每周数据法律资讯 Data Law Weekly（20250721-20250727）

1. 2025世界人工智能大会暨人工智能全球治理高级别会议发表《人工智能全球治理行动计划》

7月26日，于中国上海举行的2025世界人工智能大会暨人工智能全球治理高级别会议发表了《人工智能全球治理行动计划》。计划旨在呼吁各方在遵循向善为民、尊重主权、发展导向、安全可控、公平普惠、开放合作的目标和原则基础上，切实采取有效行动，协力推进全球人工智能发展与治理。计划提出了十三点举措分别为：共同把握人工智能机遇、促进人工智能创新发展、推动人工智能赋能千行百业、加快数字基础设施建设、营造多元开发创新生态、积极推进优质数据供给、有效应对能源环境问题、促进标准及规范共识公共部门率先部署应用、开展人工智能安全治理、共同落实《全球数字契约》、加强人工智能能力建设国际合作、构建多方参与的包容治理模式。

【参见：

https://www.mfa.gov.cn/zyxw/202507/t20250726_11677803.shtml】

The 2025 World Artificial Intelligence Conference and High-Level Meeting on Global Governance of Artificial Intelligence issued the “Global Governance Action Plan for Artificial Intelligence”

On July 26, the 2025 World Artificial Intelligence Conference and High-Level Meeting on Global Governance of Artificial Intelligence, held in Shanghai, China, released the “Global Governance Action Plan for Artificial Intelligence.” The plan aims to call on all parties to take effective actions in accordance with the goals and principles of benefiting the people, respecting sovereignty, promoting development, ensuring security and controllability, achieving fairness and inclusiveness, and fostering openness and cooperation, to jointly advance the development and governance of global artificial intelligence. The plan proposes 13 measures, which are: jointly grasping the opportunities of artificial intelligence, promoting the innovative development of artificial intelligence, driving artificial intelligence to empower all industries, accelerating the construction of digital infrastructure, fostering a diverse and innovative development ecosystem, actively promoting the supply of high-quality data, effectively addressing energy and environmental issues, promoting consensus on standards and regulations, public sector leading the way in deployment and application, conducting artificial intelligence security governance, jointly implementing the Global Digital Compact, strengthening international cooperation on artificial intelligence capacity building, and building an inclusive governance model with multi-stakeholder participation.

[Reference:

https://www.mfa.gov.cn/zyxw/202507/t20250726_11677803.shtml]

2. 广东网信部门下架一违规AI APP

7月26日，广东网信通报2025年第二季度网络处置与执法情况，并公布典型执法案例。案例一中，网民举报“奶*AI”APP生成的智能回复内容中存在低俗不雅的语音和文字信息，属地网信部门联合公安部门到APP开发公司进行现场检查，发现该APP审核机制不健全，且该公司存在未制定网络安全管理制度和防范有害信息传播的应急预案等问题，违反了《网络安全法》《生成式人工智能服务管理暂行办法》等有关规定，公安部门已依法依规给予该公司警告的行政处罚，并责令其下架APP进行整改。

【参见：

https://mp.weixin.qq.com/s/Q9TeoUs8xBK36LqbVIE3tA】

Guangdong Cyberspace Administration removed an illegal AI App

On July 26, the Guangdong Cyberspace Administration announced the results of its online content review and enforcement actions for the second quarter of 2025, and released several typical enforcement cases. In Case 1, netizens reported that the “奶*AI” app generated intelligent responses containing vulgar and inappropriate audio and text content. Local cyberspace administration authorities, in collaboration with public security departments, conducted on-site inspections at the app development company. They found that the app's review mechanism was inadequate, and the company had failed to establish cybersecurity management systems and emergency response plans to prevent the spread of harmful information, violating the Cybersecurity Law and the Interim Measures for the Administration of Generative Artificial Intelligence Services. The public security authorities have imposed an administrative penalty of a warning on the company in accordance with the law and ordered it to remove the app and rectify the issues.

