每周数据法律资讯 Data Law Weekly（20250915—20250921）

1. 微博、快手因破坏网络生态被网信部门查处

9月20日，国家网信办发布资讯，称针对微博平台未落实信息内容管理主体责任，在热搜榜单主榜高位呈现大量炒作明星个人动态和琐事类词条等不良信息内容，破坏网络生态的问题，以及针对快手平台未落实信息内容管理主体责任，在热搜榜单主榜扎堆呈现炒作明星个人动态和琐事类词条等不良信息内容，存在泛娱乐化倾向问题，国家网信办指导北京市网信办，依据《网络信息内容生态治理规定》等有关规定，对微博平台、快手平台采取约谈、责令限期改正、警告、从严处理责任人等处置处罚措施。

【微博处罚资讯参见：
 

https://mp.weixin.qq.com/s/2cWNgErc9F74lazEE60Aqg

快手处罚资讯参见：
 

https://mp.weixin.qq.com/s/iLAhaUuM6kZeaoNktnNlQQ】

Weibo and KuaiShou were taken allegation by cyberspace authorities for disrupting online ecosystem

On September 20, the CAC released announcement, saying that Weibo platform failed to implement the main responsibility of information content management, and a large number of bad information contents such as hype star personal dynamics and trivial entries were presented at the top of the hot search list, which damaged the online ecosystem, and KuaiShou platform failed to implement the main responsibility of information content management as well, and there was a pan-entertainment tendency to present bad information contents such as hype star personal dynamics and trivial entries on the hot search list. The CAC instructed the Cyberspace Administration of Beijing to take punishment measures such as interviewing, ordering correction within a time limit, warning, and severely handling those responsible for Weibo and KuaiShou platforms in accordance with the Provisions on Ecological Governance of Network Information Content（《网络信息内容生态治理规定》） and other relevant regulations.

[For announcement on Weibo, please refer to:

https://mp.weixin.qq.com/s/2cWNgErc9F74lazEE60Aqg

For announcement on Kuaishou, please refer to:

https://mp.weixin.qq.com/s/iLAhaUuM6kZeaoNktnNlQQ]

2. 公安部公布6起不履行网络安全、数据安全、个人信息保护义务的行政执法典型案例

9月18日，公安部公布“护网—2025”专项工作6起不履行网络安全、数据安全、个人信息保护义务的行政执法典型案例。具体包括，某政务服务系统未采取技术防护措施被网络攻击案、某短信平台未采取技术防护措施被网络攻击案、某学校系统遭攻击导致数据泄露案、某电子商务公司旅客购票信息泄露案、某科技公司APP数据泄露案、某跨国公司不履行个人信息保护义务案。

【参见：

https://www.mps.gov.cn/n2254098/n4904352/c10237071/content.html】

The MPS announced six typical cases of administrative law enforcement that failed to fulfill the obligations of cybersecurity, data security and personal information protection

On September 18, the Ministry of Public Security (MPS) announced six typical cases of administrative law enforcement that failed to fulfill the obligations of network security, data security and personal information protection. Specifically, it includes a case in which a government service system was attacked by a network without taking technical protection measures, a case in which a short message platform was attacked by a network without taking technical protection measures, a case in which a school system was attacked and data was leaked, a case in which information of passengers purchasing tickets of an e-commerce company was leaked, a case in which APP data of a technology company was leaked, and a case in which a multinational company failed to fulfill its personal information protection obligations.

[Reference:

https://www.mps.gov.cn/n2254098/n4904352/c10237071/content.html]

3. 公安部公布10起网络违法犯罪典型案例

9月18日，公安部公布“净网—2025”专项工作10起打击整治网络违法犯罪典型案例。典型案例涉及两起侵犯公民个人信息犯罪案件，分别为甘肃公安机关侦破卢某等人侵犯公民个人信息案（案例五）与四川公安机关侦破张某等人侵犯公民个人信息案（案例六）。案例五中，犯罪嫌疑人卢某等人在老旧小区、学校等区域，利用车载伪基站设备截取周边居民手机号及短信验证码从事网络账号注册贩卖活动。案例六中，犯罪嫌疑人张某等人利用在某保险公司从事线上外包工作的职务之便，非法获取大量客户的公民个人信息，并通过网络兜售获利。

