(2) there is any change in personal information protection policies and regulations in the country or region where the overseas recipient is located, which may affect personal information rights and interests; or (3) other circumstances that may affect personal information rights and interests. Article 9 Cyberspace authorities and their staff members shall keep confidential any personal privacy, personal information, trade secrets, or confidential business information that they come to know in the course of the performance of their duties, and must not disclose or illegally provide to others or use such information. Article 10 Any organization or individual who finds that a personal information processor provided personal information to any overseas recipient in violation of the Measures may report the case to a cyberspace authority at or above the provincial level. Article 11 Where a cyberspace authority at or above the provincial level finds any considerable risk or any personal information security incident in relation to an activity of outbound cross-border transfer of personal information, it may conduct a regulatory talk with the personal information processor concerned according to law. The personal information processor shall rectify and eliminate the risk as required. Article 12 Anyone who violated the Measures shall be dealt with in accordance with the Personal Information Protection Law of the People's Republic of China and other laws and regulations; and there shall be investigation for criminal liability according to law if the violation constitutes a criminal offense. Article 13 The Measures shall come into force on June 1, 2023. Any activity of outbound cross-border transfer of personal information initiated before the entry into force of the Measures that does not comply with the Measures shall be rectified within 6 months from the date of entry into force of the Measures. 3