[Reference:

https://mp.weixin.qq.com/s/Q9TeoUs8xBK36LqbVIE3tA]

3. 上海市通信管理局开展2025年人工智能安全赋能专项行动

7月25日，上海市通信管理局宣布决定开展“铸盾模都”2025年人工智能安全赋能专项行动。专项行动重点对象为在上海市电信和互联网行业中提供人工智能服务的企业，包括自研和开发人工智能技术的企业、使用人工智能技术对外提供服务的企业，上海市基础电信企业等，旨在提升上海市电信和互联网行业人工智能网络和数据安全基线，推动人工智能技术和应用向有益、安全、公平方向高质量发展。专项行动要求企业结合业务实际梳理人工智能业务清单，并在11月30日前将年度人工智能业务清单上报市通管局。

【参见：

https://shca.miit.gov.cn/zwgk/zcwj/wjfb/art/2025/art_4540ed600faa4ae5bbc9280ec5b30c2c.html?sessionid=1263558525】

Shanghai Communication Administration launched 2025 Artificial Intelligence Security Empowerment Special Action

On July 25, the Shanghai Communication Administration announced its decision to launch the “Cast Shield Shanghai City”(铸盾模都) 2025 Artificial Intelligence Security Empowerment Special Action. The special action focus on enterprises in the telecommunications and internet industries in Shanghai that provide artificial intelligence services, including enterprises that independently research and develop artificial intelligence technologies, enterprises that use artificial intelligence technologies to provide services to external parties, and basic telecommunications enterprises in Shanghai. The aim is to enhance the baseline level of artificial intelligence cyber and data security in the telecommunications and internet industries in Shanghai and promote the high-quality development of artificial intelligence technologies and applications in a beneficial, secure, and fair direction. The action requires companies to compile a list of AI-related business operations based on their actual operations and submit the annual AI business list to the Shanghai Communication Administration Bureau by November 30.

[Reference:

https://shca.miit.gov.cn/zwgk/zcwj/wjfb/art/2025/art_4540ed600faa4ae5bbc9280ec5b30c2c.html?sessionid=1263558525]

4. 北京市纵深推进违法违规收集使用个人信息专项治理

7月25日，北京网信办发布资讯称北京市正在纵深推进违法违规收集使用个人信息专项治理。本次专项治理聚焦公共场所收集使用人脸识别信息活动和线下消费场景中收集使用个人信息活动，治理范围主要涉及以下行业领域：交通运输（汽车站、停车场等）、住宿旅游（酒店、景区、住宅区、售楼处等）、教育培训（学校、线下教育培训机构、图书馆等）、文化体育（公共体育场馆、博物馆、美术馆等）、物流商贸（商场、超市、快递柜等）、休闲娱乐（演出场所、公园、电影院等）、自动售卖、出行乘车（公交、地铁、网约车、共享车）、商超支付、住宅区物业管理、快递寄送等。目前，各行业主管部门已全面组织本行业领域各企事业单位开展底数摸排与自查整改。后续，各行业主管部门以及市区两级网信部门将对自查整改情况进行抽查核验。对于问题严重或整改不力的，将依法依规开展处置。

【参见：

https://mp.weixin.qq.com/s/6cHCNcRaqJ-73950GOZZ1Q】

Beijing deepens special campaign against illegal collection and use of personal information

On July 25, the Beijing Cyberspace Administration announced that Beijing is deepening its special campaign against illegal collection and use of personal information. This special campaign focuses on activities involving the collection and use of facial recognition information in public places and the collection and use of personal information in offline consumption scenarios. The scope of the campaign primarily covers the following industries and fields: transportation (bus stations, parking lots, etc.), accommodation and tourism (hotels, scenic spots, residential areas, real estate sales offices, etc.), education and training (schools, offline education and training institutions, libraries, etc.), culture and sports (public sports venues, museums, art galleries, etc.),logistics and commerce (shopping malls, supermarkets, parcel lockers, etc.), leisure and entertainment (performance venues, parks, cinemas, etc.), vending machines, transportation (public buses, subways, ride-hailing services, shared vehicles), supermarket payments, residential property management, and parcel delivery. Currently, the competent authorities of each industry have fully organized enterprises and institutions within their respective sectors to conduct a comprehensive inventory and self-inspection and rectification. Going forward, the relevant industry authorities and the municipal and district-level cyberspace administration departments will conduct spot checks and verification of the self-inspection and rectification efforts. For serious issues or inadequate rectification, measures will be taken in accordance with the law.

