Company: IMG
Filing Date: 2025-07-30
Form Type: 10-K/A
Source: 0001641172-25-021542
Chunk: 49

Company: CIMG Inc.
Filing Date: 2025-07-30
Form: 10-K/A
Chunk 49
---
 offerings on U.S. securities exchanges, for alleged national security risks and improper collection and use of the personal information of Chinese data subjects. According to the official announcement, the action was initiated based on the National Security Law, the Cyber Security Law and the Measures on Cybersecurity Review, which are aimed at “preventing national data security risks, maintaining national security and safeguarding public interests.” On July 10, 2021, the Cyberspace Administration of China published a revised draft of the Measures on Cybersecurity Review, expanding the cybersecurity review to data processing operators in possession of personal information of over 1 million users if the operators intend to list their securities in a foreign country.

It is unclear at the present time how widespread the cybersecurity review requirement and the enforcement action will be and what effect they will have on the life sciences sector generally and the Company in particular. China’s regulators may impose penalties for non-compliance ranging from fines or suspension of operations, and this could lead to us delisting from the U.S. stock market.

In addition, our securities may be prohibited from trading on a national exchange or over-the-counter in the United States under the Holding Foreign Companies Accountable Act, if the PCAOB determines that it cannot inspect or fully investigate our auditors for two consecutive years.

Also, on August 20, 2021, the National People’s Congress passed the Personal Information Protection Law, which will be implemented on November 1, 2021. The law creates a comprehensive set of data privacy and protection requirements that apply to the processing of personal information and expands data protection compliance obligations to cover the processing of personal information of persons by organizations and individuals in China, and the processing of personal information of persons in China outside of China if such processing is for purposes of providing products and services to, or analyzing and evaluating the behavior of, persons in China. The law also proposes that critical information infrastructure operators and personal information processing entities who process personal information meeting a volume threshold to-be-set by Chinese cyberspace regulators are also required to store in China personal information generated or collected in China, and to pass a security assessment administered by Chinese cyberspace regulators for any export of such personal information. Lastly, the draft contains proposals for significant fines for serious violations of up to RMB 50 million or 5% of annual revenues from the prior year.

Interpretation, application and enforcement of these laws, rules and regulations evolve from time to time and their scope may continually change, through new legislation, amendments to existing legislation and changes in enforcement