每周数据法律资讯 Data Law Weekly（20250901—20250907）

1. 中国互联网金融协会发布《关于进一步加强金融领域App自律检查的通知》

9月5日，中国互联网金融协会发布《关于进一步加强金融领域App自律检查的通知》。《通知》称，为持续提升金融领域App自律管理工作水平，切实防范相关风险，中国互联网金融协会决定进一步加强金融领域App自律检查工作。检查对象为直接开展金融业务的App和为金融业务提供相关服务的App，重点检查发生安全事件、引发严重舆情、投诉高企、应备案未备案、不遵守自律管理相关要求等情况的App。检查内容包括两部分，一是App网络防护措施不到位、数据安全管理制度不完善、违规使用个人信息等问题；二是App安全管理薄弱、涉嫌违法违规开展业务和不遵守自律管理相关要求等问题。

【参见：

https://mp.weixin.qq.com/s/pRcHbhC9mdJFLsrHc3kTDA】

China Internet Finance Association issued Notice on Further Strengthening Self-Regulatory Inspections of Financial Apps

On September 5, the China Internet Finance Association released the Notice on Further Strengthening Self-Regulatory Inspections of Financial Apps. The Notice states that to continuously enhance the self-regulatory management of financial apps and effectively prevent related risks, the Association has decided to intensify self-regulatory inspections in the financial sector. The inspection targets apps that directly conduct financial business and those providing related services to financial operations. The focus will be on apps that have experienced security incidents, triggered severe public opinion backlash, received high complaint volumes, failed to complete required filings, or violated self-regulatory management requirements. The inspection covers two key areas: first, issues such as inadequate network protection measures, incomplete data security management systems, and improper use of personal information; second, problems including weak security management, suspected illegal or non-compliant business operations, and failure to adhere to self-regulatory management requirements.

[Reference:

https://mp.weixin.qq.com/s/pRcHbhC9mdJFLsrHc3kTDA]

2. 某企业某因存在数据异常跨境传输问题被网信部门约谈处罚

9月4日，由贵阳市互联网信息办公室指导，云岩区互联网信息办公室开展网络执法工作，针对辖区内某企业因存在数据异常跨境传输的问题进行执法约谈。该企业未严格遵守国家关于数据跨境传输的安全管理规定，履行必要的安全评估与合规审查义务不到位，网络安全教育不深不细，相关人员安全意识不足，在接入公网IP的设备使用中，开启同步“云数据”存储功能，导致数据传输过程存在安全隐患。此外，该企业网络设备日志存储时间不足6个月，存在履行网络安全责任不到位的情形。网信部门对该企业作出行政警告处罚，并责令整改。

【参见：

https://mp.weixin.qq.com/s/WYPkQdKH6RiqoOFb-6EVrQ?scene=1&click_id=12】

A company was summoned and penalized by the Cyberspace Administration for cross-border data transmission anomalies

On September 4, under the guidance of the Guiyang Cyberspace Administration Office, the Yunyan District Cyberspace Administration Office conducted an enforcement interview with a local company regarding cross-border data transmission anomalies. The company failed to strictly comply with national regulations on cross-border data transmission security management. It inadequately fulfilled necessary security assessment and compliance review obligations, provided insufficient cybersecurity education, and demonstrated insufficient security awareness among relevant personnel. By enabling synchronous “cloud data” storage functions on devices connected to public IP networks, the company created security risks in data transmission processes. Additionally, the company's network equipment logs were retained for less than six months, indicating inadequate fulfillment of cybersecurity responsibilities. The Cyberspace Administration issued an administrative warning to the company and ordered corrective measures.

