Company: TCOM
Filing Date: 2025-04-11
Form Type: 20-F
Source: 0001193125-25-078429
Chunk: 109

Company: Trip.com Group Ltd
Filing Date: 2025-04-11
Form: 20-F
Item: Item 4
Chunk 109
---
 on Internet Follow-up Comment Services, the Notice on Special Governance of Illegal Collection and Use of Personal Information via Apps, the Measures to Identify Illegal Collection and Usage of Personal Information by Apps, the Notice on Carrying out Special Rectification Actions in Depth against the Infringement on Users’ Rights and Interests by Apps and the Provision on Scope of Necessary Personal Information for Common Types of Mobile Internet Applications. 
 On November 7, 2016, the Standing Committee of the National People’s Congress issued the PRC Cyber Security Law, which came into effect on June 1, 2017. The PRC Cyber Security Law provides that network operators must set up a classified protection system for cyber security. The PRC Cyber Security Law imposes a relatively vague but broad obligation to provide technical support and assistance to the public and state security authorities in connection with criminal investigations or for reasons of national security. The PRC Cyber Security Law also requires network operators that provide network access or domain name registration services, landline, or mobile phone network access, or that provide users with information publication or instant messaging services, to require users to provide a real identity when they sign up. On August 29, 2015, the Standing Committee of the National People’s Congress issued the Ninth Amendment to the PRC Criminal Law, effective on November 1, 2015. Any internet service provider that fails to comply with obligations related to internet information security administration as required by applicable laws and refuses to rectify upon order will be subject to criminal penalty. 
 Since 2021, the CAC and other government authorities promulgated a series of laws and regulations relating to information protection and data security, including but not limited to, the PRC Data Security Law, the Guidance on Strengthening the Comprehensive Governance of Internet Information Service Algorithms, the Administrative Provisions on Internet Information Service Algorithm-Based Recommendation, the Administrative Provisions on Internet Information Service Deep Synthesis, the PRC Personal Information Protection Law, the Cybersecurity Review Measures, the Regulations on the Security Protection of Critical Information Infrastructure, the Security Assessment Measures for Data Outbound Transfer, the Provisions on Facilitating and Regulating Cross-border Data Flow, the Administrative Regulations on Network Data Security, the Administrative Measures on Data Security in the Field of Industry and Information Technology (Trial) and the Administrative Measures for Personal Information Protection Compliance Audit. 
 The PRC Data Security Law established a tiered system for data protection in terms of their importance. Data categorized as “important data”, which will be determined by governmental authorities in the