Company: FENG
Filing Date: 2025-04-18
Form Type: 20-F
Source: 0000950170-25-055759
Chunk: 64

Company: Phoenix New Media Ltd
Filing Date: 2025-04-18
Form: 20-F
Item: Item 4
Chunk 64
---
 have collected, and establish and improve systems to protect users’ information. To collect and use personal information, network operators shall follow the principles of legitimacy, rightfulness and necessity, disclose their rules of data collection and use, clearly express the purposes, means and scope of collecting and using information, and obtain the consent of persons whose data is gathered. Network operators shall not gather personal information unrelated to the services they provide. Network operators shall not divulge, distort or damage the personal information they have collected, and shall not provide the personal information to others without the consent of the persons whose data is collected, except under circumstance where the information has been processed and cannot be recovered and thus it is impossible to match such information with specific persons. In addition, network operators shall perform the following security obligations according to the requirements of the classified protection system for cybersecurity to ensure that the network is free from interference, damage or unauthorized access, and prevent network data from being divulged, stolen or falsified:

• formulate internal security management systems and operating instructions, determine the persons responsible for cybersecurity, and fulfill the responsibilities of cybersecurity protection;

• take technological measures to prevent computer viruses, network attacks, network intrusions and other actions endangering cybersecurity;

• take technological measures to monitor and record the network operation status and cybersecurity incidents, and preserve relevant web logs for no less than six months according to the provisions; and

• take measures such as data classification, as well as back-up and encryption of important data.

Violation of these laws and provisions may result in penalties, including fines, confiscation of illegal income. In circumstances involving serious violations, the competent telecommunication department, public security departments and other relevant authorities may order the network operators to suspend relevant business, stop the business for rectification or close down the websites, or revoke violators’ licenses or permits for their business operations.

On September 12, 2022, the CAC, issued the Decision on Amending the PRC Cybersecurity Law(Draft for Comments), focusing on the following four aspects: (i) to improve the legal liability system for violating the general provisions on the security of cyber operation; (ii) to amend the legal liability system for the security protection of critical information infrastructure; (iii) to adjust the legal liability system for network information security; and (iv) to amend the legal liability system for the protection of personal information. As of the date of this annual report, the PRC Cybersecurity Law(Draft for Comments) has not been formally adopted.

On August 25, 2017