Category: Uncategorized

On 5 March 2024, the Council and the European Parliament reached a provisional agreement on the prohibition of products derived from forced labour, as defined by the International Labour Organisation, and their export to third countries. The agreement introduces a series of changes specifying the responsibilities of the Commission and the competent national authorities in the investigation and decision-making process.

Inspired by Section 307 of the US Tariff Act, which gives US Customs and Border Protection the power to refuse entry into the United States of goods whose manufacture has involved the use of forced labour (Withhold Release Orders – WROs), this proposed Regulation authorises the supervisory authorities to penalise companies by ordering them to withdraw, at their own expense, goods produced using forced labour that they have sold on the European market.

Various elements of the provisional agreement between the two institutions should be mentioned here:

• A database will be created by the Commission detailing verifiable and regularly updated information on the risks associated with forced labour, including reports from international organisations such as the International Labour Organisation.

• This agreement implements various criteria that the Commission and national authorities must apply when assessing the likelihood of a breach of the Regulation:
  • The extent and severity of alleged forced labour, including whether forced labour imposed by a State can be a cause for concern;
  • The quantity or volume of products placed or made available on the EU market;
  • The proportion of the final product that is likely to be the result of forced labour;
  • The proximity of economic operators to the risks of presumed forced labour in their supply chain, and their scope for action in response.
• Guidelines published by the Commission will make it possible to inform and help economic operators and Member States to comply with the requirements of the regulation, as well as good practices to remedy forced labour.

• On the basis of these data, the authorities will open an investigation if there is reasonable evidence to suggest that a product has been produced using forced labour. The Commission will lead investigations outside EU territory. Where the risks are located on the territory of a Member State, the competent authority of that State will lead the investigations. Similarly, if the competent authorities, in the course of assessing the likelihood of violations of the Regulation, discover new information concerning suspected forced labour, they must inform the competent authorities of the other Member States, provided that the suspected forced labour takes place on their territory.

• Economic operators may be heard at all stages of the investigation, and relevant information may be taken into account.

• The decision to ban, withdraw or decommission a product produced using forced labour will be taken by the authority that conducted the investigation. In addition, the agreement specifies that when a component of a product has been found to be in breach of the regulation because it has been produced using forced labour, the obligation to take the product out of circulation applies only to that component and not to the entire product.

This Regulation strengthens the scope of the proposed Directive on corporate sustainability due diligence by obliging companies to ensure that their supply chain is free from forced labour.

In doing so, it is helping to complete the legislative framework for corporate social responsibility, as illustrated by the Corporate Sustainability Reporting (CSRD) and Corporate Sustainability Due Diligence (CSDD) directives.

Our DS team in Brussels and Paris works closely with our clients on this issue. We remain at the disposal of any company wishing to defend its rights and interests regarding forced labour.

Link to the Council of the European Union press release: Council and Parliament reach agreement on ban on products of forced labour

Link to the provisional agreement between the Council and the Parliament: Proposal for a Regulation of the European Parliament and of the Council on the prohibition of products of forced labour on the EU market 

The Customs and International Trade teams at DS Avocats will be happy to provide you with further information: dscustomsdouane@dsavocats.com

Data protection and privacy legal frameworks are evolving rapidly worldwide, and Asia is no exception. Over the past two years, several key jurisdictions have adopted new regulations or updated their existing data protection laws.

These regulations, heavily influenced by the EU’s GDPR, set high standards of compliance for organizations handling personal data. Our Asia-based teams have prepared a detailed overview of national privacy approaches in China, India, Indonesia, Singapore and Vietnam.

Read the newsletter

Since Russia’s invasion of Ukraine in February 2022, the European Union (hereinafter the “EU”) continues to put in place restrictive measures to sanction Russian’s actions. Regulation No. 833/2014 which restricts and prohibits the import and export of certain products originating in Russia, has thus been modified multiple times.

Among these modifications, some aim to limit Russian’s industrial capacities. For instance, since June 3^rd, 2022, it is prohibited to provide, directly or indirectly, certain services to the Russian government or to legal persons, entities or organizations established in Russia. Article 5n §1 targets accounting services, business and management consulting services orpublic relations services.

Since October 6^th, 2022, following the 8^th sanctions package, this ban has been extended to other services. According to §2 of Article 5n, it is prohibited, for example, the provision of legal advisory services and IT consulting services.

