每周数据法律资讯 Data Law Weekly（20250623-20250629）

1.《反不正当竞争法》完成第二次修订

6月27日，第十四届全国人民代表大会常务委员会第十六次会议第二次修订《反不正当竞争法》。新修订的《反不正当竞争法》对数字经济时代的网络不正当竞争行为作出了有力回应。其中，第七条将擅自使用他人有一定影响的新媒体账号名称、应用程序名称或者图标纳入混淆行为；同时，规范了对于搜索关键词的使用，规定将他人商品名称、企业名称（包括简称、字号等）、注册商标、未注册的驰名商标等设置为搜索关键词，引人误认为是他人商品或者与他人存在特定联系的，属于混淆行为。此外，第十三条明确经营者不得利用数据和算法、技术、平台规则等实施有关不正当竞争行为；同时，增加关于侵害数据权益的规定，明确经营者不得以欺诈、胁迫、避开或者破坏技术管理措施等不正当方式，获取、使用其他经营者合法持有的数据，损害其他经营者的合法权益，扰乱市场竞争秩序。

【点击查阅修订后法律全文：

http://www.npc.gov.cn/npc/c2/c30834/202506/t20250627_446247.html】

The Anti-Unfair Competition Law（《反不正当竞争法》）has been revised for the second time

On June 27, the Standing Committee of the 14th National People's Congress held its 16th session and revised the Anti-Unfair Competition Law（《反不正当竞争法》） for the second time. The newly revised Anti-Unfair Competition Law provides a strong response to cyber unfair competition in the digital economy era. Among them, Article 7 includes the unauthorized use of another party's new media account name, application name, or icon that has gained significant influence as an act of confusion. Additionally, the law standardizes the use of search keywords, stipulating that setting another party's product name, enterprise name (including abbreviations, trade names, etc.), registered trademarks, or unregistered well-known trademarks as search keywords, thereby misleading consumers into believing that the product is from another party or has a specific connection with another party, constitutes an act of confusion. Furthermore, Article 13 explicitly prohibits operators from using data, algorithms, technology, or platform rules to engage in unfair competition. It also introduces provisions on infringing data rights, clarifying that operators must not obtain or use data lawfully held by other operators through fraudulent, coercive, or other improper means, such as circumventing or destroying technical management measures, thereby harming the legitimate rights and interests of other operators and disrupting market competition order.

[Click to view the revised full text of the law:

http://www.npc.gov.cn/npc/c2/c30834/202506/t20250627_446247.html]

2.国家密码局、国家网信办、公安部联合发布《关键信息基础设施商用密码使用管理规定》

6月27日，国家密码局、国家网信办、公安部联合发布《关键信息基础设施商用密码使用管理规定》。《规定》共二十五条，适用于依据法律法规和国家有关规定认定的关键信息基础设施的商用密码使用管理。《规定》载明，关键信息基础设施使用的商用密码产品、服务应当经检测认证合格，使用的密码算法、密码协议、密钥管理机制等商用密码技术应当通过国家密码管理部门审查鉴定。同时，《规定》明确了关键基础设施的数据安全保护、个人信息保护要求，强调关键信息基础设施应当使用商用密码对其存储、使用、传输的核心数据、重要数据和个人信息进行保护。

【点击查阅《规定》全文：

https://www.oscca.gov.cn/sca/xxgk/2025-06/27/content_1061270.shtml】

The SCA, the CAC, and the MPS jointly issued the “Provisions on the Administration of the Use of Commercial Cryptography in Critical Information Infrastructure”（《关键信息基础设施商用密码使用管理规定》）

On June 27, the State Cryptography Administration（SCA）, the Cyberspace Administration of China（CAC）, and the Ministry of Public Security（MPS） jointly issued the “Provisions on the Administration of the Use of Commercial Cryptography in Critical Information Infrastructure.”（《关键信息基础设施商用密码使用管理规定》）The Provisions consist of 25 articles and apply to the administration of the use of commercial cryptography in critical information infrastructure as defined by laws, regulations, and relevant national provisions. The Provisions stipulate that commercial cryptography products and services used in critical information infrastructure must pass testing and certification, and that commercial cryptography technologies such as cryptographic algorithms, cryptographic protocols, and key management mechanisms must be reviewed and approved by the national cryptography administration department. Additionally, the Provisions clarify data security protection and personal information protection requirements for critical infrastructure, emphasizing that critical information infrastructure must use commercial cryptography to protect core data, important data, and personal information during storage, use, and transmission.

