Company: TME
Filing Date: 2025-04-23
Form Type: 20-F
Source: 0000950170-25-056949
Chunk: 176

Company: Tencent Music Entertainment Group
Filing Date: 2025-04-23
Form: 20-F
Item: Item 4
Chunk 176
---
 service providers shall immediately take remedial measures and report any actual or potential material leak to the telecommunications regulatory authority.

On December 28, 2012, the Decision on Strengthening Network Information Protection promulgated by the Standing Committee of the National People’s Congress emphasizes the need to protect electronic information that contains individual identification information and other private data. The decision requires internet service providers to establish and publish policies regarding the collection and use of electronic personal information and to take necessary measures to ensure the security of the information and to prevent leakage, damage or loss.
In July 2013, the MIIT promulgated the Regulations on Protection of Personal Information of Telecommunications and Internet Users, or the Regulations on Network Information Protection, effective on September 1, 2013, to enhance and enforce legal protection over user information security and privacy on the internet. The Regulations on Network Information Protection require internet operators to take various measures to ensure the privacy and confidentiality of users’ information.
Pursuant to the Ninth Amendment to the Criminal Law of the PRC issued by the Standing Committee of the National People’s Congress on August 29, 2015, effective on November 1, 2015, any internet service provider that fails to fulfill the obligations related to internet information security as required by applicable laws and refuses to take corrective measures will be subject to criminal liability for (i) any large-scale dissemination of illegal information; (ii) any severe effect due to the leakage of users’ personal information; (iii) any serious loss of evidence of criminal activities; or (iv) other severe situations, and any individual or entity that (a) sells or provides personal information to others unlawfully or (b) steals or illegally obtains any personal information will be subject to criminal liability in severe situations.
On November 7, 2016, the Standing Committee of the National People’s Congress promulgated the Cybersecurity Law of the PRC, or the Cybersecurity Law, which came into effect on June 1, 2017. Pursuant to the Cybersecurity Law, network operators shall follow their cybersecurity obligations according to the requirements of the classified protection system for cybersecurity, including: (a) formulating internal security management systems and operating instructions, determining the persons responsible for cybersecurity, and implementing the responsibility for cybersecurity protection; (b) taking technological measures to prevent computer viruses, network attacks, network intrusions and other actions endangering cybersecurity; (c) taking technological measures to monitor and record the network operation status and cybersecurity incidents; (d) taking measures