On December 18^th, 2023, Regulation (EU) 833/2014 was once again amended following the adoption of the 12th “package” of sanctions. Article 5n was supplemented by paragraph 2b. This paragraph provides that it is now prohibited to sell, transfer, export or make available directly or indirectly software for the management of enterprises and industrial design and manufacturing software listed in Annex XXXIX to the government Russian or to legal entities, entities of organizations established in Russia. According to the Commission’s FAQs, this ban covers their updating and upgrading and also software in material form, for example saved on a USB key and in intangible form, in the case of storage on a cloud.

Management of enterprises means the systems used “to represent and digitally control all the processes taking place in a company”, including enterprise resource planning (ERP), customer relationship management (CRM), business intelligence (BI) or supply chain management (SCM).

Design and manufacturing software includes software “used in architecture, engineering, construction, manufacturing, media, education and entertainment, including” software that enables building information modeling (BIM), computer-aided design (CAD) and computer-aided manufacturing (CAM).

It is important to underline that, all the typical components of the above-mentioned suites are also covered by this appendix. For example, concerning business management software, accounting software, fleet management, logistics and human resources.

Regarding the deadlines surrounding Article 5n 2b, prohibitions targeted by the article entered into force on December 18^th, 2023. The Commission has, however, allowed an additional period: these prohibitions will be effective as of March 20^th, 2024, for contracts concluded before December 19^th, 2023, or ancillary contracts necessary for execution.

These prohibitions in Article 5n §1, §2 and §2b will only be effective for Russian subsidiaries of EU groups as of June 20^th, 2024. From this date, an authorization will be required to provide these services. However, it is important to remember that the Commission sanctions the sanctions’ circumvention. It is therefore necessary to rigorously conduct the “due diligence” process.

Text’s link: COUNCIL REGULATION (EU) No 833/2014 of 31 July 2014 (consolidated version)

European Commission’s FAQs : Consolidated FAQs on the implementation of Council Regulation No 833/2014 and Council Regulation No 269/2014

The Customs and International Trade teams at DS Avocats will be happy to provide you with further information: dscustomsdouane@dsavocats.comm

Data protection and privacy frameworks are increasingly being developed globally. This is particularly the case in Asia: in the past two years, several key jurisdictions, including China, India, Indonesia and Vietnam have either introduced their jurisdiction’s first-ever comprehensive data protection laws or are updating and reforming their existing privacy laws. These regulations are very much influenced by, or borrow concepts from, the EU General Data Protection Regulation (“GDPR”) and set a high standard of compliance for organisations processing personal data.

Below is a snapshot of China, India, Indonesia, Singapore and Vietnam national approaches to privacy prepared by our Asia data privacy task force.

Our Asia data privacy task force. At DS Avocats, we have developed a strong expertise in data protection issues in Asia, enabling us to assist our clients in the development of their operations while taking into account their data compliance obligations. Our knowledge of the GDPR also allows us to bridge the needs of European based headquarters and the local subsidiary in China, India, Indonesia, Singapore and Vietnam.

Indonesia’s long awaited law on Personal Data Protection (Law No. 27 Year 2022) (“PDPL”) finally came into force on 17 October 2022. With its extraterritorial coverage, the PDPL also applies to processing activities outside Indonesian jurisdiction so long as the activities have legal effect or consequences within Indonesia and/or towards Indonesian data subjects outside Indonesia. It classifies personal data into specific and general categories. The PDPL regulates various personal data processing activities, emphasizing principles such as limited and transparent data collection, accurate processing, and security measures. Transitional provisions set a two-year compliance period for entities involved in personal data processing.

PDPL and GDPR

The PDPL is equally close and different from the GDPR.

Both regulations have adopted a broad definition of “personal data” and have created different categories of data based on their sensitivity. The PDPL adopts a similar extraterritorial approach than the GDPR, applying to any entity that processes personal data of Indonesian citizens, whether they are or not in Indonesia and to entities outside of Indonesian jurisdiction who have an impact within Indonesia.

Also, they both aim to safeguard individuals’ rights, emphasizing the importance of protecting personal data as a human right by prioritising transparent and accountable data processing and ensuring individuals are informed.

The PDPL is however critically different from the GDPR concerning the powers of the regulatory bodies. While the Indonesian law gives substantial powers to the government to formulate policies, supervise implementation and enforce sanctions, the GDPR relies on independent authorities.