【参见：

https://www.mps.gov.cn/n2254098/n4904352/c10237151/content.html】

The MPS announced 10 typical cases of cyber crimes

On September 18, the MPS announced 10 typical cases from the “Clean Internet-2025” special campaign targeting online crimes. Typical cases involve two crimes of infringing citizens’ personal information, namely, the case of Gansu public security organs detecting Lu Mou and others infringing citizens’ personal information (Case 5) and the case of Sichuan public security organs detecting Zhang Mou and others infringing citizens’ personal information (Case 6). In the Case 5, the criminal suspect Lu and others engaged in online account registration and sales activities by using vehicle-mounted pseudo base station equipment to intercept the mobile phone numbers and SMS verification codes of surrounding residents in old communities, schools and other areas. In the sixth case, the criminal suspect Zhang and others illegally obtained a large number of customers’ personal information by taking advantage of their position of online outsourcing in an insurance company, and peddled profits through the Internet.

[Reference:

https://www.mps.gov.cn/n2254098/n4904352/c10237151/content.html]

4. 工信部通报29款侵害用户权益行为的APP（SDK）

9月18日，工业化和信息化部通信管理局发布《关于侵害用户权益行为的APP（SDK）通报》（2025年第5批，总第50批），共涉及29款APP（SDK）。这些APP（SDK）所涉问题有：违规收集个人信息；APP强制、频繁、过度索取权限；APP频繁自启动和关联启动；强制用户使用定向推送功能。

【参见：

https://mp.weixin.qq.com/s/CCItP6cdGEq05uzR4zQwsA】

MIIT issued notice on 29 Apps (SDKs) violating user rights

On September 18, the Department of Communications of the MIIT released the “Notice on Apps (SDKs) Violating User Rights” (Batch 5 of 2025, Total Batch 50), which involved a total of 23 Apps (SDKs). The issues identified in these Apps (SDKs) include: illegal collection of personal information; forced, frequent, or excessive requests for permissions;APP frequently starts itself and is associated with it; Force users to use the directed push function.

[Reference:

https://mp.weixin.qq.com/s/CCItP6cdGEq05uzR4zQwsA]

5. 国家网信办发布《未成年人用户数量巨大和对未成年人群体具有显著影响的网络平台服务提供者认定办法（征求意见稿）》

9月16日，国家网信办发布《未成年人用户数量巨大和对未成年人群体具有显著影响的网络平台服务提供者认定办法（征求意见稿）》。《办法》第六条规定：符合以下情形之一的，应当认定为未成年人用户数量巨大的网络平台服务提供者：（一）该网络平台提供的产品或者服务专门以未成年人为服务对象，注册用户在1000万以上或者月活跃用户在100万以上。（二）该网络平台提供的产品或者服务的对象不局限于未成年人的，未成年人注册用户数量在1000万以上或者月活跃未成年人用户在100万以上。《办法》第七条规定，认定对未成年人群体具有显著影响的网络平台服务提供者，应当综合考虑以下因素：（一）该网络平台下载量、注册用户数量、月活跃用户数量规模较大，或网络产品的销售额、交易量等较大；（二）该网络平台未成年人登录频次、使用时长、喜爱程度、消费金额等指标较高；（三）该网络平台涵盖大量涉及或面向未成年人的信息内容；（四）该网络平台在3年内存在较多涉未成年人突出情况，违法违规问题较为突出，受到社会广泛关注；（五）该网络平台在相关垂直领域排名靠前；（六）其他对未成年人群体具有显著影响的因素。