[Reference:

https://mp.weixin.qq.com/s/6cHCNcRaqJ-73950GOZZ1Q]

5. 上海市通信管理局通报下架23款侵害用户权益行为的应用

7月24日，上海市通信管理局通报下架23款侵害用户权益行行为的应用。上海市通信管理局将移动互联网应用软件用户个人信息保护专项整治作为全年的重点工作，全面深化落实移动互联网应用软件侵害用户权益的专项整治行动。2025年6月，上海市通信管理局向社会公示了一批共50款存在侵害用户权益行为的应用。在规定的整改期限内，经核查复检，尚有23款应用未按照要求落实整改。上海市通信管理局已对上述应用在全国范围内主流应用市场进行下架处理。上海市通信管理局将对上述应用持续跟踪，视情况进一步采取停止接入、行政处罚、纳入电信业务经营不良名单等后续处理措施。

【参见：

https://mp.weixin.qq.com/s/OXf5wjwdj5HRVp-g72MnyQ】

Shanghai Communication Administration announced removal of 23 apps that infringe on user rights

On July 24, the Shanghai Communication Administration announced the removal of 23 applications engaging in activities that infringe upon user rights. The Shanghai Communication Administration has designated the special rectification of personal information protection for mobile internet application software users as a key task for the year, and is comprehensively deepening and implementing the special rectification campaign targeting mobile internet application software that infringes upon user rights. In June 2025, the Shanghai Communication Administration publicly announced a list of 50 applications that were found to infringe upon user rights. After the specified rectification period, upon re-inspection, 23 applications were found to have failed to implement the required rectifications. The Shanghai Communication Administration has removed the aforementioned applications from mainstream application markets nationwide. The Shanghai Communication Administration will continue to monitor the aforementioned applications and, depending on the situation, take further measures such as suspending access, imposing administrative penalties, or including them in the list of telecommunications business operators with poor records.

[Reference:

https://mp.weixin.qq.com/s/OXf5wjwdj5HRVp-g72MnyQ]

6. 公安部通报33款违法违规收集使用个人信息的移动应用

7月23日，公安部计算机信息系统安全产品质量监督检验中心检测发现33款移动应用存在违法违规收集使用个人信息情况，并进行了通报。这些移动应用涉及的问题有：未公开收集使用规则；未逐一列出收集、使用个人信息的目的、方式、范围；在申请打开可收集个人信息的权限时，未同步告知用户其目的；在申请收集用户等个人敏感信息时，未同步告知用户其目的；征得用户同意前就开始收集个人信息；实际收集的个人信息超出用户授权范围；配置文件中声明的可收集个人信息的权限超出相关功能的必要范围；实际收集的个人信息超出相关功能的必要范围；实际收集个人信息的频率超出相关功能的必要范围；提前要求用户打开非当前功能所需的可收集个人信息权限；强制要求用户打开非必要的可收集个人信息权限；强制要求用户提供非必要的个人信息；广告存在误导、欺骗用户行为。

【参见：

https://mp.weixin.qq.com/s/g2UykawpjL5hnbSjUEEREw】
 

The MPS announced 33 mobile applications that illegally collect and use personal information

On July 23, MPS Quality Supervision and testing Center of Security Products for Computer Information Systems detected 33 mobile applications that illegally collected and used personal information and issued a notice. The issues of these mobile applications include: failure to disclose rules for collecting and using personal information; failure to list the purpose, method, and scope of collecting and using personal information one by one; failing to simultaneously inform users of the purpose when requesting permission to access personal information; failing to simultaneously inform users of the purpose when requesting collection of sensitive personal information such as user information; beginning to collect personal information before obtaining user consent; collecting personal information beyond the scope authorized by users; declaring permissions for collecting personal information in configuration files that exceed the necessary scope for related functions; collecting personal information beyond the necessary scope for related functions; the frequency of actual collection of personal information exceeds the necessary scope of the relevant functions; requiring users to enable permissions for collecting personal information that are not necessary for the current function in advance; forcing users to enable permissions for collecting personal information that are not necessary; forcing users to provide personal information that is not necessary; advertisements contain misleading or deceptive behavior toward users.