Moreover, the PDPL highlights promoting the growth of the digital economy and information technology industry alongside personal data protection, reflecting a dual focus on development and privacy, while the GDPR focuses on protection of individual rights.

Cross-Border Data Transfer Requirements

Under the PDPL, data controllers transferring personal data abroad, must ensure that the recipient country has a level of data protection equivalent or higher than their own. While the GDPR emphasises adequacy decisions, the PDPL focuses on ensuring the receiving entity’s protection level. Moreover, the PDPL introduces the possibility of obtaining approval from the relevant data subject if equivalent protection is not assured, a provision not explicitly present in the GDPR.

The PDPL sets forth administrative sanctions to ensure compliance. These sanctions are designed to encourage organisations to adhere to the principles and comply with the obligations outlined in the PDPL. The severity of the sanction depends on the nature and extent of the violation, aiming at balancing enforcement with the goal of promoting responsible and lawful personal data processing.

Legislation:	Law No. 27 Year 2022, Personal Data Protection Law   Sector specific regulation: Banking / Financial Services
Regulator	Ministry of Communication and Informatics of the Republic of Indonesia
Scope	Extra-territorial Any entity processing Indonesian personal data whether they are within or outside of Indonesia.
Definition of personal data	Personal data means any data related to identified or identifiable individuals, separately or in combination with other information, directly or indirectly, through an electronic or non-electronic system.   Sensitive personal data includes 1. Health and information data; 2. Biometric data;genetic data; 3. Criminal records;children’s data; 4. Personal financial data; and/or 5. Other data in accordance with provisions of laws and regulations.
Parties involved in the processing of data	Controller: means any person or corporation, public institution and international organisation acting individually or jointly that determine the purposes and have control over personal data processing activities.   Processor: means any person or corporation, public institution and international organisation acting individually or jointly in processing personal data on behalf of the Controller.
Principles under the PDPL	1. Lawful, fair and transparent processing 2. Purpose limitation 3. Data minimisation 4. Accuracy 5. Integrity, security and confidentiality 6. Lawful retention 7. Ensuring data subjects’ rights 8. Accountability
Rights of data subjects	1. Right to obtain information 2. Right to complete, update and/or rectify errors or inaccuracies 3. Right to access data or copies of dataRight to terminate the processing, deletion or disposal of data 4. Right to withdraw consent 5. Right to object against automated decision-making 6. Right to restrict processingRight to file a lawsuit 7. Right to obtain, use or transfer their data 8. Right to complain to the relevant data protection authority(ies)
Security	The Controller and Processor are required to protect and ensure the security of the processed personal data. This shall be achieved through: a) preparing and implementing operational technical measures to protect personal data from disruption in the data processing; b) determining the security level of personal data by taking into account the nature and risks of the processed personal data; c) andusing a security system for the processed personal data and/or processing personal data using an electronic system in a reliable, secure and responsible manner.
Requirement for consent	Children: Under the PDPL, processing children’s personal data requires the consent of their parent or legal guardian. The PDPL defer the authority to set out the age of consent to other laws. Based on Law No. 23 of 2002 regarding Child Protection, as amended by Law No. 35 of 2014, a child is an individual who has not reached the age of 18 years.
Cross-Border Data Transfer	Cross-border data transfer can be carried out if one of the following conditions is fulfilled: – the transferor must ensure that the recipient’s country has an equivalent or higher standard of personal data protection than the PDP Law; – if the above condition in letter a is not met, the transferor must ensure the existence of an adequate and binding instrument (e.g., standard contractual clause); or – if the above conditions in letters a and b are not met, the transferor must obtain the data subjects’ consent.
Breach notification	In the event that a data breach occurs, the Controller is required to submit a written notification to the affected data subjects and the Indonesian DPA no later than three days from the occurrence of the data breach. In certain circumstances, the data breach shall also be notified to the public if it disturbs public services and/or has a material impact on the public interest.  The notification shall contain the following items: – the disclosed data; – the time and reason of the breach; and – the remedy measure carried out by the Controller.
Penalties/ sanctions	I) written warning II) temporary suspension of the data processing activity III)erasure or destruction of personal data; and/or VI) an administrative fine in the maximum amount of two per cent of annual income or annual receipt of the violation variable

Data protection and privacy frameworks are increasingly being developed globally. This is particularly the case in Asia: in the past two years, several key jurisdictions, including China, India, Indonesia and Vietnam have either introduced their jurisdiction’s first-ever comprehensive data protection laws or are updating and reforming their existing privacy laws. These regulations are very much influenced by, or borrow concepts from, the EU General Data Protection Regulation (“GDPR”) and set a high standard of compliance for organisations processing personal data.