[Click to view the full text of the Provisions:

https://www.oscca.gov.cn/sca/xxgk/2025-06/27/content_1061270.shtml]

3. 国家网信办发布《网信部门行政处罚裁量权基准适用规定》

6月27日，国家网信办发布《网信部门行政处罚裁量权基准适用规定》。《规定》明确，行政处罚裁量权基准是指网信部门在实施行政处罚时，按照裁量涉及的违法行为的事实、性质、情节、社会危害程度、当事人主观过错等因素，对法律、法规、规章中的原则性规定或者具有一定弹性的执法权限、裁量幅度等内容进行细化量化而形成的具体执法尺度和标准。明确网信部门适用行政处罚裁量权基准，应当遵循法制统一、公平公正、过罚相当、处罚与教育相结合等原则。《规定》提出，网信部门行政处罚裁量权基准划分为不予处罚、减轻处罚、从轻处罚、一般处罚、从重处罚等裁量阶次。明确不予处罚、减轻处罚、从轻处罚、从重处罚等具体适用情形。规定违法行为不具有不予处罚、减轻处罚、从轻处罚或者从重处罚情形的，应当给予一般处罚。

【点击查阅规定全文：

https://mp.weixin.qq.com/s/EKfXSujjBT9MB5xZHQNr2A】

The CAC issued the “Provisions on the Application of Administrative Penalty Discretionary Benchmarks by Cyberspace Administration Departments”（《网信部门行政处罚裁量权基准适用规定》）

On June 27, the CAC issued the “Provisions on the Application of Administrative Penalty Discretionary Benchmarks by Cyberspace Administration Departments.” （《网信部门行政处罚裁量权基准适用规定》）The Provisions clarify that administrative penalty discretion benchmarks refer to the specific enforcement standards and criteria established by cyberspace administration departments when imposing administrative penalties. These benchmarks are derived by quantifying and specifying the general provisions of laws, regulations, and rules, as well as the discretionary authority and discretion margins with a certain degree of flexibility, based on factors such as the facts, nature, circumstances, social harmfulness, and the subjective fault of the parties involved in the violation. The provisions clarify that when applying administrative penalty discretion benchmarks, cyberspace administration departments shall adhere to principles such as legal unity, fairness and justice, proportionality of penalties, and the combination of punishment and education. The provisions propose that administrative penalty discretion benchmarks for cyberspace administration departments are divided into the following categories: no penalty, reduced penalty, lenient penalty, general penalty, and severe penalty. Specific circumstances for the application of no penalty, reduced penalty, lenient penalty, and severe penalty are also clarified. It is stipulated that where a violation does not fall under any of the circumstances for no penalty, reduced penalty, lenient penalty, or severe penalty, a general penalty shall be imposed.

[Click to view the full text of the Provisions:

https://mp.weixin.qq.com/s/EKfXSujjBT9MB5xZHQNr2A]

4. 国家网信办发布《数据出境安全评估申报指南（第三版）》

6月27日，国家网信办发布《数据出境安全评估申报指南（第三版）》。《指南》对数据处理者申报数据出境安全评估需要提交的相关材料进行了优化简化，明确数据处理者申请延长数据出境安全评估结果有效期的条件、流程、材料等内容。《指南》规定，数据处理者因业务需要向境外提供重要数据和个人信息，符合数据出境安全评估适用情形的，应当根据《数据出境安全评估办法》和《促进和规范数据跨境流动规定》，按照申报指南申报数据出境安全评估。评估结果有效期届满，符合申请延长评估结果有效期条件的，数据处理者可以在有效期届满前60个工作日内提出延长评估结果有效期申请。