【点击查阅办法全文：

https://mp.weixin.qq.com/s/4Qd3MWpPcD-jzOa6j5nQ_A】

【注：《未成年人网络保护条例》第二十条规定：未成年人用户数量巨大或者对未成年人群体具有显著影响的网络平台服务提供者，应当履行下列义务：

（一）在网络平台服务的设计、研发、运营等阶段，充分考虑未成年人身心健康发展特点，定期开展未成年人网络保护影响评估；

（二）提供未成年人模式或者未成年人专区等，便利未成年人获取有益身心健康的平台内产品或者服务；

（三）按照国家规定建立健全未成年人网络保护合规制度体系，成立主要由外部成员组成的独立机构，对未成年人网络保护情况进行监督；

（四）遵循公开、公平、公正的原则，制定专门的平台规则，明确平台内产品或者服务提供者的未成年人网络保护义务，并以显著方式提示未成年人用户依法享有的网络保护权利和遭受网络侵害的救济途径；

（五）对违反法律、行政法规严重侵害未成年人身心健康或者侵犯未成年人其他合法权益的平台内产品或者服务提供者，停止提供服务；

（六）每年发布专门的未成年人网络保护社会责任报告，并接受社会监督。

前款所称的未成年人用户数量巨大或者对未成年人群体具有显著影响的网络平台服务提供者的具体认定办法，由国家网信部门会同有关部门另行制定。】

The CAC released “Measures for the Identification of Network Platform Service Providers with a Huge Number of Minor Users and Significant Influence on Minor Groups (Draft for Comment)”（《未成年人用户数量巨大和对未成年人群体具有显著影响的网络平台服务提供者认定办法（征求意见稿）》）

On September 16, the CAC released “Measures for the Identification of Network Platform Service Providers with a huge number of minor users and significant influence on minor groups (Draft for Comment)”（《未成年人用户数量巨大和对未成年人群体具有显著影响的网络平台服务提供者认定办法（征求意见稿）》）. Article 6 of the Measures stipulates that a network platform service provider shall be identified as having a huge number of minor users if it meets any of the following criteria: (1) The network platform provides products or services specifically targeting minors, with over 10 million registered users or over 1 million monthly active users. (2) Where the network platform’s products or services are not exclusively targeted at minors, the number of registered minor users exceeds 10 million or the number of monthly active minor users exceeds 1 million. Article 7 of the Measures stipulates that the determination of network platform service providers with significant influence on minors shall comprehensively consider the following factors: (1) The network platform has a large scale in terms of download volume, registered user numbers, or monthly active users, or has substantial sales revenue or transaction volume for its network products; (2) The network platform has high metrics such as minor login frequency, usage duration, preference level, or consumption amount; (3) The network platform contains a large volume of information content involving or targeting minors; (4) The platform has experienced numerous prominent incidents involving minors within the past three years, with significant violations of laws and regulations that have attracted widespread public attention; (5) The platform ranks highly in relevant vertical fields; (6) Other factors demonstrating significant influence on minors.

[Click to view the full text of the Measures:

https://mp.weixin.qq.com/s/4Qd3MWpPcD-jzOa6j5nQ_A]

[Note: Article 20 of the Regulations on the Protection of Minors Online stipulates that providers of online platform services with a large number of minor users or significant influence on minors shall fulfill the following obligations:

(1) During the design, development, and operation phases of online platform services, fully consider the characteristics of minors' physical and mental health development and regularly conduct impact assessments on the protection of minors online;

(2) Provide a minor mode or dedicated minor section to facilitate minors' access to platform products or services beneficial to their physical and mental health;

(3) Establish and improve a compliance system for online protection of minors in accordance with national regulations, and set up an independent body primarily composed of external members to supervise the implementation of online protection for minors;

(4) Formulate dedicated platform rules adhering to the principles of openness, fairness, and impartiality, clearly defining the online protection obligations of providers of products or services within the platform. Prominently notify minor users of their legally protected online rights and available remedies for online harm;

(5) Cease providing services to providers of products or services within the platform that violate laws or administrative regulations, seriously harm the physical and mental health of minors, or infringe upon other lawful rights and interests of minors;

(6) Publish an annual social responsibility report on online protection for minors and accept public oversight.

The specific criteria for determining which online platform service providers have a large number of minor users or exert significant influence on the minor population shall be separately formulated by the national cyberspace administration in conjunction with relevant departments.]