Below is a snapshot of China, India, Indonesia, Singapore and Vietnam national approaches to privacy prepared by our Asia data privacy task force.

• Chine – Personal Information Protection Law (PIPL)
• Indonesie – Personal Data Protection Law (PDPL)
• Singapour – Personal Data Protection Act (PDPC)
• Viêt Nam – Personal Data Protection (DPDP

Our Asia data privacy task force. At DS Avocats, we have developed a strong expertise in data protection issues in Asia, enabling us to assist our clients in the development of their operations while taking into account their data compliance obligations. Our knowledge of the GDPR also allows us to bridge the needs of European based headquarters and the local subsidiary in China, India, Indonesia, Singapore and Vietnam.

1. Brief Introduction of Personal Data Protection in China

The Personal Information Protection Law (“PIPL”) of the People’s Republic of China (“PRC”), which came into effect on 1 November 2021 is known as “Chinese GDPR” due to its similarities with the EU General Data Protection Regulation (“GDPR”).

Foreign invested enterprises (“FIEs”) familiar with the European approach to data protection would have some advantages in implementing the “Chinese GDPR”, as some of the best practices established under the GDPR hold significant value as a model. However, as influenced by the GDPR as the PIPL might be, one cannot simply rely on their knowledge of the GDPR while approaching the PIPL and must take into account the distinctive features of data controllers/processors in China.

Although the PIPL follows a similar framework than the GDPR, it gradually shows more of its own unique features through both its supporting regulations, implementing rules, national standards and compliance practices recommended by competent authorities. Before the PIPL came into effect, provisions related to data protection were scattered across different laws and regulations, including but not limited to the PRC Civil Code, Criminal Law, Cybersecurity Law, the Law on the Protection of Minors and E-commerce Law.

For certain strategic industries, industry-specific regulations, standards, and guidelines that may impose further obligations concerning data security and other related matters should not be overlooked. In addition to meeting the duties outlined by PIPL and PRC Data Security Law for processing data, controllers/processors may also encounter tougher cybersecurity demands and extra data processing requirements. Therefore, data controllers and processors must adapt data compliance projects by considering their target for compliance and organizational traits.

Data controllers/processors should however not ignore the importance of cybersecurity laws in China, especially the PRC Cybersecurity Law which is closely intertwined with the PIPL. Indeed, some cybersecurity law infringement cases relate to violations on personal data protection as personal data compliance should have been built upon cybersecurity compliance. Data compliance cannot be complete or effective without cybersecurity compliance.

Considering the evolving legal landscape in China, it is advisable for data controllers and processors to take a comprehensive approach in creating and implementing compliance projects. Additionally, it is critical to keep up with legal updates and adjust plans accordingly. In particular, FIEs should balance the compliance requirements imposed by their parent companies in other countries with the compliance targets established for their subsidiaries/FIEs in China.

1. Latest Updates on Data Protection in China

Following the implementation of the PIPL, various national standards, regulations, and guides have been gradually released or updated. These legal instruments provide specific instructions on key aspects of data protection, including consent management, cross border data transfer (“CBDT”), facial recognition, and personal data audit. Below is a brief introduction to the main legal instruments related to these topics.

1. Consent Management

Obtaining consent is one of the legal obligations under the PIPL to process personal data. For certain significant personal data processes, obtaining separate consent from the concerned individuals is also necessary. The Chinese laws and regulations do not explicitly explain how to collect and maintain such consent, but a recommended national standard sets out the general principles regarding consent.

The Information Security Technology—Implementation Guidelines for Notices and Consent in Personal Information Processing (Reference No. GB/T 42574-2023) deals with:

• Information of data subjects (form and content of notice);
• Requirements to obtain consent (including separate consent) and exemptions;
• Refusals and withdrawal of consent; and,
• Preservation of consent as evidence.

1. CBDT

The Chinese CBDT regime is primarily based on and further detailed by two regulations respectively specifying the scenarios and requirements where security assessments and Chinese Standard Contracts are applicable as CBDT compliance tools:

• Measures for the Security Assessment of Outbound Data Transfers (released on July 7^th, 2022 and effective on September 1^st, 2022);
• Measures for the Standard Contract for Outbound Cross-Border Transfer of Personal Information (released on February 22^nd, 2023 and effective on June 1^st, 2023).

