每周数据法律资讯 Data Law Weekly（20250804-20250810）

1. 工信部发布行政执法事项清单（2025年版）

8月8日，工业和信息化部发布《工业和信息化部行政执法事项清单（2025年版）》。清单涉及工信部管辖的行政许可、行政检查、行政处罚、行政强制、行政征收等268项行政执法事项。其中，多项涉及网络安全、数据安全与个人信息保护的行政执法事宜。

【参见：

https://www.miit.gov.cn/jgsj/zfs/gzdt/art/2025/art_afda8b3ec9104d26addb7f1742f8ae10.html】

MIIT issued List of Administrative Enforcement Matters (2025 Edition)

On August 8, the MIIT issued the “List of Administrative Enforcement Matters of the MIIT (2025 Edition).” (《工业和信息化部行政执法事项清单（2025年版）》) The list covers 268 administrative enforcement matters under the jurisdiction of the MIIT, including administrative licensing, administrative inspections, administrative penalties, administrative coercion, and administrative levies. Among them, large amount of items pertain to administrative enforcement matters related to cybersecurity, data security, and personal information protection.

[Reference:

https://www.miit.gov.cn/jgsj/zfs/gzdt/art/2025/art_afda8b3ec9104d26addb7f1742f8ae10.html]

2. 上海通管局通报145款存在侵害用户权益行为的APP（SDK）

8月5日，上海市通信管理局发布《关于侵害用户权益行为APP的通报（2025年第六批）》, 共涉及145款APP（SDK）。这些APP（SDK）所涉问题有：未明示个人信息处理规则；违规收集个人信息；超范围收集个人信息；未建立已收集个人信息清单；账号注销难；未合理申请使用权限、过度申请权限；APP自启动和关联启动；APP强制、频繁、过度索取权限；未提供投诉渠道；未及时响应用户投诉；未妥善处理用户投诉；未成年人身份验证；应用名称变更备案未更新；跨境传输未明确安全措施；强制用户使用定向推送功能等。

【参见：

https://mp.weixin.qq.com/s/UsNF45FRAPt9ape5Zv8D4A】

Shanghai Communications Administration issued notice on 145 Apps (SDKs) found to infringe upon user rights

On August 5, the Shanghai Communications Administration issued the “Notice on Apps Violating User Rights (2025 Sixth Batch),” which involved a total of 145 Apps (SDKs). The issues identified in these Apps (SDKs) include: failure to clearly disclose personal information processing rules, illegal collection of personal information, collection of personal information beyond the scope of necessity, failure to establish a list of collected personal information, difficulties in account deletion, failure to reasonably request permission to use personal information, excessive requests for permissions, app self-startup and associated startup, forced, frequent, or excessive requests for permissions, failure to provide complaint channels, failure to promptly respond to user complaints, failure to properly handle user complaints, verification of minors’ identities, failure to update application name changes, failure to clearly specify security measures for cross-border data transmission, and forcing users to use targeted push features.

[Reference:

https://mp.weixin.qq.com/s/UsNF45FRAPt9ape5Zv8D4A]

3. 中国人民银行、国家金融监管总局、中国证监会联合发布《金融机构客户尽职调查和客户身份资料及交易记录保存管理办法（征求意见稿）》

8月4日，中国人民银行、国家金融监督管理总局、中国证券监督管理委员会联合发布《金融机构客户尽职调查和客户身份资料及交易记录保存管理办法（征求意见稿）》。《管理办法》旨在预防和遏制洗钱和恐怖融资活动，规范金融机构客户尽职调查、客户身份资料及交易记录保存行为，维护国家安全和金融秩序。《管理办法》规定，金融机构应当采取必要的管理措施和技术措施，逐步实现以电子化方式完整、准确保存客户身份资料及交易信息，依法保护商业秘密和个人信息，防止客户身份资料及交易记录缺失、损毁，防止泄漏客户身份资料及交易信息。同时规定，客户身份资料与交易记录应自业务关系结束后或交易结束后至少保存10年。

【点击查看全文：

http://www.pbc.gov.cn/tiaofasi/144941/144979/3941920/5799318/2025080416572969830.pdf】

The PBC, the NRFA, and the CSRC jointly issued the “Measures for the Administration of Customer Due Diligence, Customer Identity Documentation, and Transaction Record Keeping by Financial Institutions (Draft for Public Comment)”《金融机构客户尽职调查和客户身份资料及交易记录保存管理办法》

On August 4, the People’s Bank of China (PBC), the National Financial Regulatory Administration (NFRA), and the China Securities Regulatory Commission (CSRC) jointly issued the “Measures for the Administration of Customer Due Diligence, Customer Identity Documentation, and Transaction Record Keeping by Financial Institutions (Draft for Public Comment).”（《金融机构客户尽职调查和客户身份资料及交易记录保存管理办法》）The Measures aim to prevent and combat money laundering and terrorist financing activities, standardize the customer due diligence, customer identity documentation, and transaction record keeping practices of financial institutions, and safeguard national security and financial order. The Measures stipulate that financial institutions shall adopt necessary management measures and technical measures to gradually achieve the complete and accurate electronic storage of customer identity information and transaction information, protect commercial secrets and personal information in accordance with the law, prevent the loss or damage of customer identity information and transaction records, and prevent the leakage of customer identity information and transaction information. At the same time, it is stipulated that customer identity information and transaction records shall be retained for at least 10 years after the termination of the business relationship or the completion of the transaction.

