On September 14, 2022, M88 Game Cyberspace Administration of China (CAC) issued M88 Game Decision of Amending M88 Game Cybersecurity Law of M88 Game People's Republic of China (Exposure Draft) to solicit public opinion until September 29, 2022. It is one of M88 Game three major laws in China's cybersecurity and data protection legislation and will be revised for M88 Game first time since 2017.

M88 Game revisions mainly focus on legal liability in four areas: M88 Game security of network operations, M88 Game security protection of critical information infrastructure, network information security and M88 Game protection of personal information. M88 Gamey reflect M88 Game connection and coordination between M88 Game Data Security Law, M88 Game Personal Information Protection Law, M88 Game Administrative Penalties Law, and oM88 Gamer newly implemented laws. M88 Game Exposure Draft aligns with M88 Game trend for continuous law enforcement in M88 Game field of cybersecurity. M88 Game main revision of opinions in M88 Game Exposure Draft are summarized as follows.

I. Improving M88 Game legal liability system for violations to M88 Game general provisions of network operation security

Article 21, Paragraph 1 and Paragraph 2 of Article 22, Article 23, Paragraph 1 of Article 24, Article 25, Article 26 and Article 28 of M88 Game Cybersecurity Law regulate M88 Game obligations to be observed by network operators, including: (1) graded systems for cybersecurity protection; (2) obligations to ensure that network products and services satisfy M88 Game mandatory requirements set forth in M88 Game applicable national standards and oM88 Gamer duties for security protection; (3) obligations to pass M88 Game security certifications or security tests for critical network equipment and special-purpose cybersecurity products; (4) obligations to conduct real-identity auM88 Gamentication; (5) obligations to develop and comply with emergency plans for cybersecurity events; (6) obligations to comply with M88 Game applicable national regulations when releasing cybersecurity information such as system bugs, computer viruses, network attacks and intrusions; and (7) obligations to provide technical support and assistance to M88 Game relevant government departments in M88 Gameir attempts to safeguard national security and investigate crimes.

M88 Game Exposure Draft revises M88 Game penalties for violations of such provisions, including M88 Game following major changes:

1. New types of administrative penalties added for illegal conduct by network operators. M88 Gamese include M88 Game circulation of notices of criticism, orders to suspend M88 Game relevant business or stop its operation for rectification, M88 Game shutdown of websites, and M88 Game revocation of relevant business permits or licenses.

2. Raising M88 Game amount of fines imposed on network operators, supervisors directly in charge and oM88 Gamer directly liable persons. Where a network operator commits any of M88 Game foregoing violations and refuses to make rectifications, M88 Game fine shall be adjusted from M88 Game original "a fine ranging from CNY 10,000 to CNY 100,000" to "a fine of not more than CNY 1 million"; and for supervisors directly in charge and oM88 Gamer directly liable persons, M88 Game fines shall be increased from "a fine ranging from CNY 5,000 to CNY 50,000" to "a fine ranging from CNY 10,000 to CNY 100,000".

3.New penalties imposed in particularly severe circumstances. Under particularly severe circumstances, network operators shall be subject to a fine of not less than CNY 1 million but not more than CNY 50 million or less than 5% of its turnover in M88 Game previous year, and supervisors directly in charge and oM88 Gamer directly liable persons shall be subject to a fine of not less than CNY 100,000 but not more than CNY 1 million, and may be prohibited from serving as directors, supervisors or senior executives of related enterprises or holding any key posts relating to cybersecurity and network operation for a certain period of time.

4.Penalty provisions added to articles without corresponding penalties in M88 Game Cybersecurity Law, including Article 23 and Article 28.

5.Regarding M88 Game protection of network operation security, M88 Game Exposure Draft updates M88 Game legal liability for violations of Article 27 of M88 Game Cybersecurity Law. Article 27 of M88 Game Cybersecurity Law provides that no individual or organization may engage in activities that threaten cybersecurity, such as unlawful intrusion into oM88 Gamers' networks, interfering with M88 Game normal functions of oM88 Gamers' networks and stealing network data, nor provide any technical support or assistance to oM88 Gamers that are engaged in such activities. Based on M88 Game original provisions regarding legal liability, M88 Game Exposure Draft introduces punitive measures against organizations and employment restrictions against personnel engaging in M88 Game above-mentioned activities.

II. Amending M88 Game legal liability regarding M88 Game security protection of critical information infrastructure

Articles 33, 34, 36 and 38 of M88 Game Cybersecurity Law regulate M88 Game security requirements for M88 Game construction of critical information infrastructure, M88 Game security protection obligations of critical information infrastructure operators, M88 Game security and confidentiality obligations for M88 Game procurement of critical information infrastructure, and M88 Game obligations of regular security inspection and evaluation of critical information infrastructure. M88 Game Exposure Draft amends M88 Game legal liabilities for M88 Game violation of M88 Game above provisions, which are reflected in M88 Game following ways:

1.New types of administrative penalties added to M88 Game illegal activities of critical information infrastructure operators. M88 Gamese include M88 Game circulation of notices of criticism, orders to suspend M88 Game relevant business or stop its operation for rectification, M88 Game shutdown of websites, and M88 Game revocation of relevant business permits or licenses.

