Industry Updates

The Data Dispute Behind Didi's U.S. Listing, Domestic Penalties and Overseas Litigation

There are rumors online that Didi was fined for packaging sensitive user and road data into the United States. Didi's vice president has already stated online that this is a rumor:

The English text below is a convenience translation. The complete original Chinese text follows it.

Didi had just gone public in the US on June 30, and soon after was notified by the Cyberspace Administration of China for national security review.

On July 4, Didi was removed from the app store.

On July 6, Didi's stock price plummeted nearly 20%, wiping out $14 billion in market value.

On July 7, it was revealed that Didi had officially been sued by a U.S. law firm in a class-action lawsuit.

Has Didi recently entered the Mercury retrograde phase?

1. Does Didi provide sensitive data to the US for listing?

There are rumors online that Didi was fined for packaging sensitive user and road data into the United States. Didi's vice president has already stated online that this is a rumor:

Personally, Ibelieve the Vice President's statement. If a Chinese company dares to disclose data related to national security to the U.S. during its IPO approval, it must be because the executives have been kicked out of their heads

In the Cyberspace Administration's notice about Didi's removal from shelves, the wording used was "the app has serious illegal and irregular collection and use of personal information," without claiming that Didi's actions endangered national security. It can be inferred that this does not constitute fact.

2. Why impose heavy fines on Didi?

If we want to investigate illegal personal information collection, probably not a single Chinese internet company is 100% compliant. Why deal with Didi?

On the surface, it appears to be personal information, but behind it lies a national security issue.

Didi has not leaked sensitive information yet, but that does not mean it will not be leaked after listing in the United States.

Why?

Because the U.S. now holds a powerful weapon—

In March this year, the U.S. Securities Exchange (SEC) passed the final amendment to the Holding Foreign Companies Accountable Act. This bill is considered to be designed specifically for Chinese concept stocks. Under this law, the SEC has the authority to conduct routine inspections of companies listed in the United States.

If the SEC requires Didi to provide various data for inspection under the pretext of protecting investors' interests, and Didi cannot violate this requirement, it will not be allowed to delist.

As a domestic travel giant, Didi hires the most expensive professional intermediaries for its IPO, so it's impossible to understand the power of the SEC's bill.

Moreover, the listing in the US was chosen at 00:45 Beijing time on June 30, the eve of the government's centennial celebration, and in the middle of the night. This deliberate low-key approach clearly aimed to avoid attracting domestic attention and quietly making big money.

3. Why do we know there are tigers in the mountains, yet we still head toward them?

Knowing the power of the SEC bill and at such a critical moment of strained China-US relations, why would Didi take such a huge risk to list in the US?

Of course, it's for profit.

Let's take a look at Didi's shareholder structure:

Image from Didi's prospectus

Didi's top two shareholders are SoftBank and Uber, holding 21.6% and 12.8% respectively.

Didi has been established for nine years, and Yang'er has grown fat. The best way out for capital cashing out is, of course, to go public.

If listed domestically, not only is it required to be profitable for three consecutive years, but exporting RMB abroad is very troublesome; If listed in the US, there would be no issue of capital outflow, valuations higher than Hong Kong's capital market, and it would help the company expand into global markets. It would be the optimal choice for both shareholders and the company.

But once private interests conflict with the nation's public interest, they run into conflict.

4. Legal issues behind Didi Data

Let's first take a look at the data Didi has in hand:

First, massive amounts of personal travel data:

Didi has nearly 500 million users and over 40 million daily orders. Besides ordinary citizens, the daily travel data of soldiers and staff with special identities is also included. Using modern technology, it is easy to extract valuable information from massive user data and make use of it.

Second, road data:

As early as 2017, Didi subsidiary Ditu Technology applied for a national high-precision map surveying license. The sensitivity of street data goes without saying, and if foreign governments had access to it, it would truly endanger national security.

Let's take a look at what cybersecurity review means.

The cybersecurity review conducted by the Cyberspace Administration of Didi is defined by the relevant provisions of the "Cybersecurity Review Measures" (Cyberspace Administration of China Announcement No. 6, hereinafter referred to as the "Measures"), and specifically includes:

Article 2 Operators of critical information infrastructure (hereinafter referred to as operators) who procure network products and services that affect or may affect national security shall conduct cybersecurity reviews in accordance with these Measures.

Original language

Complete original Chinese text

The complete Chinese original migrated from the previous website and checked for completeness follows.

滴6月30日前脚刚刚在美国上市,后脚就被网信办通告进行国家安全审查了。


7月4日滴滴在APP应用商店被下架。


7月6日滴滴股价应声暴跌近20%,市值蒸发140亿美元。


7月7日爆出滴滴已经正式被美国律所发起集体诉讼起诉。


滴滴最近进入了水逆期?