[Click to view the full text:

http://www.pbc.gov.cn/tiaofasi/144941/144979/3941920/5799318/2025080416572969830.pdf]

4. 工信部通报23款侵害用户权益行为的APP（SDK）

8月4日，工业化和信息化部通信管理局发布《关于侵害用户权益行为的APP（SDK）通报》（2025年第4批，总第49批），共涉及23款APP（SDK）。这些APP（SDK）所涉问题有：违规收集个人信息；APP强制、频繁、过度索取权限；信息窗口乱跳转；信息窗口无法关闭；SDK公示信息不到位；超范围收集个人信息。

【参见：

https://mp.weixin.qq.com/s/PTRthMAO-mNtL5aoYgmf0A】

MIIT issued notice on 23 Apps (SDKs) violating user rights

On August 4, the Department of Communications of the MIIT released the “Notice on Apps (SDKs) Violating User Rights” (Batch 4 of 2025, Total Batch 49), which involved a total of 23 Apps (SDKs). The issues identified in these Apps (SDKs) include: illegal collection of personal information, forced, frequent, or excessive requests for permissions, random redirection of information windows, inability to close information windows, inadequate disclosure of SDK information, and collection of personal information beyond the scope of authorized permissions.

[Reference:

https://mp.weixin.qq.com/s/PTRthMAO-mNtL5aoYgmf0A]

5. 7项网络安全国家标准获批发布

近日，由全国网络安全标准化技术委员会归口的7项国家标准正式发布。具体清单如下：《网络安全技术公钥基础设施证书管理协议》《网络安全技术公钥基础设施PKI 组件最小互操作规范》《网络安全技术公钥基础设施时间戳规范》《网络安全技术信息安全风险管理指导》《网络安全技术云计算服务安全能力评估方法》《网络安全技术网络安全运维实施指南》《网络安全技术人工智能计算平台安全框架》。

【参见：

https://www.tc260.org.cn/front/postDetail.html?id=20250804155822】

Seven national cybersecurity standards approved for publication

Recently, seven national standards administered by the TC260 were officially released. The specific list is as follows: “Cybersecurity Technology - Public Key Infrastructure - Certificate Management Protocol”（《网络安全技术公钥基础设施证书管理协议》）, “Cybersecurity Technology - Public Key Infrastructure - Minimum Interoperability Specifications for PKI Components”（《网络安全技术公钥基础设施 PKI 组件最小互操作规范》）, “Cybersecurity Technology - Public Key Infrastructure - Timestamp Specifications”（《网络安全技术公钥基础设施时间戳规范》）, “Cybersecurity Technology - Guidelines for Information Security Risk Management”（《网络安全技术信息安全风险管理指导》）, “Cybersecurity Technology - Methods for Assessing the Security Capabilities of Cloud Computing Services”（《网络安全技术云计算服务安全能力评估方法》）, “Cybersecurity Technology - Implementation Guidelines for Cybersecurity Operations and Maintenance”（《网络安全技术网络安全运维实施指南》）, “Cybersecurity Technology - Security Framework for Artificial Intelligence Computing Platforms”（《网络安全技术人工智能计算平台安全框架》）.

[Reference:

https://www.tc260.org.cn/front/postDetail.html?id=20250804155822]

6. 上海发布新一期生成式人工智能服务登记信息公告

8月4日，上海网信办发布《上海市生成式人工智能服务登记信息公告（8月4日）》。公告显示，截至当日，上海市新增1款已完成登记的生成式人工智能服务，累计已完成101款生成式人工智能服务登记。已上线的生成式人工智能应用或功能，应在显著位置或产品详情页面标明所取得的上线编号。

【参见：

https://mp.weixin.qq.com/s/aDe-pUycOD0rUzf12U5pkA】

Shanghai released new round of generative AI service registration information announcement

On August 4, the Shanghai Cyberspace Administration released the “Announcement on the Registration Information of Generative AI Services in Shanghai (August 4).” The announcement shows that as of that day, Shanghai had added one new generative AI service that had completed registration, bringing the total number of generative AI services that had completed registration to 101. Generative AI applications or functions that have been launched should clearly indicate the launch number obtained in a prominent location or on the product details page.