6. 全国网安标委发布数据安全、个人信息保护国家标准体系与多项网络安全标准实践指南

9月16日，全国网安标委发布《数据安全国家标准体系（2025版）》《个人信息保护国家标准体系（2025版）》与《网络安全标准实践指南——互联网平台停服数据处理安全要求》《网络安全标准实践指南——扫码点餐个人信息保护要求》《网络安全标准实践指南——学术科技服务平台数据安全要求》。

【点击查看《数据安全国家标准体系（2025版）》：
 

https://www.tc260.org.cn/upload/2025-09-16/1757991172917070462.pdf

点击查看《个人信息保护国家标准体系（2025版）》：
 

https://www.tc260.org.cn/upload/2025-09-16/1757991247699056052.pdf

点击查看《网络安全标准实践指南——互联网平台停服数据处理安全要求》：
 

https://www.tc260.org.cn/upload/2025-09-15/1757944571777024928.pdf

点击查看《网络安全标准实践指南——扫码点餐个人信息保护要求》：
 

https://www.tc260.org.cn/upload/2025-09-15/1757913424949012232.pdf

点击查看《网络安全标准实践指南——学术科技服务平台数据安全要求》：
 

https://www.tc260.org.cn/upload/2025-09-15/1757913640136012491.pdf】

The TC260 issued national standard systems for data security and personal information protection and a number of practical guidelines for cybersecurity standards

On September 16, the TC260 issued “National Standard System for Data Security (2025 Edition)”(《数据安全国家标准体系（2025版）》), “National Standard System for Personal Information Protection (2025 Edition)”(《个人信息保护国家标准体系（2025版）》), “Practice Guide for Cybersecurity Standards —— Security Requirements for Data Processing of Shut Down of Internet Platforms”（《网络安全标准实践指南——互联网平台停服数据处理安全要求》）, “Practice Guide for Cybersecurity Standards —— Personal Information Protection Requirements for Ordering by Scanning Codes”（《网络安全标准实践指南——扫码点餐个人信息保护要求》）, “Practice Guide for Cybersecurity Standards ——— Data Security Requirements for Academic Science and Technology Service Platforms”（《网络安全标准实践指南——扫码点餐个人信息保护要求》）.

[Click to view the National Standard System for Data Security (2025 Edition):

https://www.tc260.org.cn/upload/2025-09-16/1757991172917070462.pdf

Click to view the National Standard System for Personal Information Protection (2025 Edition):

https://www.tc260.org.cn/upload/2025-09-16/1757991247699056052.pdf

Click to view the Practice Guide of Cybersecurity Standards ——— Security Requirements for Data Processing when Internet Platforms Stop Service:

https://www.tc260.org.cn/upload/2025-09-15/1757944571777024928.pdf

Click to view the Practice Guide of Cybersecurity Standards-Personal Information Protection Requirements for Order Scanning:

https://www.tc260.org.cn/upload/2025-09-15/1757913424949012232.pdf

Click to view the Practice Guide of Cybersecurity Standards-Data Security Requirements for Academic Science and Technology Service Platforms:

https://www.tc260.org.cn/upload/2025-09-15/1757913640136012491.pdf]

7. 国家网信办发布近期网络安全、数据安全、个人信息保护相关执法典型案例

9月16日，国家网信办发布了近期网络安全、数据安全、个人信息保护相关执法典型案例。本次发布的执法典型案例共10个，涉及网页篡改、数据泄露、数据被窃取、数据存在泄露安全风险、APP超范围收集个人信息、违法违规收集人脸信息、App提供深度合成服务未按规定进行安全评估等问题。

【参见：

https://mp.weixin.qq.com/s/-EfW7ImfLGJI_ihc970I9A】

The CAC released recent typical law enforcement cases related to cybersecurity, data security and personal information protection

On September 16, the CAC released a recent typical case of law enforcement related to network security, data security and personal information protection. There are 10 typical law enforcement cases released this time, involving webpage tampering, data leakage, data theft, data leakage security risks, personal information collected by App beyond the scope, face information collected by APP in violation of laws and regulations, and deep synthesis service provided by APP failed to conduct security assessment as required.

