Business Overview
Internet security in China is also regulated and network equipment, high-performance computers
restricted from a national security standpoint. On July
1, 2015, the National People’s Congress Standing
Committee promulgated the National Security Law,
which took effect on the same date and replaced
the former National Security Law promulgated in
1993. According to the National Security Law, the
state shall ensure that the information system and
data in important areas are secure and controllable.
In addition, according to the National Security Law,
the state shall establish national security review and
supervision institutions and mechanisms, and conduct
national security reviews of key technologies and IT
products and services that affect or may affect national
security. There are uncertainties on how the National
Security Law will be implemented in practice.
On November 7, 2016, the National People’s Congress
Standing Committee promulgated the Cybersecurity
Law, which came into effect on June 1, 2017, and
applies to the construction, operation, maintenance
and use of networks as well as the supervision
and administration of cybersecurity in China. The
Cybersecurity Law defines “networks” as systems that
are composed of computers or other information
terminals and relevant facilities used for the purpose
of collecting, storing, transmitting, exchanging and
processing information in accordance with certain
rules and procedures. “Network operators,” who are
broadly defined as owners and administrators of
networks and network service providers, are subject
to various security protection-related obligations
including, among others, security protection, user
identity verification, cybersecurity emergency response
plans and technical assistance.
According to the Cybersecurity Law, network service
providers must inform users about and report to
the relevant authorities any known security defects
and bugs, and must provide continuous security
maintenance services for their products and services.
Network products and service providers shall not
contain or provide malware. Network service providers
who do not comply with the Cybersecurity Law may
be subject to fines, suspension of their businesses,
shutdown of their websites, and revocation of their
business licenses.
On April 13, 2020, the Cyberspace Administration,
the NDRC, the MIIT, and several other governmental
authorities jointly issued the Measures for
Cybersecurity Review, or the Cybersecurity Review
Measures, which came into effect on June 1, 2020.
According to the Cybersecurity Review Measures, the
purchase of cyber products and services including core
76 Alibaba Group Holding Limited
and servers, mass storage devices, large databases
and application software, network security equipment,
cloud computing services, and other products and
services that have an important impact on the security
of critical information infrastructure which affects or
may affect national security is subject to cybersecurity
review by the Cybersecurity Review Office.
The Cyberspace Administration is responsible for
organizing and implementing cybersecurity reviews,
while the competent departments in key industries
such as finance, telecommunications, energy and
transport shall be responsible for organizing and
implementing security review of cyber products and
services in their respective industries or fields.
On November 15, 2018, the Cyberspace Administration
issued the Provisions on Security Assessment of the
Internet Information Services with Public Opinion
Attributes or Social Mobilization Capacity, which came
into effect on November 30, 2018. The provisions
require ICPs to conduct security assessments on their
Internet information services if their services include
functions that provide channels for the public to
express opinions or have the capability of mobilizing
the public to engage in specific activities. ICPs must
conduct self-assessment on, among other things, the
legality of new technology involved in the services
and the effectiveness of security risk prevention
measures, and file the assessment report with the
local competent cyberspace administration authority
and public security authority.
Regulation of Privacy Protection
Under the ICP Measures, ICPs are prohibited from
producing, copying, publishing or distributing
information that is humiliating or defamatory to others
or that infringes upon the lawful rights and interests of
others. Depending on the nature of the violation, ICPs
may face criminal charges or sanctions by PRC public
security authorities for these acts, and may be ordered
to suspend temporarily their services or have their
licenses revoked.
Under the rules issued by the MIIT, ICPs are also
prohibited from collecting any personal user
information or providing any information to
third parties without the consent of the user. The
Cybersecurity Law provides an exception to the consent
requirement where the information is anonymous, not
personally identifiable and unrecoverable. ICPs must
expressly inform the users of the method, content
and purpose of the collection and processing of user
personal information and may only collect information