The former regulates CBDT as well as personal data, whereas the latter only supervises CBDT relating to personal data. The former appears to have more stringent requirements compared to the latter, which in practice put data exporters in a challenging situation, A recently issued draft regulation, the Draft Provisions on Regulating and Facilitating Cross-border Data Flow (“DPRF CBDT”), released on 28^th September 2023, provides exemptions to the two aforementioned regulations. which, if passed, will facilitate the CBDT and, notably, reduce the compliance burden for data exporters.

However, it is important to note that not all compliance obligations on personal data protection can be exempted through possible exemptions. The DPRF CBDT only pertains to CBDT compliance in later stages of an all-encompassing personal data compliance program. There is much work to be done prior to the implementation of the CBDT compliance tool, including data mapping and corrective measures to ensure lawful processing of personal data, particularly with regard to the principles of data minimization and necessity, which should be diligently observed.

Data controllers have another CBDT compliance tool at their disposal, the Personal Information Protection Certification. Due to its complexity and cost, this option is currently not widely adopted by data controllers.

1. Facial Recognition

Facial information obtained through facial recognition is registered as biometric data/personal sensitive data in accordance with Chinese data protection laws, therefore those in charge of data processing must comply with more rigorous regulations. Before the PIPL, a judicial interpretation called the Provisions of the Supreme People’s Court on Several Issues concerning the Application of Law in the Trial of Civil Cases involving the Processing of Personal Information Using Facial Recognition Technology, released on August 1^st, 2021, provided examples of common civil disputes relating to facial recognition together with criteria on how courts will solve them.

A draft regulation on facial recognition, the Provisions on Security Management of the Application of Face Recognition Technology (for Trial Implementation), was released in August 2023 for public review. The draft document regulates the application of facial recognition and sets out the key responsibilities of data controllers. In particular, it mentions that facial recognition used in public places and processing of personal data of/over 10k data subjects should be filed with the local competent authority. Besides the basic compliance obligations on data, facial recognition service providers targeting the public have stricter requirements on its Multi-Level Protection Scheme (“MLPS”) under the PRC Cybersecurity Law.

1. Personal Data Audit

The PIPL mandates that all data controllers conduct a personal data audit, either voluntarily or upon order of competent authorities. However, it does not specify the audit procedures, frequency or routines. In August 2023, a draft regulation, the Administrative Measures for Personal Information Protection Compliance Auditing, was published for public comment and provides guidance on personal data audits.

Conducting a personal data protection audit is an essential task for data controllers in the initial stages of a personal data compliance project. This will enable data controllers to assess any shortcomings in meeting compliance requirements. It is advisable to use this draft as a reference and commence the audit promptly, as achieving personal data compliance can be a lengthy process.

If they possess adequate resources, personal data audits can be done by the data controllers  themselves. This should occur at least once every two years, or once per year if personal data for over 1 million data subjects is processed.

Data breaches or other data incidents may also trigger an audit, in which case a qualified audit service provider registered with the competent authorities should be engaged. Data controllers should implement corrective measures based on the findings of the first audit report. A second audit will be conducted to determine whether the situation has been improved, and whether the compliance target has been reached. The final report will be submitted to the competent authority.

Furthermore, the draft regulation also outlines essential elements that require auditing, as well as the obligations of audit service providers. Additionally, it stipulates the penalties for non-compliance.