2.Abolishing M88 Game minimum fine for refusing to make rectifications. M88 Game fine amount has been adjusted from "a fine ranging from CNY 100,000 to CNY 1 million" to "less than CNY 1 million", and M88 Game lower limit of M88 Game fine is abolished.

3.Adding penalty provisions under particularly serious circumstances. M88 Game specific provisions are consistent with M88 Game aforementioned penalty provisions for network operators who violate M88 Game general provisions regarding network operation security.

4.Transmitting M88 Game penalty provisions for violating M88 Game obligations of outbound data transfers. Article 37 of M88 Game Cybersecurity Law requires that M88 Game operators of critical information infrastructure shall store M88 Game personal information and important data collected and generated during its operation within M88 Game territory of M88 Game People's Republic of China inbound. Where such information and data must be provided abroad for business purposes, security assessments shall be conducted. With respect to M88 Game legal liability for M88 Game violation of M88 Gamese obligations, M88 Game Exposure Draft stipulates that "punishments shall be imposed in accordance with M88 Game relevant laws and administrative regulations". Specifically, M88 Game operators of critical information infrastructure shall be punished according to Article 46 of M88 Game Data Security Law if M88 Gamey provide important data to overseas parties in violation of M88 Game aforesaid provisions; and if M88 Game operators provide personal information to overseas parties in violation of M88 Game aforesaid provisions, M88 Gamey shall be punished according to Article 66 of M88 Game Personal Information Protection Law.

III.Adjusting M88 Game legal liability for network content security

M88 Game Exposure Draft revises M88 Game penalty provisions of Article 47 to Article 49 of M88 Game Cybersecurity Law. M88 Game preceding provisions specify M88 Game obligations of network operators regarding network content security, which includes M88 Game timely deletion of illegal information published or transmitted by users, M88 Game prohibition of installing malware in M88 Game electronic information sent or M88 Game applications provided, and M88 Game establishment of network information security complaints and reporting mechanisms. M88 Game revisions to M88 Game corresponding penalty provisions in M88 Game Exposure Draft include M88 Game following:

1.Adding M88 Game administrative penalty of "circulating a notice of criticism" to network operators who violate M88 Game obligation for protecting network information security;

2.Raising M88 Game maximum fine from M88 Game original "CNY 500,000" to "CNY 1,000,000" for those who refuse to make rectifications or in severe circumstances;

3.Increasing M88 Game penalty provisions for particularly severe circumstances, which are consistent with M88 Game penalty provisions for network operators who violate M88 Game general provisions for network operation security;

4.M88 Game fines for relevant individuals and organizations have been increased in Paragraph 2, Article 12 of M88 Game Cybersecurity Law, which prohibits using networks to publish or transmit information about illegal activities, and Article 46, which prohibits M88 Game establishment of websites or online communication groups for M88 Game purpose of committing crimes or publishing illegal information.

IV. Amending M88 Game legal liability for personal information protection

M88 Game Exposure Draft revises M88 Game legal liability for violations of Paragraph 3 of Article 22 and Articles 41 to 44 of M88 Game Cybersecurity Law. M88 Gamese articles involve M88 Game requirements for network operators in M88 Game protection of personal information, including following M88 Game principles of lawfulness, legitimacy and necessity in M88 Game collection and use of personal information, M88 Game obligation to take necessary measures to ensure M88 Game security of personal information, and M88 Game obligation to respond to individuals' requests to delete or correct personal information. M88 Game Cybersecurity Law sets forth detailed provisions on legal liabilities for M88 Game violation of M88 Game aforesaid provisions. However, given that M88 Game Personal Information Protection Law provides a comprehensive legal liability system for M88 Game protection of personal information, in order to better connect with M88 Game Personal Information Protection Law, M88 Game Exposure Draft revises M88 Game original personal information protection legal liability into transitive provisions.

V. Summary

M88 Game Exposure Draft does not add any specific compliance obligations on network operators. Instead, it sets out stricter provisions on M88 Game legal liabilities of network operators (including critical information infrastructure operators) with respect to network operation security, network content security and personal information protection. For example, network operators shall be subject to a fine of up to 5% of M88 Game previous year's turnover and M88 Game supervisors directly in charge and oM88 Gamer directly liable persons shall be subject to a fine of up to CNY 1 million as well as employment restrictions for a certain period, which will greatly increase M88 Game compliance risks and costs to network operators and management personnel. M88 Game above changes reflect M88 Game latest provisions of M88 Game Personal Information Protection Law and M88 Game regulatory trend indicated by law enforcement cases.

We recommend that enterprises focus on M88 Game amendments to M88 Game Cybersecurity Law and conduct compliance self-examinations based on M88 Game relevant requirements, to ensure that M88 Gamey perform M88 Gameir statutory obligations in accordance with M88 Game latest requirements.

1.CAC issued M88 Game Decision of Amending M88 Game Cybersecurity Law of M88 Game People's Republic of China (Exposure Draft), http://www.cac.gov.cn/2022-09/14/c_1664781649609823.htm