and servers, mass storage devices, large databases and application software, network security equipment, cloud computing services, and other products and services that have an important impact on the security of critical information infrastructure which affects or may affect national security is subject to cybersecurity review by the Cybersecurity Review Office. On December 28, 2021, the Cyberspace Administration of China, together with certain other PRC governmental authorities, promulgated the Revised Cybersecurity Review Measures which replaced the then-effective version and took effect on February 15, 2022. According to the Revised Cybersecurity Review Measures, operators of critical information infrastructure who purchase network products and services and network platform operators who carry out data processing activities that affect or may affect national security shall be subject to cybersecurity review. In addition, any online platform operator possessing over one million users’ individual information must apply for a cybersecurity review before listing abroad. Relevant competent governmental authorities may also initiate cybersecurity review if they determine certain network products, services or data processing activities affect or may affect national security. Article 10 of the Revised Cybersecurity Review Measures also sets out certain general factors that are the focus in assessing the national security risk in a cybersecurity review, including (i) the risks of critical information infrastructure being illegally controlled by any individual or organization or subject to interference or destruction; (ii) the harm caused by the disruption of the supply of the product or service to the continuity of critical information infrastructure business; (iii) the security, openness, transparency and diversity of sources of the product or service, the reliability of supply channels, and risks of supply disruption due to political, diplomatic, trade and other factors; (iv) compliance with PRC laws, administrative regulations and department rules by the provider of the product or service; (v) the risk of core data, important data or a large amount of personal information being stolen, leaked, damaged, illegally used, or illegally transmitted overseas; (vi) the risk that critical information infrastructure, core data, important data or a large amount of personal information for a listing being affected, controlled, and maliciously used by foreign governments, as well as network information security risks; and (vii) other factors that may endanger the security of critical information infrastructure, cybersecurity and data security. However, there are still uncertainties as to the exact scope of network products or services or data processing activities that will or may affect national security, and the PRC government authorities have discretion in the interpretation and enforcement of these measures.
According to the Administrative Provisions on Security Vulnerability of Network Products jointly promulgated by the MIIT, the Cyberspace Administration of China and the Ministry of Public Security, which came into effect on September 1, 2021, network