【点击查阅第三版《指南》：

https://www.cac.gov.cn/2025-06/27/c_1752652339765002.htm】

The CAC issued the “Guidelines for the Declaration of Data Outbound Security Assessment (Third Edition)” （《数据出境安全评估申报指南（第三版）》）

On June 27, the CAC issued the “Guidelines for the Declaration of Data Outbound Security Assessment (Third Edition).”（《数据出境安全评估申报指南（第三版）》）The guidelines streamline and simplify the materials that data processors must submit when declaring data outbound security assessments, and clarify the conditions, procedures, and materials required for data processors to apply for an extension of the validity period of data outbound security assessment results. The guidelines stipulate that data processors who need to provide important data and personal information to foreign entities for business purposes and meet the applicable circumstances for data cross-border transfer security assessments shall submit applications for such assessments in accordance with the “Measures for Data Cross-Border Transfer Security Assessments”（《数据出境安全评估办法》）and the “Provisions on Promoting and Regulating Data Cross-Border Flow,” （《促进和规范数据跨境流动规定》） following the application guidelines. Upon the expiration of the validity period of the assessment results, data processors who meet the conditions for extending the validity period may submit an application for such extension within 60 working days prior to the expiration date.

[Click to view the third edition of the Guidelines：

https://www.cac.gov.cn/2025-06/27/c_1752652339765002.htm]

5. 全国网安标委发布《人工智能生成合成内容标识方法文件元数据隐式标识文本文件》等6项网络安全标准实践指南的征求意见稿

6月24日，全国网络安全标准化技术委员会发布6项网络安全标准实践指南的征求意见稿，并向社会公开征求意见。6项实践指南分别为：《人工智能生成合成内容标识方法文件元数据隐式标识文本文件》《人工智能生成合成内容标识方法文件元数据隐式标识图片文件》《人工智能生成合成内容标识方法文件元数据隐式标识音频文件》《人工智能生成合成内容标识方法文件元数据隐式标识视频文件》《人工智能生成合成内容标识方法文件元数据隐式标识安全防护技术指南》《人工智能生成合成内容检测技术指南》。

【参见：

https://mp.weixin.qq.com/s/-oA9eVUK-JDHuO4cihBYGw】

The TC260 released drafts for comment of six Cybersecurity Standard Practice Guidelines

On June 24, the TC260 released drafts for comments of six cybersecurity standard practice guidelines and solicited public comments. The six practice guidelines are: “Identification Methods for AI-Generated and Synthetic Content: Implicit Identification of File Metadata - Text Files”,（《人工智能生成合成内容标识方法文件元数据隐式标识文本文件》）“Identification Methods for AI-Generated and Synthetic Content: Implicit Identification of File Metadata - Image Files”, （《人工智能生成合成内容标识方法文件元数据隐式标识图片文件》）“Identification Methods for AI-Generated and Synthetic Content: Implicit Identification of File Metadata - Audio Files”, （《人工智能生成合成内容标识方法文件元数据隐式标识音频文件》）“Identification Methods for AI-Generated and Synthetic Content: Implicit Identification of File Metadata - Video Files”, （《人工智能生成合成内容标识方法文件元数据隐式标识视频文件》）“Identification Methods for AI-Generated and Synthetic Content: Implicit Identification of File Metadata - Safety Protection Technology Guidelines”, 《人工智能生成合成内容标识方法文件元数据隐式标识安全防护技术指南》and “Technical Guidelines for Detection of AI-Generated and Synthetic Content.” （《人工智能生成合成内容检测技术指南》）

[Reference:

https://mp.weixin.qq.com/s/-oA9eVUK-JDHuO4cihBYGw]

