Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 131

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 3
Chunk 131
---
 take immediate remedial measures if user personal information is suspected to have been disclosed. If the consequences of any such disclosure are expected to be serious, ICP operators must immediately report the incident to the telecommunications regulatory authority and cooperate with the authorities in their investigations.

On December 28, 2012, the Standing Committee of the National People’s Congress promulgated the Decision of the Standing Committee of the National People’s Congress on Strengthening Online Information Protection with immediate effect. The decision provides that, among others, internet service providers shall abide by the principles of legality, legitimacy and necessity, clearly state the purpose, method and scope of the collection and use of information, obtain the consent of the person whose information is being collected when collecting and using a citizen’s personal information during business activities, and shall not violate the provisions of laws and regulations or the agreement between the parties when collecting and using information.

Table of Contents

On July 16, 2013, the MIIT issued the Order for the Protection of Telecommunication and Internet User Personal Information, which came into effect on September 1, 2013. The majority of the requirements under the order relevant to internet content provision operators are consistent with pre-existing requirements, but they are often more stringent and expansive in scope. If an internet content provision operator wishes to collect or use personal information, it may do so only if such collection is necessary for the services it provides. Furthermore, it must disclose to its users the purpose, method and scope of any such collection or use, and must obtain consent from its users whose information is being collected or used. Internet content provision operators are also required to establish and publish their rules relating to personal information collection or use, keep any collected information strictly confidential, and take technological and other measures to maintain the security of such information. Internet content provision operators are required to cease any collection or use of the user personal information, and de-register the relevant user account, when a given user stops using the relevant internet service. Internet content provision operators are further prohibited from divulging, distorting or destroying any such personal information, or selling or providing such information unlawfully to other parties.

The PRC Cybersecurity Law imposes specific data protection obligations on network operators, including not disclosing, tampering with, or damaging users’ personal information that they have collected, as well as the obligation to delete unlawfully collected information and to correct any inaccuracies. Moreover, internet operators are prohibited from providing users’ personal information to others without users’ consent. Information irreversibly processed to preclude