Company: LI
Filing Date: 2025-04-10
Form Type: 20-F
Source: 0001410578-25-000678
Chunk: 158

Company: Li Auto Inc.
Filing Date: 2025-04-10
Form: 20-F
Item: Item 4
Chunk 158
---
 personal information by improper methods, such as fraud and deception; (viii) failing to provide users with the means and methods to withdraw their permission for collecting personal information; and (ix) collecting and using personal information in violation of the rules for collecting and using personal information promulgated by the app operator.

90

On August 20, 2021, the Standing Committee of National People’s Congress issued the PRC Personal Information Protection Law, which took effect on November 1, 2021, integrates the scattered rules with respect to personal information rights and privacy protection. The PRC Personal Information Protection Law aims at protecting the personal information rights and interests, regulating the processing of personal information, ensuring the orderly and free flow of personal information in accordance with the law, and promoting the reasonable use of personal information. Personal information, as defined in the PRC Personal Information Protection Law, refers to information related to identified or identifiable natural persons and recorded by electronic or other means, but excluding the anonymized information. The PRC Personal Information Protection Law provides the circumstances under which a personal information processor could process personal information, which include but not limited to, where the consent of the individual concerned is obtained and where it is necessary for the conclusion or performance of a contract to which the individual is a contractual party. It also stipulates certain specific rules with respect to the obligations of a personal information processor, such as to inform the purpose and method of processing to the individuals, and the obligation of the third party who has access to the personal information by way of co-processing or delegation.
Pursuant to the Measures for Cybersecurity Review (2020) promulgated by the CAC and certain other PRC regulatory authorities in April 2020, which took effect in June 2020, critical information infrastructure operators must pass a cybersecurity review when purchasing network products and services that affect or may affect national security. On December 28, 2021, the CAC published the Cybersecurity Review Measures, which took effect on February 15, 2022 and replaced the Measures for Cybersecurity Review (2020). Pursuant to the Cybersecurity Review Measures, critical information infrastructure operators that purchase network products and services and network platform operators engaging in data processing activities that affect or may affect national security must be subject to the cybersecurity review. According to the Cybersecurity Review Measures, before purchasing any network products or services, a critical information infrastructure operator should assess potential national security risks that may arise from the launch or use of such products or services, and apply for a