Company: ZK
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0001410578-25-000390
Chunk: 146

Company: ZEEKR Intelligent Technology Holding Ltd
Filing Date: 2025-03-20
Form: 20-F
Item: Item 4
Chunk 146
---
 to rectify, subject to warnings, fines and other administrative penalties or even criminal liabilities, and the directly responsible personnel in charge may also be imposed with fines or other liabilities.
On August 20, 2021, the SCNPC promulgated the PRC Personal Information Protection Law, which came into effect on November 1, 2021. As the first systematic and comprehensive law specifically for the protection of personal information in the PRC, the PRC Personal Information Protection Law provides, among others, that (i) an individual’s separate consent shall be obtained before operation of such individual’s sensitive personal information, e.g., biometric characteristics and individual location tracking, (ii) personal information operators operating sensitive personal information shall notify individuals of the necessity of such operations and the influence on the individuals’ rights, (iii) if personal information handlers reject individuals’ requests to exercise their rights, individuals may file a lawsuit with a People’s Court.
The Administrative Provisions on Security Vulnerability of Network Products, or the Provisions, were jointly promulgated by the MIIT, the CAC and the Ministry of Public Security on July 12, 2021 and became effective on September 1, 2021. Network product providers, network operators as well as organizations or individuals engaging in the discovery, collection, release and other activities of network product security vulnerability are subject to the Provisions and shall establish channels to receive information of security vulnerability of their respective network products and shall examine and fix such security vulnerability in a timely manner. In response to the PRC Cybersecurity Law, network product providers are required to report relevant information of security vulnerability of network products with the MIIT within two days and to provide technical support for network product users. Network operators shall take measures to examine and fix security vulnerability after discovering or acknowledging that their networks, information systems or equipment have security loopholes. According to the Provisions, the breaching parties may be subject to monetary fine as regulated in accordance with the PRC Cybersecurity Law. Since the Provisions is relatively new, uncertainties still exist in relation to its interpretation and implementation.
On December 8, 2022, the MIIT issued the Measures for Data Security Administration in the Industry and Information Technology Field (Trial Implementation), or the Data Security Measures, which became effective on January 1, 2023. In accordance with the Data Security Measures, the industrial and telecommunication data processors shall classify data firstly based on the data’s category and then based on its security level on a regular basis, to classify