Overseas listings on million-user platforms are required to apply for a network security review, clarifying the risk factors for the first time

On January 4, the State Internet Information Office released information on the official WeChat, and the Cyberspace Administration of China and 13 other departments jointly revised and promulgated the Measures for Network Security Review (hereinafter referred to as the "Measures"), which came into effect on February 15, 2022.

The "Measures" include situations such as network platform operators carrying out data processing activities that affect or may affect national security, and make it clear that network platform operators with more than 1 million users' personal information must apply to the Network Security Review Office for network security review when going public abroad. According to the actual needs of the review, the CSRC has been added as a member unit of the network security review work mechanism, and the national security risk assessment factors have been improved.

Liu Feng, a member of the Expert Committee of the China Digital Economy 100 Association, told the first financial reporter: "The latest measures clarify the review unit, review content and process, and at the same time clarify the review standards for overseas listings, which will help the industry to carry out compliance work, which will also drive compliance industries including technology and third-party institutions to usher in a new growth point." ”

Listing in Hong Kong is not within the scope of review for the time being

In the Draft for Comments in July last year, the new object of review in the Cybersecurity Review Measures was "data processor", but the final draft changed "data processor" to "network platform operator".

In this regard, Hao Changwei, partner of KPMG China's network and information security consulting services, told First Financial Reporter: "Network platform operator is a concept first proposed in this measure, and its scope is wider. However, it needs to be further clarified whether this concept fits with network operators in the Cybersecurity Law or with data processors in the Data Security Law. ”

He also said that cybersecurity reviews should be distinguished from data security reviews. "It is understood that data security reviews should be part of cybersecurity reviews, but this is not particularly clear in the approach." Hao Changwei said.

The Measures add a new network information security risk assessment for listed enterprises. Including the existence of critical information infrastructure, core data and important data, or the risk of a large number of personal information being affected, controlled, or maliciously exploited by foreign governments, as well as network information security risks, etc., it is the focus of network security review.

"Since Didi announced its delisting from the United States, the state has conducted a network security review of IPOs listed abroad." Hao Changwei told the first financial reporter, "Data compliance has become a necessary inspection item in the IPO, and we have received many projects, which are required by the sponsors of the listing of enterprises to do data and privacy compliance." ”

Hao Changwei believes that from a literal point of view, "listing in Hong Kong" does not belong to "listing abroad", so it does not fall within the scope of network security review now, but it does not rule out that future supervision will actively review enterprises listed in Hong Kong.

It is worth noting that on December 30 last year, SenseTime went public in Hong Kong, and on the third trading day of listing, SenseTime's stock price continued to rise by 20%, with a cumulative increase of more than 150%, and its market value exceeded HK$300 billion.

Although the market believes that the demand for Hong Kong IPO will increase in the short term, international investors still say that China's strengthening of regulation of Internet technology companies involving a large amount of user information does not mean that there will be no Chinese technology companies listing in overseas markets such as the United States in the future.

"I think China's regulatory strengthening is mainly aimed at platform-based Internet companies, while for other hard technology companies, such as biotechnology or health care companies, the government still encourages them to go public abroad." An overseas investor focusing on the field of medical technology told the first financial reporter.

On December 5 last year, the China Securities Regulatory Commission also responded on the official WeChat: "The China Securities Regulatory Commission and relevant regulatory departments have always been open to enterprises choosing overseas listing places, and fully respect enterprises' independent choice of listing places in accordance with laws and regulations." ”

In response to a series of policies and measures recently issued by Chinese regulators to promote the development of platform economic norms, the CSRC responded: "Its main purpose is to regulate monopolistic behavior, protect the rights and interests of small and medium-sized enterprises, data security, personal information security, eliminate the financial regulatory vacuum, and prevent disorderly expansion of capital." ”

Strengthen anti-monopoly and improve algorithm transparency

At the same time, the Cyberspace Administration of China and four other departments recently issued the Provisions on the Administration of Internet Information Service Algorithm Recommendation (hereinafter referred to as the "Provisions"), which will come into effect on March 1, 2022. The provisions clarify the information service specifications for algorithm recommendation service providers, requiring that algorithm recommendation service providers shall adhere to the mainstream value orientation, actively disseminate positive energy, must not use algorithm recommendation services to engage in illegal activities or disseminate illegal information, and shall take measures to prevent and resist the dissemination of negative information; standardize the development of Internet news information services, must not generate synthetic false news information or disseminate news information released by units that are not within the scope of national regulations; must not use algorithm implementation to influence network public opinion, Circumvent supervision and management, as well as monopoly and unfair competition.

Algorithms are the operating rules of the digital world, but at present, the technology platform has not yet established a compliant and effective algorithmic ethics system and mechanism. The latest regulations are related to the Personal Information Protection Law. Experts in the ARTIFICIAL intelligence industry believe that for companies that create and use algorithms, improving transparency is crucial, and that laws on algorithmic transparency are necessary before the specific uses and applications of AI are regulated.

According to the latest requirements of the regulations, algorithm recommendation service providers shall periodically review, evaluate, and verify algorithm mechanism mechanisms, models, data, and application results, and must not set up algorithm models that violate public order and good customs, such as inducing users to indulge or spend high amounts.

In the past year, anti-monopoly has always been the main theme in the field of Internet technology in China. In the context of chaos such as "big data killing", the industry calls for consumers to be allowed to "one-click shutdown" algorithms.

Liu Feng told the first financial reporter: "Most users are difficult to make judgments about the company's algorithms, and users need to be able to control the algorithm's right to know and choose, that is, choose to open or close the algorithm recommendation." He stressed that algorithmic compliance requires a combination of corporate autonomy and collaborative regulation.

You Yunting, a senior partner at Shanghai Dabang Law Firm, told First Financial Reporter: "In addition to algorithm-driven platforms such as Toutiao and Douyin, user-generated content platforms such as Sina Weibo, as well as companies that use algorithm management platforms such as Didi, Meituan, and Ele.me, are also subject to the new regulations. ”

Under the tide of global antitrust, regulators in various countries have also recently stepped up their crackdown on algorithm unfairness. In the United States, lawmakers are also re-examining how tech companies should change the way they use algorithms. The U.S. House of Representatives recently introduced legislation known as Filter bubble transparency, which requires big tech companies to allow users to access algorithm-independent versions of the platform, meaning that consumers will have the option to turn on or off features manipulated by secret algorithms.