Company: SSEA
Filing Date: 2025-03-05
Form Type: DRS
Source: 0001829126-25-001469
Chunk: 127

Company: STARRY SEA ACQUISITION CORP
Filing Date: 2025-03-05
Form: DRS
Chunk 127
---
 Protection Law (the “PIPL”), which took effect on November 1, 2021. The PIPL accentuates the importance of processors’ obligations and responsibilities for personal information protection and sets out the basic rules for processing personal information and the rules for cross-border transfer of personal information. Pursuant to the PIPL, a personal information processor is allowed to process (including to collect, store, use, process, transmit, provide, disclose and delete) personal information only under certain circumstances, such as processing with consent from such individual, or for the necessity of performance of a contract to which such individual is a contracting party or statutory duties, management of human resource under the labor rules and regulations developed in accordance with the law or a collective contract signed in accordance with the law, protection of public interest, or reasonable usage of legally disclosed information. Processing of sensitive personal information, such as the personal information that may easily result in damage to personal dignity, personal or property safety once leaked or illegally used, as well as the personal information of minors under the age of 14, is subject to higher regulatory requirements including specific purpose, sufficient necessity, duty of explanation to such individuals and consent from a parent or a guardian of such minors.

On September 24, 2024, the State Council published the Regulations on Network Data Security Management (the “Network Data Security Regulations”), which became effective on January 1, 2025. The Network Data Security Regulations provide that network data processors refer to individuals or organizations that autonomously determine the purpose and the manner of processing network data, and the network data processors engaging in data processing activities that affect or may affect national security shall be subject to the national security review in accordance with relevant laws and regulations. Additionally, the Network Data Security Regulations emphasize the obligations of important data processors, and clarify the definition and obligations of “large-scale network platform” service providers, with the “large-scale network platform” referring to a network platform with more than 50 million registered users or more than 10 million monthly active users, complex business types, and network data processing activities having a significant impact on national security, economic operation, national welfare and people’s livelihood, etc.

On December 28, 2021, the CAC, MIIT and other eleven regulatory authorities jointly issued the Revised Cybersecurity Review Measures, which became effective on February 15, 2022 and repealed the Cybersecurity Review Measures promulgated on April 13, 2020. The Revised Cybersecurity Review Measures provide that a critical information infrastructure operator purchasing