6. 上海网信办等十一部门联合发布《上海市人脸识别技术合规应用倡议书》

6月23日，上海市委网信办联合市通信管理局、市公安局、市市场监管局、市商务委、市教委、市科委、市文旅局、市体育局、市绿化市容局、市房管局发布《上海市人脸识别技术合规应用倡议书》。倡议书提出了“六不得”，包括：一、非特定必要，不得强制使用人脸识别技术；二、未告知目的、用途，不得收集人脸信息；三、未经个人单独同意，不得处理分析人脸信息；四、未开展影响评估，不得处理人脸信息；五、已实现收集目的的，不得继续存储人脸信息；六、私密空间等特殊场所，不得过度使用人脸识别技术。

【参见：

https://mp.weixin.qq.com/s/NF2eFiJb3Qr82HjWL1CSPQ】

Shanghai Cyberspace Administration and 10 other departments jointly issued the “Shanghai Initiative on the Compliance of Facial Recognition Technology”（《上海市人脸识别技术合规应用倡议书》）

On June 23, the Shanghai Cyberspace Administration, in conjunction with the Municipal Communications Administration, Municipal Public Security Bureau, Municipal Market Supervision and Administration Bureau, Municipal Commission of Commerce, Municipal Education Commission, Municipal Science and Technology Commission, Municipal Culture and Tourism Bureau, Municipal Sports Bureau, Municipal Greenery and City Appearance Bureau, and Municipal Housing Administration Bureau, issued the “Shanghai Initiative on the Compliance of Facial Recognition Technology.”（《上海市人脸识别技术合规应用倡议书》）The initiative consists of six prohibitions: 1. Facial recognition technology shall not be used compulsorily unless strictly necessary; 2. Facial information shall not be collected without informing the purpose and use; 3. Facial information shall not be processed or analyzed without the individual's separate consent; 4. Facial information shall not be processed without conducting an impact assessment; 5. Facial information shall not be stored after the purpose of collection has been achieved; 6. Facial recognition technology shall not be used excessively in special places such as private spaces.

[Reference:

https://mp.weixin.qq.com/s/NF2eFiJb3Qr82HjWL1CSPQ]

7. 上海市网信办对一批拒不整改的生成式人工智能服务网站予以立案处罚

6月24日，上海市网信办在专项行动中发现，部分对外提供生成式人工智能服务功能的网站，未按法律要求开展安全评估工作、未采取必要的安全措施防范违规信息生成、未采取限制措施防止生成式人工智能功能被滥用，导致相关生成功能侵犯个人信息权益、产出“开盒”“洗钱”等违法违规内容、生成色情低俗图片等信息内容，存在较大安全风险。上海市网信办督促企业自行下线相关功能，在通过安全评估后方可重新上线。通报指出，在近期“回头看”巡查发现，在未通过安全评估、未采取必要安全防护措施等情况下，被要求下线的3家企业自行重新上线存在安全风险的生成式人工智能功能。上海市网信办依法约谈企业，进行严肃批评，要求全面整改，并依法对涉事企业进行立案查处。其中，涉及的典型问题包括：生成侵害他人个人信息权益的违规信息、生成侵犯他人名誉权、隐私权等合法权益的违规信息、生成色情、暴力等法律法规禁止的违规信息。

【参见：

https://mp.weixin.qq.com/s/kWsWPXX34SdVo8_NYnqvhw】

The Shanghai Cyberspace Administration imposed penalties against a number of generative AI service websites that have refused to rectify their violations

