business permits or business license; and the directly responsible officers and other persons directly liable shall be imposed a fine of no less than CNY50,000 but no more than CNY200,000. Those who violate the management system for core data of the State and cause harm to the national sovereignty, security and development interests shall be imposed a fine of no less than CNY2 million but no more than CNY10 million by relevant competent departments, and shall be ordered to suspend relevant business or stop operation for rectification, or be subject to revocation of relevant business permits or business license, as appropriate; if a crime is constituted, they shall be held criminally liable in accordance with the law. Article 46 Those who provide any important data to a party outside the territory of the People's Republic of China in violation of Article 31 hereof shall be ordered to make correction and given warnings by relevant competent departments, and may be imposed a fine of no less than CNY100,000 but no more than CNY1 million concurrently; the directly responsible officers and other persons directly liable may be imposed a fine of no less than CNY10,000 but no more than CNY100,000. In case of serious circumstances, they shall be imposed a fine of no less than CNY1 million but no more than CNY 10 million, and may be ordered to suspend relevant business or stop operation for rectification, or be subject to revocation of relevant business permits or business license; the directly responsible officers and other persons directly liable shall be imposed a fine of no less than CNY100,000 but no more than CNY1 million. Article 47 Where any data transaction intermediary organization fails to perform the obligations stipulated in Article 33 hereof, relevant competent departments shall order it to make correction, confiscate any illegal income, and impose a fine of no less than one but no more than ten times the illegal income; where there is no illegal income or the illegal income is less than CNY100,000, a fine of no less than CNY100,000 but no more than CNY1 million shall be imposed, and the relevant competent departments may order such organization to suspend relevant businesses, stop its operation for rectification, or revoke the relevant business permits or business licenses; the directly responsible officers and other persons directly liable shall be imposed a fine of no less than CNY10,000 but no more than CNY100,000. Article 48 Those who refuse to cooperate in data access in violation of Article 35 hereof shall be ordered to make correction and given warnings and may be imposed a fine of no less than CNY50,000 but no more than CNY500,000 concurrently by relevant competent departments; their directly responsible officers and other persons directly liable shall be imposed a fine of no less than CNY10,000 but no more than CNY100,000. Those who provide any data to any foreign judicial or law enforcement body without approval of competent departments in violation of Article 36 hereof shall be given warnings, and may be imposed a fine of no less than CNY100,000 but no more than CNY1 million concurrently by relevant competent departments; their directly responsible officers and other persons directly liable may be imposed a fine of no less than CNY10,000 but no more than CNY100,000. In case of serious consequences, they shall be imposed a fine of no less than CNY1 million but no more than CNY5 million, and may be ordered to suspend relevant business or stop operation for rectification, or be subject to revocation of relevant business permits or business license; their directly responsible officers and other persons directly liable shall be imposed a fine of no less than CNY50,000 but no more than CNY500,000. Article 49 Where any state organ fails to perform its data security protection obligations provided for herein, the directly responsible officers and other persons directly liable shall be sanctioned in accordance with the law. Article 50 Where any government functionary with the duties of overseeing data security neglects his or her duties, abuses his or her powers, or engages in malpractice for selfish ends, he or she shall be sanctioned in accordance with the law. Article 51 Any act of stealing or illegally obtaining data, and any data handling activity that excludes or 7

Select target paragraph3