[Reference:

https://mp.weixin.qq.com/s/aDe-pUycOD0rUzf12U5pkA]

7. 国标《智能网联汽车数据安全管理体系规范》公开征求意见

近日，全国汽车标准化技术委员会发布了2项推荐性国家标准的征求意见稿，分别为《智能网联汽车数据安全管理体系规范》、《汽车数字钥匙系统技术规范》。其中，《智能网联汽车数据安全管理体系规范》规定了组织的汽车数据安全管理、相关方汽车数据安全活动管理、汽车数据全生命周期管理、汽车数据安全监测与处置、汽车数据安全工程、汽车数据安全风险评估等要求。

【点击查阅全文：

http://zxd.catarc.org.cn/zxd/portal/detail/zqyj/681】

National Standard “Intelligent Connected Vehicle Data Security Management System Specification”(《智能网联汽车数据安全管理体系规范》) Open for Public Comment

Recently, the National Technical Committee of Auto Standardization released two draft national standards for public comment, namely “Intelligent Connected Vehicle Data Security Management System Specification” (《智能网联汽车数据安全管理体系规范》)  and “Technical Specification for Automotive Digital Key Systems.” (《汽车数字钥匙系统技术规范》) The “Intelligent Connected Vehicle Data Security Management System Specification” specifies requirements for an organization's management of automotive data security, management of automotive data security activities by relevant parties, management of the entire lifecycle of automotive data, monitoring and handling of automotive data security incidents, automotive data security engineering, and automotive data security risk assessment.

[Click here to view the full text:

http://zxd.catarc.org.cn/zxd/portal/detail/zqyj/681]

1. 韩国PIPC发布《生成式人工智能开发与应用个人信息处理指南》

8月6日，韩国个人信息保护委员会（PIPC）发布《生成式人工智能开发与应用个人信息处理指南》，指南旨在帮助企业消除在生成式人工智能开发及应用全周期内适用韩国《个人信息保护法》的不确定性。《指南》重点关注了三个方面：第一，将生成式人工智能的开发与应用生命周期分为四个阶段（目标设定、战略制定、训练与开发、应用与管理），并规定了各阶段需落实的最低安全措施。第二，针对在人工智能训练中能否使用用户个人信息的法律标准等生成式人工智能开发与应用过程中不确定性较高的问题，结合PIPC的政策与执法案例，提出了具体的解决方案。第三，指南反映了与生成式人工智能开发与应用相关的最新技术和研究成果，包括人工智能代理、知识蒸馏、机器反学习等。

【参见：

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=11410#LINK】

South Korea’s PIPC released “Guidelines for the Processing of Personal Information in the Development and Application of Generative Artificial Intelligence”

On August 6, the Personal Information Protection Commission (PIPC) of South Korea released the “Guidelines for the Processing of Personal Information in the Development and Application of Generative Artificial Intelligence.” The guidelines aim to help companies eliminate uncertainties regarding the applicability of the Personal Information Protection Act throughout the entire lifecycle of generative artificial intelligence development and application. The guidelines focus on three key areas: First, they divide the development and application lifecycle of generative AI into four stages (goal setting, strategy formulation, training and development, and application and management), and specify the minimum security measures that must be implemented at each stage. Second, addressing high levels of uncertainty in the development and application of generative AI—such as legal standards for using user personal information in AI training—the guidelines propose specific solutions based on the PIPC’s policies and enforcement cases. Third, the Guidelines reflect the latest technological advancements and research findings related to the development and application of generative AI, including AI agents, knowledge distillation, and machine anti-learning.

[Reference:

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=11410#LINK]

2. 欧盟公布签署《通用人工智能行为准则》的组织清单

8月4日，欧盟委员会公布了当前已经签署《通用人工智能行为准则》的组织清单，包括：谷歌、微软、亚马逊、OpenAI等26家公司。同时，公告强调，一些签名者可能不会立即出现，但会确保在签名得到确认后不断更新名单。《通用人工智能行为准则》是一个自愿工具，旨在帮助行业遵守欧盟《人工智能法》对通用人工智能模型提供商的义务。

【参见：

https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai#ecl-inpage-Signatories-of-the-AI-Pact】

EU published list of organizations that have signed the General-Purpose AI Code of Practice

On August 4, the European Commission published a list of organizations that have currently signed the General-Purpose AI Code of Practice, including 26 companies such as Google, Microsoft, Amazon, and OpenAI. At the same time, the announcement emphasized that some signatories may not appear immediately, but will ensure that the list is continuously updated once their signatures are confirmed. The General-Purpose AI Code of Practice is a voluntary tool developed by independent experts through a multi-stakeholder process, aimed at helping the industry comply with the obligations of the Artificial Intelligence Act for providers of general-purpose artificial intelligence models.

[Reference:

https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai#ecl-inpage-Signatories-of-the-AI-Pact]