国外上市和香港上市在网络安全审查方面有区别吗？

《审查办法》规定，“掌握超过100万用户个人信息的运营者赴国外上市”应主动申报网络安全审查，相较于《中华人民共和国证券法》以及国务院的有关规定，此条款并未使用“境外”这一概念，而是使用了“国外”一词。我们认为，这一特殊安排的用意旨在将赴香港上市排除在本条所规定的网络安全审查的适用范围。《数安条例》将“赴国外上市”和“赴香港上市”通过第十三条的第二项和第三项分置规定，显然印证了这一理解，即《审查办法》第六条的适用范围不包括香港上市。

我们理解，《数安条例》并非在《审查办法》基础上对香港上市监管加码，而是法律适用的明确。《数安法》第二十四条规定，“国家建立数据安全审查制度，对影响或者可能影响国家安全的数据处理活动进行国家安全审查。”即，只要数据处理活动影响或可能影响国家安全，都会触发安全审查，赴港上市行为当然也应包括在内。《审查办法》第六条虽然不包括香港上市，但在第二条却有原则性的要求，即：“数据处理者开展数据处理活动，影响或可能影响国家安全的，应当按照本办法进行网络安全审查。”

据此，相较于对国外上市所采取的一刀切的量化标准，赴港上市的网络安全审查采取是风险导向的标准，只有确实存在影响或可能影响国家安全的风险，才会触发网络安全审查。同时，为消除该规定对香港上市带来的不确定性，我们也建议监管部门尽快制定赴港上市的数据风险预判指南。

最后，《数安条例》第三十二条还规定赴境外上市的数据处理者应每年开展数据安全评估并向市级网信部门报送的义务。此为赴国外上市和赴香港上市均需遵循的法定义务。

翻译：

Is there a difference in network security review between overseas listing and Hong Kong listing?

According to the regulations, “Operators with more than 1 million users’ personal information should report for cyber security review.” Compared with the Securities Law of the People’s Republic of China and relevant regulations of The State Council, this article does not use the concept of “overseas”, but uses the word “foreign”. In our view, this special arrangement is intended to exclude listings in Hong Kong from the scope of the cyber security review provided for in this Article. By separating the terms “overseas listing” and “Hong Kong listing” through the second and third provisions of Article 13, the Data Safety Ordinance clearly confirms this understanding that Article 6 of the Review Measures does not cover listing in Hong Kong.

We understand that the Data Safety Ordinance does not increase the regulation of listing in Hong Kong on the basis of the Review Measures, but clarifies the application of the law. Article 24 of the Data Security Law stipulates that “the State establishes a data security review system to conduct national security review on data processing activities that affect or may affect national security.” That is, whenever data-processing activities affect or could affect national security, a security review is triggered, and listing in Hong Kong should certainly be included. Although Article 6 of the Review Measures does not cover listing in Hong Kong, Article 2 has a principled requirement, namely: “Where data processors carry out data processing activities that affect or may affect national security, they shall conduct network security review in accordance with these Measures.”

Therefore, compared with the one-size-fits-all quantitative standards for foreign listings, the network security review for Hong Kong listings is risk-oriented. Only when there is a real risk that affects or may affect national security, the network security review will be triggered. At the same time, in order to eliminate the uncertainty caused by the regulation on listing in Hong Kong, we also suggest that the regulatory authorities formulate data risk prediction guidelines for listing in Hong Kong as soon as possible.

Finally, Article 32 of the “data security Regulations” also stipulates that data processors listed overseas should carry out annual data security assessment and report to the municipal network information department. This is the legal obligation to go public both abroad and in Hong Kong.