On June 24, during a special enforcement campaign, the Shanghai Cyberspace Administration discovered that certain websites offering generative AI services had failed to conduct security assessments as required by law, had not implemented necessary security measures to prevent the generation of non-compliant information, and had not taken restrictive measures to prevent the misuse of generative AI functions. This resulted in related generative functions infringing upon personal information rights, producing illegal content such as “unboxing” and “money laundering”, and generating pornographic or vulgar images, posing significant security risks. The Shanghai Cyberspace Administration urged the companies to voluntarily take down the relevant functions and only relaunch them after passing security assessments. The notice pointed out that during recent follow-up inspections, three companies that had been required to take down their functions had voluntarily relaunched the generative AI functions without passing security assessments or implementing necessary security measures, posing security risks. The Shanghai Cyberspace Administration legally summoned the companies for a serious reprimand, demanded comprehensive rectification, and initiated investigations and penalties against the involved companies in accordance with the law. Typical issues involved include: Generating information that infringes upon others' personal information rights, generating information that infringes upon others' reputation rights, privacy rights, and other legitimate rights, and generating information containing pornography, violence, and other content prohibited by laws and regulations. 

[Reference:

https://mp.weixin.qq.com/s/kWsWPXX34SdVo8_NYnqvhw] 

8.公安部通报45款违法违规收集使用个人信息的移动应用

6月24日，公安部计算机信息系统安全产品质量监督检验中心通报了45款违法违规收集使用个人信息的移动应用。这些移动应用涉及的问题有未公开收集使用规则；未逐一列出收集、使用个人信息的目的、方式、范围；在申请打开可收集个人信息的权限时，未同步告知用户其目的；征得用户同意前就开始收集个人信息；实际收集的个人信息超出用户授权范围；个人信息保护政策中描述需要收集的个人信息超出相关功能的必要范围；提前要求用户打开非当前功能所需的可收集个人信息权限；注销账户的流程中设置不合理的条件或提出额外要求等。

【参见：

https://mp.weixin.qq.com/s/1aCQ8SaOfP1GuVUTDEVYVA】

The MPS reported 45 mobile applications that illegally collect and use personal information

On June 24, the MPS Quality Supervision and Testing Center of Security Products for Computer Information Systems（hereinafter referred as “MPS”） reported 45 mobile applications that illegally collect and use personal information. These mobile applications have issues such as not disclosing the rules for collecting and using information; not listing the purpose, method, and scope of collecting and using personal information one by one; failing to inform users of the purpose when requesting consent to access personal information; collecting personal information before obtaining user consent; collecting personal information beyond the scope authorized by users; describing the scope of personal information to be collected in the privacy policy as exceeding the necessary scope for related functions; requiring users to enable consents to access personal information not needed for current functions in advance; and setting unreasonable conditions or making additional demands during the account cancellation process.

[Reference:

https://mp.weixin.qq.com/s/1aCQ8SaOfP1GuVUTDEVYVA]

9. 工信部通报57 款存在侵害用户权益行为的APP （SDK）

6月26日，工业和信息化部信息通信管理局发布关于侵害用户权益行为的APP（SDK）通报（2025年第3批，总第48批），涉57款APP（SDK）。这些APP（SDK）所涉问题包括：信息窗口乱跳转；信息窗口无法关闭；违规收集个人信息；超范围收集个人信息；APP频繁自启动和关联启动；APP强制、频繁、过度索取权限；强制用户使用定向推送功能；应用分发平台上的App信息明示不到位；SDK信息公示不到位等。

【参见：

https://www.miit.gov.cn/jgsj/xgj/gzdt/art/2025/art_eb31dd22d04a4658b912871c090274bd.html】

The MIIT issued notice on 57 apps (SDKs) found to infringe upon user rights

On June 26, the Department of Information and Communications Technology of the Ministry of Industry and Information Technology (MIIT) released a notice on apps (SDKs) found to infringe upon user rights (Batch 3 of 2025, Total Batch 48), involving 57 apps (SDKs). The issues identified in these apps (SDKs) include: Random redirection of information windows; information windows can not be closed; illegal collection of personal information; collection of personal information beyond the scope of necessity; frequent self-startup and associated startup of apps; forced, frequent, or excessive requests for permissions; forcing users to use targeted push features; inadequate disclosure of app information on app distribution platforms; and inadequate disclosure of SDK information, among others.