Summary of the PIPL

Aspects\Laws	Personal Information Protection Law (“PIPL”)
Effective Date	November 1st, 2021
Definition of personal data/personal information (“PI”)	Personal information refers to any kind of information related to an identified or identifiable natural person as electronically or otherwise recorded, excluding information that has been anonymized (Article 4, PIPL). Personal information is the information recorded electronically or in other ways that can be used, by itself or in combination with other information, to identify a natural person, including the name, date of birth, identification number, biometric information, residential address, telephone number, email address, health information, whereabouts, and the like, of the person (Article 1034, PRC Civil Code).
Minors’ personal data/personal information	Any personal information of minors under 14 years old is considered as sensitive personal information. Processing personal information of minors should also comply with other applicable laws and regulations, including but not limited to, the Law of the People’s Republic of China on the Protection of Minors, Regulations on the Protection of Minors Online, and the Provisions on the Protection of Minors at School, etc.
Parties involved in data processing	Data Processor: term used in PIPL to designate the data controller (hereinafter referred to as “data controller”/ “controller”) Entrusted Processor: term used in PIPL to designate the data processor (hereinafter referred to as “data processor”/ “processor”)
Scope	Territorial principle: PIPL applies to data processing activities occurring in China. Targeting principle: PIPL applies to data processing activities occurring outside China but targeting natural persons in China: 1. For provision of products and/or service; or 2. for analyzing their behavior.
General principles of processing	1. Lawfulness, legitimacy, necessity and good faith; 2. Legitimate purpose; 3. Data minimization; 4. Openness and transparency; 5. Accuracy and completeness; 6. Security.
Legal Basis for processing	PIPL require controllers to meet at least one of the following conditions for PI processing: 1. Informed consent; 2. Contract and labor management; 3. Legal obligation; 4. Emergency (public health/vital interest of individuals); 5. News reporting, or 6. for public interest purposes; 7. PI disclosed to the public; and, 8. other legal basis specified by other laws and regulations. PIPL specifies that processing PI legally disclosed to the public does not require the consent from the data subject, however the data subject has the right to refuse such processing. In such case, the processing should be stopped.
Rights of data subjects	1. Right to information; 2. Right to access; 3. Right to rectification; 4. Right to erasure/to be forgotten; 5. Right to restriction of processing; 6. Right to data portability; 7. Right to object; 8. Right to not be subject to automated decision-making. 9. Right to make copies(associated to the right to access); 10. Right to decide on the processing activities (associated to the right to restriction and the right to deny).
Protection Measures	PIPL requires that controllers keep a registry of important data processing activities (the scenarios listed in the impact assessment below). Most of the mandatory obligations in protection of personal data and data subjects are undertaken and led by controllers, who should take appropriate technical and organizational measures to ensure the lawful processing of personal data. Processors are responsible for securing data, processing data as agreed in contractual arrangements and assisting controllers.
Impact Assessment	Personal Information Protection Impact Assessment (“PIPIA”)is required in the following scenarios: 1. Cross-border transfer; 2. Process sensitive personal information; 3. Process personal information for decision-making; 4. Providing personal information to 3rd parties; 5. Publicize personal information; 6. Any other scenarios where data subjects’ rights and interests will be greatly impacted.   PIPIA report shall be kept for at least 3 years. As to the approaches, they are provided in relevant Chinese national standards. Besides, PIPIA report for cross-border transfer shall follow an official template and be submitted to the competent authority for record-filing.
CBFT	Informing data subjects, obtaining separate consent if applicable and choosing one to legitimize the transfer: 1. Security Assessment organized by competent authority (in some scenarios this is mandatory and not optional for data exporters); 2. Obtained Personal Information Protection Certification issued by licensed service providers; 3. Concluding Standard Contract between data exporter and data importer.
Breach Notification	Report data breach to the competent authority/authorities within 24 hours/immediately.   Per a draft regulation released on December 8, 2023, the Administrative Measures for the Reporting of Cybersecurity Incidents, any serious cyber incident should be reported within 1 hour to the competent authority, with any key details reported within 24 hours; and, the cyber incident disposal report should also be submitted within 5 working days after it is solved.
Remedies	Data subjects may take legal actions against the infringing party, and the qualified organizations could also take civil legal actions for public interests.

• Details of Administrative Penalties for Violation of PIPL

Scenarios	Penalties
Minor violations	Order of rectification; Warning; Confiscating illegal gains (if any); (for software applications) order of suspension or termination of the service.
Where the violator refuses to rectify the illegal activities	Beside the above, Pecuniary fine (RMB below 1 million) upon the violator; Pecuniary fine (RMB 10k to RMB 100k) upon the person directly in charge of the violator.
Severe violations	Order of rectification by the competent authority in provincial level; Confiscating illegal gains (if any); Pecuniary fine of maximum RMB 50 million or 5% of the previous year’s turnover; Suspension or termination of business, and cancellation of the relevant approvals or business license; Pecuniary fine of minimum RMB 100k to maximum RMB 1 million to the person directly in charge; and, Such person directly in charge of the violator can be banned for a certain period of time from serving as director, supervisor, senior officer or PI protection officer of a relevant enterprise.