一、滴滴为上市向美国提供敏感数据?


网上有传言,滴滴被罚是因为将用户和道路的敏感数据打包提供给了美国,滴滴副总裁已经在网上声明这是谣言:

图片


我个人是相信副总裁声明的。一家中国公司,要是敢在上市审批中把涉及国家安全的数据批露给美国,除非公司的高管脑子被驴踢了图片


网信办关于滴滴下架的通报里,用的措辞也是“App存在严重违法违规收集使用个人信息问题”,并没有说滴滴的行为危害了国家安全。可以推断,并没有构成事实。


图片


二、为什么要对滴滴重罚?


如果要查违规收集个人信息的问题,中国的互联网公司恐怕没有一家是百分之一百合规,为什么要治滴滴?


表面看是个人信息,背后是国家安全问题。


滴滴现在没有泄露敏感信息,但不代表在美国上市之后不会泄露。


为什么?


因为美国手里现在有一个大杀器——


今年3月,美国证券交易所(SEC)通过了Holding Foreign Companies Accountable Act(《外国公司问责法案》)的最终修正案。这部法案被认为是针对中概股制定。根据这部法案,SEC有权对在美上市的企业进行常规性检查。


如果届时,SEC以保护投资者利益的名义要求滴滴提供各种数据配合检查,如果滴滴是不能违背的,除非退市。


滴滴作为国内出行巨头,上市请的都是最贵的专业中介,不可能不知道SEC这部法案的威力。


而且,选在北京时间6月30日00:45在美国上市,这是政府筹备百年大庆的前夜,而且大半夜的,这刻意的低调显然是不想引起国内关注,闷声发大财。 


三、为什么明知山有虎偏向虎山行?


明知SEC法案的威力,而且在中美关系这么不友好的节骨眼上,滴滴为什么还要冒这么大风险去美国上市?


当然是为了利益。


看一下滴滴的股东结构:


图片

图片

图片来自滴滴招股书


滴滴前2大股东分别是软银和Uber,分别持股21.6%和12.8%。


滴滴已经成立9年,羊儿养肥了,资本套现退出最好的出路当然是上市。


如果在国内上市,不但有连续3年盈利的要求,而且人民币出境非常麻烦;如果在美国上市,不存在资金出境的问题,比香港资本市场估值高,而且对公司开拓全球市场有帮助,对股东对公司来说,都是最优选择。


但私利和国家的公利一旦相冲突,就撞枪口上了。


四、滴滴数据后面的法律问题


我们先看一下滴滴手里有哪些数据:


一是海量的个人出行数据:


滴滴拥有近五亿用户,日订单4000多万。除了普通老百姓,一些特殊身份的军人、工作人员的日常出行数据都在里面,利用现代技术很容易在海量的用户数据中挖掘出有价值的信息,加以利用。


二是道路数据:


早在2017年,滴滴旗下的滴图科技就申请了全国高精地图测绘牌照,街道数据的敏感性不用说,如果被外国政府掌握,是实打实的危及国家安全。


再来了解一下什么叫网络安全审查


网信办对滴滴进行的网络安全审查,其定义出自《网络安全审查办法》(国家互联网信息办公室公告第6号,以下简称《办法》)的相关规定,具体包括:

第二条 关键信息基础设施运营者(以下简称运营者)采购网络产品和服务,影响或可能影响国家安全的,应当按照本办法进行网络安全审查。

第十九条 运营者违反本办法规定的,依照《中华人民共和国网络安全法》第六十五条的规定处理。

《中华人民共和国网络安全法》第六十五条规定:

关键信息基础设施的运营者违反本法第三十五条规定,使用未经安全审查或者安全审查未通过的网络产品或者服务的,由有关主管部门责令停止使用,处采购金额一倍以上十倍以下罚款;对直接负责的主管人员和其他直接责任人员处一万元以上十万元以下罚款。


五、结语


除了滴滴,7月5日,网信办对运满满、货车帮、BOSS直聘三家网络平台也进行了网络安全审查——这几家公司都是今年6月份在美国上市的。


现在进入数字经济,数据已经成为兵家必争之地。大数据可以带来经济利益,也可以带来国家安全的隐患。


而一旦涉及数据跨境,就会触及国家安全,这也是中美博弈的背景下,两国在数据跨境问题上寸土不让的根本原因


这一轮网络安全审查风暴,某种意义上是给广大互联网企业提了个醒,如果拥有敏感数据却要去美国上市是存在巨大的风险的。


中国企业在处理数据跨境合规问题时,也应当将国家安全作为逻辑基石,不要抱侥幸心理。


This English convenience translation is provided alongside the complete Chinese original, which prevails. Neither version constitutes legal advice on any specific matter.