[Reference:

https://mp.weixin.qq.com/s/WYPkQdKH6RiqoOFb-6EVrQ?scene=1&click_id=12]

3.《人工智能生成合成内容标识办法》正式施行

9月1日，由国家网信办、工信部、公安部、国家广电总局联合发布的部门规章《人工智能生成合成内容标识办法》正式施行。根据《标识办法》，人工智能生成合成服务提供者，应当按照要求对生成合成内容添加显式标识及隐式标识。用户使用网络信息内容传播服务发布生成合成内容的，应当主动声明并使用服务提供者提供的标识功能进行标识。

【《办法》全文参见：

https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm】

【关于AIGC标识实操中的几点问题解读，可点击以下链接查阅：

https://mp.weixin.qq.com/s/OwbIqnfrxK-QJtqxT4vT7Q】

“Measures for Labeling AI-Generated and Synthetic Content”（《人工智能生成合成内容标识办法》）officially enforced

On September 1, the “Measures for Labeling AI-Generated and Synthetic Content”《人工智能生成合成内容标识办法》）—jointly issued by the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the National Radio and Television Administration—officially took effect. According to the Measures, providers of AI-generated and synthetic content services must add explicit and implicit labels to such content as required. Users publishing generated or synthesized content via online information dissemination services must proactively declare such content and utilize the labeling functions provided by service providers.

[Full text of the Measures available at:

https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm]

[For an interpretation of several issues regarding the practical implementation of AIGC labeling, please click the link below:

https://mp.weixin.qq.com/s/OwbIqnfrxK-QJtqxT4vT7Q]

4. 数据安全技术国家标准《个人信息跨境处理活动安全认证要求》与《数据安全和个人信息保护社会责任指南》获批发布

近日，由全国网络安全标准化技术委员会归口的2项数据安全国家标准正式发布，分别为：GB/T 46068-2025《数据安全技术个人信息跨境处理活动安全认证要求》与GB/T 46071-2025《数据安全技术数据安全和个人信息保护社会责任指南》。两项国家标准将在发布后20个工作日内公开，并将于2026年3月1日起正式实施。

【参见：

https://mp.weixin.qq.com/s/VJ53sO9OBmlzPi74eqPN4A】

National standards for data security technology: “Security Certification Requirements for Cross-border Processing of Personal Information”（《个人信息跨境处理活动安全认证要求》） and “Guideline for Social Responsibility of Data Security and Personal Information Protection”（《数据安全和个人信息保护社会责任指南》）have been approved for release

Recently, two national standards for data security, administered by the National Technical Committee 260 on Cybersecurity of Standardization Administration of China, were officially released: GB/T 46068-2025 “Data Security Technology - Security Certification Requirements for Cross-border Processing of Personal Information” （《数据安全技术个人信息跨境处理活动安全认证要求》） and GB/T 46071-2025 “Data Security Technology - Guideline for Social Responsibility of Data Security and Personal Information Protection” （《数据安全技术数据安全和个人信息保护社会责任指南》. Both national standards will be publicly available within 20 working days after release and will take effect on March 1, 2026.

[Reference:

https://mp.weixin.qq.com/s/VJ53sO9OBmlzPi74eqPN4A]

1. 欧盟法院CJEU重新界定“假名化数据”（Pseudonymized Data）的性质

9月4日，欧盟法院CJEU对EDPS诉SRB上诉案（C‑413/23 P）作出裁决。该案对假名化数据的性质进行了论证。判决认为，个人数据必须与“已识别或可识别”（“identified or identifiable”）的自然人“相关”（“related”），“假名化数据”是否个人数据应从相关性与可识别性两方面来判断。在相关性上，该判决认为，观点或意见（opinions or views）具有特殊性，其作为自然人的思想表达，天然与自然人“相关”。在可识别性上，该判决认为，可识别性取决于具体场景与主体。从数据接收方视角来判断，如果假名化措施可有效地阻止其识别数据主体，则假名化数据不构成个人数据。然而，对于数据控制者而言，由于数据控制者保留了附加信息，其能够将该数据与具体个人重新关联，因此属于个人数据。同时，数据控制者在收集数据时的透明度义务也不因后续数据假名化或接收方不可识别数据而减轻，其应当告知数据主体向数据接收方提供数据的情况。

【点击查看判决原文：

https://curia.europa.eu/juris/document/document.jsf;jsessionid=4D47F6C1B798B5C8E0D285C8789374E7?text=&docid=303863&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=18219470】

The CJEU redefined the nature of “Pseudonymized Data”

