On June 30, four days ago, Didi, a nine-year-old company, was officially listed on the New York Stock Exchange with the stock code of "didi”.  On July 2, Cyberspace Security Review Office announced to carry out cyberspace security review on DiDi in accordance with the Measures for Cyberspace Security Review, in order to prevent national data security risks, safeguard national security and protect public interests.  As a result, DiDi was requested to stop the registration of new users during the review period.  It is the first time that China kicked off the first national security review.

On July 4, Cyberspace Administration of China announced that, according to a whistleblowing tip, it is verified that the DiDi app has serious problems of illegal collection and use of personal information.  According to the relevant provisions of Cybersecurity Law, Cyberspace Administration of China decided to shut off DiDi app, and required DiDi company to take remedial measures to address the problems.

It seems that DiDi has two compliance risks to face: national security and personal information.  Of the two risks, national security could be a more serious concern for DiDi and always a compliance nightmare for multinational companies in China.  It is also surprising that such a big company did not identify and control well its compliance risks on personal information before getting listed in New York Stock Exchange.  It is worth to know that China government launched the investigation upon a whistleblowing tip -- if you do not do your compliance well, there could be many whistleblowers always ready to help you.

_________

The author, Henry Chen, licensed to practice law in China and New York, is a senior partner at the Dentons office in Shanghai. Before joining Dentons, Henry was AP Compliance Director of Ford.  Henry Chen is also Certified Information Security Personnel (CISP) and Critical Information Infrastructure Personnel (CIIP).

Henry Chen is a drafter of China national standard (draft) Information security technology-Cyber-data process security specification  (信息安全技术 网络数据处理安全规范).

Henry's practice areas include cyber security and data governance, FCPA, anti-bribery and fraud investigations, economic sanctions and trade controls, compliance management systems, corporate matters and dispute resolution. You can reach Henry by sending an email to henry.chen@dentons.cn. Henry is the author of the book Risk Management on Commercial Bribery in China and the book Compliance Risks of Enterprises in Globalization: Outbreak and Control.