Company: JXG
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001213900-25-043744
Chunk: 100

Company: JX Luxventure Group Inc.
Filing Date: 2025-05-15
Form: 20-F
Item: Item 4
Chunk 100
---
 network information security risks; and (vii) other factors that may endanger the security
of critical information infrastructure, cybersecurity and data security.

On July 30, 2021, the State Council promulgated
the Regulations on Security Protection of Critical Information Infrastructures, which took effect on September 1, 2021 and provide that
“critical information infrastructures” refer to any important network facilities or information systems of important industries
or fields such as public communication and information service, energy, communications, water conservation, finance, public services,
e-government affairs and national defense science, and any other important network facilities or information systems which may endanger
national security, people’s livelihood and public interest in case of damage, function loss or data leakage. In addition, relevant
administration departments of each critical industry and sector, or Protection Departments, shall be responsible to formulate eligibility
criteria and determine the critical information infrastructure operator in the respective industry or field. The operators shall be informed
about the final determination as to whether they are categorized as critical information infrastructure operators. The regulations further
require critical information infrastructures operators, among others, (i) to report to the competent Protection Departments in a timely
manner when the identification result may be affected due to material changes in the critical information infrastructures; (ii) to plan,
construct or put into use the security protection measures and the critical information infrastructures simultaneously; and (iii) to report
to the competent Protection Departments in a timely manner in the event of merger division or dissolution, and deal with critical information
infrastructures as required by the competent Protection Departments. Operators in violation of the regulations may be ordered to rectify,
subject to warnings, fines and other administrative penalties or even criminal liabilities, and the directly responsible personnel in
charge may also be imposed on fines or other liabilities.

On June 10, 2021, the SCNPC promulgated the Data
Security Law of the PRC (the “Data Security Law”), with effect from September 1, 2021. The Data Security Law establishes
a data classification and hierarchical protection system depending on the importance of the data in economic and social development, and
the damage caused to national security, public interests, or the legitimate rights and interests of individuals and organizations if the
data is falsified, damaged, disclosed, illegally obtained or illegally used. Under the Data Security Law, critical information infrastructure
operators shall be subject to the Cybersecurity Law in connection with the cross-border transfer of important data collected and generated