Company: CHNR
Filing Date: 2025-01-27
Form Type: POS AM
Source: 0001079973-25-000143
Chunk: 134

Company: CHINA NATURAL RESOURCES INC
Filing Date: 2025-01-27
Form: POS AM
Chunk 134
---
 and taking effect on March 15, 2012, an internet information service provider must not collect any personal information from any of its users or provide any such information to third parties without the consent of such user, unless otherwise provided by laws or regulations. Internet information service providers must expressly inform the users of the method for and purpose of the collection and processing of such user’s personal information and the content of the personal information so collected and processed, and should only collect or use such information to the extent necessary for the provision of its services. An internet information service provider is also required to properly maintain users’ personal information, and in case of any leak or possible leak of such personal information, the Internet information service provider must take immediate remedial measures and, in severe circumstances, make an immediate report to the relevant telecommunications regulatory authority.

In addition, pursuant to the Decision on Strengthening the Protection of Online Information issued by the SCNPC on December 28, 2012 and the Order for the Protection of Telecommunication and Internet User Personal Information issued by the MIIT on July 16, 2013, any collection and use of a user’s personal information must be subject to the consent of the user, adhere to the principles of legality, rationality and necessity and be within the specified purposes, methods and scopes. An internet information service provider must also keep such information strictly confidential, and is further prohibited from divulging, tampering with or destroying any such information, or selling or providing such information to other parties. An internet information service provider is required to take technical and other measures to prevent the unauthorized disclosure, damage or loss of any personal information collected.

On November 7, 2016, the SCNPC issued the Cyber Security Law of the PRC (the “Cybersecurity Law”), which took effect on June 1, 2017. The Cybersecurity Law is formulated to maintain the network security, safeguard the cyberspace sovereignty, national security and public interests, and protect the lawful rights and interests of citizens, legal persons and other organizations. Pursuant to the Cybersecurity Law, a network operator, which includes, among others, internet information services providers, must take technical measures and other necessary measures in accordance with applicable laws and regulations as well as mandatory requirements of national and industrial standards to safeguard the safe and stable operation of networks, effectively respond to network security incidents, prevent illegal and criminal activities, and maintain the integrity, confidentiality and availability of network data. The Cybersecurity Law reaffirms the basic principles and requirements as specified in