China sends state security officials and police to Didi for cybersecurity investigation

Earlier this month, the Cyberspace Administration of China, the country’s internet regulator, ordered Didi to submit to a cybersecurity exam for national security concerns, days after the company raised $ 4.4 billion in an initial public offering in New York. The regulator also said Didi illegally collected personal data and ordered the removal of more than two dozen of its apps from app stores.

The Ministry of Public Security is responsible for China’s internal security, while the Ministry of State Security oversees the country’s civilian branch for intelligence gathering and counterintelligence. Lawyers and analysts say the two ministries are part of an agency overseeing cybersecurity reviews.

Yet their participation signals the potentially serious nature of the investigation. Potential outcomes include financial penalties, business license suspensions, and criminal charges.

The large number of ministries participating in the survey also highlights the extent of the data held by Didi and which is now subject to regulatory review. The Ministry of Transport regulates the VTC industry, while the Ministry of Natural Resources is responsible for road mapping and surveying.

Didi did not respond to a request for comment.

Didi is the first major internet company to publicly undergo cybersecurity review, said Yan Luo, partner and cybersecurity lawyer at Covington & Burling LLP in Beijing. China’s Cyberspace Administration last week released a review of the security review, for public comment, in which it said companies with personal data on at least one million users must request a review. cybersecurity before any foreign registration.

The survey illustrates how regulators are expanding the scope of cybersecurity reviews, which in the past focused on technology supply chain risks, to more broadly defined data security risks, such as transfers. cross-border “important data and a large amount of personal data,” Ms. Luo said.

Didi, China’s most popular ridesharing app, with 377 million annual active users, collects data, including consumer personal information, street mapping, and real-time movement of vehicles and people. This has put the company’s data collection and processing practices on regulators’ radar, as that data is considered sensitive by Chinese authorities, lawyers and analysts have said.

On Friday morning, dozens of officials arrived at Didi’s headquarters in Beijing and spoke with executives, according to an employee there. While the on-site visit by officials did not surprise many employees, the atmosphere in the company was tense and employees there were ordered to remain silent and not to post the development on the media. social, the person said.

The Wall Street Journal reported earlier that Didi continued his IPO despite being urged by China’s internet regulator to submit to a cybersecurity review.

Didi’s shares are trading around 12% below their IPO price.

—Raffaele Huang contributed to this article.

Write to Liza Lin at [email protected]