[Reference:

https://www.miit.gov.cn/jgsj/xgj/gzdt/art/2025/art_eb31dd22d04a4658b912871c090274bd.html]

1. 柏林要求苹果和谷歌下架DeepSeek

6月27日，柏林数据保护和信息自由专员表示已向德国谷歌和苹果公司举报人工智能应用程序DeepSeek含有非法内容。这两家公司必须立即审查该报告，并决定是否屏蔽该应用程序。原因是该应用程序将用户的个人数据非法传输到中国。柏林数据保护和信息自由专员梅克·坎普 (Meike Kamp) 表示，DeepSeek 将用户数据传输到中国是违法的，DeepSeek 未能令人信服地证明，德国用户在中国的数据受到的保护程度与欧盟相当，中国当局拥有在中国公司势力范围内获取个人数据的广泛权利。

【参见：

https://www.datenschutz-berlin.de/pressemitteilung/berliner-datenschutzbeauftragte-meldet-ki-app-deepseek-in-deutschland-bei-apple-und-google-als-rechtswidrigen-inhalt/】

Berlin demanded Apple and Google remove DeepSeek

On June 27, the Berlin Data Protection and Freedom of Information Commissioner reported to German Google and Apple company that the artificial intelligence application DeepSeek contains illegal content. The two companies must immediately review the report and decide whether to block the application. The reason is that the application illegally transfers users' personal data to China. Berlin's Data Protection and Freedom of Information Commissioner, Meike Kamp, stated that DeepSeek's transfer of user data to China is illegal. DeepSeek has failed to convincingly demonstrate that German users' data in China is protected to the same extent as in the EU, and Chinese authorities have broad rights to access personal data within the scope of Chinese companies' operations.

[Reference:

https://www.datenschutz-berlin.de/pressemitteilung/berliner-datenschutzbeauftragte-meldet-ki-app-deepseek-in-deutschland-bei-apple-und-google-als-rechtswidrigen-inhalt/]

2. 越南国会通过《个人数据保护法》

6月26日，越南国会通过《个人数据保护法》，将于2026年1月1日正式生效。该法案包含39个条款，将禁止影响国防、国家安全、社会秩序和安全以及机关、组织和个人合法权益的数据处理活动。此外，法案还规定了一系列具体的禁止行为，如，妨碍个人数据保护活动；利用个人数据保护活动实施违法行为；违法处理个人数据；使用他人个人数据或允许他人使用本人个人数据实施违法行为；买卖个人数据；盗用、故意泄露或丢失个人数据。违反个人数据保护法的组织和个人可能受到行政处罚甚至刑事追究；造成损失的，必须赔偿损失。其中，对于买卖个人数据的行政违法行为，最高罚款金额为营业额的10倍；对于违反个人数据跨境转移规定的组织，最高罚款金额为该组织上一年度营业额的5%。

【参见：

https://quochoi.vn/tintuc/Pages/su-kien-noi-bat.aspx?ItemID=94817】

Vietnam's National Assembly passed the Law on Personal Data Protection

On June 26, the National Assembly of Vietnam passed the Law on Personal Data Protection,which will officially take effect on January 1, 2026. The law consists of 39 articles and prohibits data processing activities that may affect national defense, national security, social order and security, as well as the legitimate rights and interests of agencies, organizations, and individuals. Additionally, the law has specified a series of specific prohibited acts, such as: Obstructing personal data protection activities; using personal data protection activities to commit illegal acts; illegally processing personal data; using another person's personal data or allowing others to use one's own personal data to commit illegal acts; buying or selling personal data; and stealing, intentionally disclosing, or losing personal data. Organizations and individuals violating the Law may face administrative penalties or even criminal prosecution; those causing losses must compensate for the damages. For administrative violations involving the buying or selling of personal data, the maximum fine is 10 times the organization's annual turnover. For organizations violating regulations on the cross-border transfer of personal data, the maximum fine is 5% of the organization's annual turnover from the previous year.

[Reference:

https://quochoi.vn/tintuc/Pages/su-kien-noi-bat.aspx?ItemID=94817]