Explainer | Why does ride-hailing giant Didi’s cybersecurity review involve so many Chinese government agencies and who is absent?
- China’s Cybersecurity Review Office is managed by 12 ministries, but only four are involved in Didi’s review with three unrelated agencies invited to join
- It is too early to tell how China’s first cybersecurity review of a Big Tech company might end, but it’s already having a chilling effect on US IPOs
While rules dictate that several ministries could potentially be involved in cybersecurity reviews, not all of them are involved with Didi’s case and some additional ones have been invited on. Here is a closer look at who is involved and what it means for China’s dominant ride-hailing firm.
Which Chinese ministries are involved in cybersecurity reviews?
According to China’s Cybersecurity Review Measures published in 2020, such reviews are handled by the Cybersecurity Review Office under the Cyberspace Administration of China (CAC).
How an obscure government office has struck fear into China’s Big Tech
The office is backed by 12 ministries: the Cyberspace Administration of China, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, the Ministry of State Security, the Ministry of Finance, the Ministry of Commerce, the People’s Bank of China, the State Administration for Market Regulation, the State Administration of Radio, Film and Television, the National Administration of State Secrets Protection, and the State Cryptography Administration.
Which ministerial bodies are involved in the cybersecurity review of Didi Chuxing?
Seven ministries are involved with Didi’s review, according to a statement from the CAC on Friday, but only four of them are among the agencies that back the Cybersecurity Review Office.
In addition to the CAC, the bodies from the review office include the Ministry of Public Security, the Ministry of State Security and the State Administration for Market Regulation. The other three agencies are included on an “ad hoc” basis. They are the Ministry of Natural Resources, the Ministry of Transport and the State Administration of Taxation.
Why are an additional three ministries involved in Didi’s probe?
Chinese authorities did not provide details of how the cybersecurity review is being conducted, but it is possible the additional agencies have been brought in because of the specific industry in which Didi operates.
The Ministry of Natural Resources is the regulator in charge of mapping the country, indicating the body might be involved in reviewing Didi’s mapping information, which is considered part of the sensitive data that the company stores.
The involvement of the Ministry of Transport, which is in charge of regulating licensing of taxi services, could mean the review will also examine Didi’s compliance with taxi licensing and driver qualification laws.
The taxation authority’s involvement is also a strong sign that the probe may involve an investigation into possible tax fraud.
Why are some ministries absent from Didi’s review?
Eight of the 12 ministries that back the cybersecurity review office are not currently involved in the Didi probe. The most surprising for industry watchers is the absence of the Ministry of Industry and Information Technology, as the agency has been very active in reviewing apps for excessive user data collection.
07:30
Why China is tightening control over cybersecurity
The Chinese Securities Regulatory Commission and the State Administration of Foreign Exchange were also notably not among the new agencies invited to participate. The two bodies are not part of the Cybersecurity Review Office, but they are directly involved in overseas listings.
The People’s Bank of China, one of the 12 review office ministries, is also not directly involved.
What does the review mean for Didi?
This is China’s first cybersecurity review into a company, so there is no precedent to suggest how things might end for Didi. Many analysts and legal experts say it is too early to tell how the investigation might end or what punishments Didi could face.
The only indication of the situation’s severity is all the ministries involved. On the surface, it does not look good for Didi, if only because having investigators from the state and public security offices knocking at the door is a nightmare scenario for any Chinese company.
Didi won’t be the last IPO to set sail for New York, but is there a storm ahead?
The good news for the ride-hailing giant is that the absence of key regulators suggests the company ticked all the necessary boxes regarding the conventional procedures for an overseas IPO.