[Reference:

https://mp.weixin.qq.com/s/g2UykawpjL5hnbSjUEEREw]

7. 全国网安标委发布网络安全标准实践指南《扫码点餐个人信息保护要求（征求意见稿）》与《摇一摇广告触发行为安全要求》

7月22日，全国网络安全标准化技术委员会发布《网络安全标准实践指南——扫码点餐个人信息保护要求（征求意见稿）》与《网络安全标准实践指南——摇一摇广告触发行为安全要求》。其中，前者旨在指导餐饮商家规范扫码点餐服务个人信息处理活动，减少因扫码点餐造成的个人权益损害问题，并就扫码点餐小程序的开发者、运营者及各方主体的个人信息安全责任作出了要求，同时列举了扫码点餐服务的必要个人信息范围。后者规定了移动智能终端摇一摇广告个人权益保障的基本原则和触发行为安全要求，适用于规范摇一摇广告的展示和触发行为，也可为移动智能终端、App、第三方SDK等个人信息处理者或评估机构提供参考。

【参见：

https://www.tc260.org.cn/front/hydtList.html?start=0&length=10&postType=2】

The TC260 released the cybersecurity standard practice guidelines “Requirements for the Protection of Personal Information in QR Code-Based Ordering” (Draft for Comment) （《扫码点餐个人信息保护要求（征求意见稿）》）and “Security Requirements for Shake-to-Activate Advertising.”（《摇一摇广告触发行为安全要求》）

On July 22, the TC260 released the “Cybersecurity Standard Practice Guidelines — Requirements for the Protection of Personal Information in QR Code-Based Ordering” (Draft for Comment) （《网络安全标准实践指南——扫码点餐个人信息保护要求（征求意见稿）》）and the “Cybersecurity Standard Practice Guidelines — Security Requirements for Shake-to-Activate Advertising.” （《网络安全标准实践指南——摇一摇广告触发行为安全要求》）The first guideline aims to guide catering businesses in standardizing the processing of personal information during QR code scanning and ordering services, reduce personal rights infringements caused by QR code scanning and ordering, and stipulate the personal information security responsibilities of developers, operators, and other parties involved in QR code scanning and ordering mini-programs, while also listing the necessary scope of personal information for QR code scanning and ordering services. The second guideline establishes the basic principles and safety requirements for personal rights protection related to “shake-to-advertise” on mobile intelligent terminals, applicable to regulating the display and triggering behavior of such advertisements. It may also serve as a reference for personal information processors or assessment institutions such as mobile intelligent terminals, apps, and third-party SDKs.

[Reference:

https://www.tc260.org.cn/front/hydtList.html?start=0&length=10&postType=2]

1. 欧盟发布《通用人工智能模型训练内容公共摘要说明与模版》

7月24日，欧盟委员会发布《通用人工智能模型训练内容公共摘要说明与模版》（Explanatory Notice and Template for the Public Summary of Training Content for General-Purpose AI Models）帮助人工智能模型提供商总结其训练模型的内容，以落实《人工智能法案》（AI Act）第53条第1款第（d）项对训练数据透明度的要求。该模板为通用人工智能模型提供商提供了一种简单、统一和有效的方式去增强透明度以确保符合《人工智能法案》。

【参见：

https://digital-strategy.ec.europa.eu/en/library/explanatory-notice-and-template-public-summary-training-content-general-purpose-ai-models】

The European Union published the “Explanatory Notice and Template for the Public Summary of Training Content for general-purpose AI models”

On July 24, the European Commission published the “Explanatory Notice and Template for the Public Summary of Training Content for General-Purpose AI Models” to assist artificial intelligence model providers in summarizing the content of their training models, thereby complying with the requirement for transparency of training data under Article 53(1)(d) of the AI Act. This template provides general-purpose AI providers with a simple, unified, and effective way to enhance transparency and ensure compliance with the AI Act.