On September 4, theCourt of Justice of the European Union (CJEU) delivered its judgment in the EDPS v SRB appeal case (C‑413/23 P). This case examined the nature of pseudonymized data. The judgment held that personal data must “related” to an “identified or identifiable” natural person. Whether “pseudonymized data” constitutes personal data should be determined based on both “related” and “identified or identifiable”. Regarding “related”, the judgment held that opinions or views possess a particular nature as expressions of a person’s thinking, inherently “related” to that natural person. Concerning “identified or identifiable”, the judgment determined that it depends on the specific context and subject. From the perspective of the recipient pseudonymized data does not constitute personal data if the pseudonymization effectively prevents the recipient from identifying the data subject. However, for the data controller, since the controller retains additional information enabling re-identification of specific individuals, the data remains personal data. Furthermore, the controller’s transparency obligations during data collection are not diminished by subsequent pseudonymization or the recipient’s inability to identify the data. The controller must inform the data subject about the provision of data to the recipient.

[Click to view the original judgment:

https://curia.europa.eu/juris/document/document.jsf;jsessionid=4D47F6C1B798B5C8E0D285C8789374E7?text=&docid=303863&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=18219470]

2. 谷歌、希音因违规处理用户“Cookies”问题被法国CNIL处以上亿欧元罚款

9月3日，法国国家信息与自由委员会（CNIL）宣布对谷歌、希音分别处以3.25亿欧元和1.5亿欧元罚款，理由为这两家公司未遵守Cookies追踪规则。CNIL认为，谷歌存在在未经用户同意的情况下，在Gmail邮件界面中违规展示广告并使用Cookies进行追踪等问题；希音存在擅自在用户设备中存储追踪文件，未能尊重用户意愿及履行充分告知义务等问题。

【参见：

https://cnil.fr/fr/regulation-des-cookies-la-cnil-poursuit-le-plan-daction-initie-en-2019-et-prononce-deux-amendes】

Google and Shein were fined over 100 Millions of Euro by CNIL for improper handling of cookies

On September 3, France’s National Commission on Informatics and Liberties (CNIL) announced fines of €325 million and €150 million against Google and Shein respectively, citing violations of cookie tracking regulations. CNIL determined that Google displayed ads within Gmail interfaces and employed cookies for tracking without user consent. Shein was found to have improperly stored tracking files on user devices, disregarded user preferences, and failed to provide adequate information.

[Reference:

https://cnil.fr/fr/regulation-des-cookies-la-cnil-poursuit-le-plan-daction-initie-en-2019-et-prononce-deux-amendes]

3. 迪士尼公司将支付1000万美元以和解非法收集儿童数据的指控

9月2日，美国联邦贸易委员会宣布，迪士尼将支付1000万美元以和解美国联邦贸易委员会的指控。该机构称该公司违反了《儿童在线隐私保护法》（COPPA），未能正确将部分上传至 YouTube的视频标记为“面向儿童”。这种错误标记使得迪士尼能够通过 YouTube 收集观看儿童导向视频的13岁以下儿童的个人数据，并将这些数据用于针对儿童的定向广告。错误标记还使儿童接触到不适合其年龄的YouTube功能。COPPA 规则要求针对 13 岁以下儿童的网站、应用程序和其他在线服务告知父母他们收集哪些个人信息，并在收集此类信息之前获得可验证的父母同意。

【参见：

https://www.ftc.gov/news-events/news/press-releases/2025/09/disney-pay-10-million-settle-ftc-allegations-company-enabled-unlawful-collection-childrens-personal】

The Walt Disney Company will pay $10 million to settle allegations of illegally collecting children's data

On September 2, the U.S. Federal Trade Commission announced that Disney will pay $10 million to settle FTC allegations. The agency stated the company violated the Children's Online Privacy Protection Act (COPPA) by failing to properly label certain videos uploaded to YouTube as “Made for Kids.”This mislabeling enabled Disney to collect personal data from children under 13 watching child-directed videos via YouTube and use that data for targeted advertising aimed at children. The mislabeling also exposed children to YouTube features unsuitable for their age. COPPA rules require websites, apps, and other online services targeting children under 13 to inform parents about what personal information is collected and obtain verifiable parental consent before gathering such data.

[Reference:

https://www.ftc.gov/news-events/news/press-releases/2025/09/disney-pay-10-million-settle-ftc-allegations-company-enabled-unlawful-collection-childrens-personal]