[Reference:

https://digital-strategy.ec.europa.eu/en/library/explanatory-notice-and-template-public-summary-training-content-general-purpose-ai-models]

2. 美国发布《人工智能行动计划》

7月23日，美国政府发布《赢得竞赛：美国人工智能行动计划》（Winning the Race: America’s AI Action Plan）。该计划有三大支柱，分别为加快AI创新、建设美国AI基础设施、在国际AI外交和安全中发挥领导作用。同时，计划提出了以下人工智能发展原则，第一，美国工人是特朗普政府人工智能政策的核心；第二，人工智能系统必须摆脱意识形态偏见，在用户寻求事实信息或分析时，旨在追求客观真理，而非社会工程议程；第三，必须防止美国的先进技术被恶意行为者滥用或窃取，并监测人工智能带来的新兴和不可预见的风险。此外，计划提出了包括消除苛刻监管、加速政府部门AI应用、简化数据中心、半导体制造设施和能源基础设施的审批流程、加强关键基础设施网络安全、在国际治理机构中对抗中国影响力等数十项政策建议，。

【点击查看《计划》全文：

https://whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf】

The US released America’s AI Action Plan

On July 23, the US government released Winning the Race: America’s AI Action Plan. The plan has three pillars: Accelerate AI Innovation, Build US AI Infrastructure, and Lead in international AI Diplomacy and Security. Additionally, the plan outlines the following principles for AI development: First, American workers are central to the Trump Administration’s AI policy. Second,AI systems must be free from ideological bias and be designed to pursue objective truth rather than social engineering agendas when users seek factual information or analysis. Third, America must prevent their advanced technologies from being misused or stolen by malicious actors and monitor emerging and unforeseen risks posed by AI. Additionally, the plan outlines dozens of policy recommendations, such as eliminating onerous regulations, accelerating AI adoption across government agencies, streamlining approval processes for data centers, semiconductor manufacturing facilities, and energy infrastructure, strengthening cybersecurity for critical infrastructure networks, and countering Chinese influence in international governance institutions.

[Click here to view the full plan:

https://whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf]

3. 法国CNIL发布人工智能系统开发过程中的GDPR合规建议

7月22日，法国CNIL发布实践指南《人工智能系统开发：CNIL关于遵守GDPR的建议》。指南适用于开发过程中涉及个人数据处理的人工智能系统，提出了十一个合规步骤，包括：（1）为人工智能系统设定明确目的；（2）明确开发者的GDPR法律角色；（3）确定处理个人数据的合法性基础；同时，还应针对数据抓取实施保障措施，（4）核查是否可重复使用已有的个人数据；（5）最小化使用个人数据；（6）设定数据储存期限；（7）履行告知义务；（8）保障数据主体权利；（9）保障人工智能系统安全；（10）分析人工智能模型受GDPR约束的状态；（11）在标注阶段遵守GDPR原则；最后，重点还需要进行数据保护影响评估。

【参见：

https://www.cnil.fr/fr/developpement-des-systemes-dia-les-recommandations-de-la-cnil-pour-respecter-le-rgpd】

French CNIL issued GDPR compliance recommendations for the development of AI systems

On July 22, the French CNIL published a practical guide titled “Development of AI Systems: CNIL Recommendations for Compliance with the GDPR.” The guide applies to AI systems that involve the processing of personal data during the development process and sets out eleven compliance steps, including: (1) Setting clear objectives for the AI system; (2) Clarifying the GDPR legal role of the developer;(3) Determining the legal basis for processing personal data; additionally, safeguards must be implemented for data scraping; (4) Verifying whether existing personal data can be reused; (5) Minimizing the use of personal data; (6) Setting data retention periods; (7) Fulfilling the obligation to inform; (8) Ensuring data subject rights;(9) Ensuring the security of AI systems; (10) Analyzing the status of AI models subject to GDPR constraints; (11) Complying with GDPR principles during the labeling stage; Finally, it is also important to conduct a data protection impact assessment.

[Reference:

https://www.cnil.fr/fr/developpement-des-systemes-dia-les-recommandations-de-la-cnil-pour-respecter-le-rgpd]