[Reference:

https://mp.weixin.qq.com/s/-EfW7ImfLGJI_ihc970I9A]

8. 上海通管局通报下架42款侵害用户权益行为的应用

9月16日，上海市通信管理局通报下架42款侵害用户权益行为的应用。通报称，2025年8月，上海通管局向社会公示了一批存在侵害用户权益行为的应用。在规定的整改期限内，经核查复检，尚有42款应用未按照要求落实整改。为严肃处理上述应用的违法违规行为，上海通管局已对上述应用在全国范围内主流应用市场进行下架处理。上海通管局将对上述应用持续跟踪，视情况进一步采取停止接入、行政处罚、纳入电信业务经营不良名单等后续处理措施。

【参见：

https://mp.weixin.qq.com/s/NB0f2yol1qdJYFiura7fxA】

Shanghai Communications Administration announced the removal of 42 apps that infringe on user rights

On September 16, the Shanghai Communications Administration announced the removal of 42 apps that infringe on user rights. The announcement stated that in August 2025, the Shanghai Communications Administration publicly announced a list of apps that infringed on user rights. Within the specified rectification period, after verification and re-inspection, 42 apps still did not implement the required rectification. To strictly address the illegal and non-compliant activities of the aforementioned applications, the Shanghai Communications Administration has removed the aforementioned applications from mainstream application markets nationwide. The Shanghai Communications Administration will continue to monitor the aforementioned applications and may take further measures such as suspending access, imposing administrative penalties, or including them in the list of entities with poor records in telecommunications business operations, depending on the circumstances.

[Reference:

https://mp.weixin.qq.com/s/NB0f2yol1qdJYFiura7fxA]

9. 特斯拉被判向车主提供事故前30分钟完整行车数据

9月16日，北京市大兴区人民法院的一份民事判决书显示，法院判决特斯拉北京公司应向车主提供车辆于2021年2月21日发生交通事故前30分钟的完整行车数据。法院认为，涉案车辆是智能网联汽车，出现交通事故后，不同于以往的传统汽车，在事故成因上仅需考虑车辆硬件的实时性能即可，智能网联汽车在行使过程中产生的行车数据对于事故成因分析愈发重要，行车数据对于消费者而言重要性和客观需求愈发凸显。该案车主名下车辆在2021年2月21日发生交通事故，要求特斯拉提供事故发生前30分钟的行车数据，有助于辅助其全面分析涉案车辆该时段内的整体情况，应当认定为消费者知情权范畴，具有合理性和必要性。

【参见：

https://mp.weixin.qq.com/s/nIbaF_oNO1xPZNPY_zKmOg】

Tesla was sentenced to provide the owner with complete driving data 30 minutes before the accident

On September 16, a civil judgment of Daxing District People’s Court in Beijing showed that the court ruled that Tesla Beijing Company should provide the vehicle owner with complete driving data 30 minutes before the traffic accident on February 21, 2021. The court held that the vehicle involved was an intelligent connected vehicle. After a traffic accident, it was different from the traditional vehicle in the past, which only the real-time performance of the vehicle hardware should be considered in the accident reason. The driving data generated by the intelligent connected vehicle during its exercise became more and more important for the analysis of the cause of the accident, and the importance and objective demand of driving data for consumers became more and more prominent. In this case, a vehicle of the owner was involved in a traffic accident on February 21st, 2021. It is reasonable and necessary to ask Tesla to provide the driving data 30 minutes before the accident, which will help him to comprehensively analyze the overall situation of the vehicles involved in this period. It should be recognized as the category of consumers’ right to know.

[Reference:

https://mp.weixin.qq.com/s/nIbaF_oNO1xPZNPY_zKmOg]

10. 中国网络空间安全协会发布完成个人信息收集使用优化改进App清单的公告（2025年第4批）

9月16日，中国网络空间安全协会发布公告称，协会组织指导学习教育、交通票务、旅游服务、问诊挂号、实用工具、本地生活、网络游戏、网络支付、应用商店、婚恋相亲等10类12款App运营方，对照《中华人民共和国网络安全法》《中华人民共和国个人信息保护法》《常见类型移动互联网应用程序必要个人信息范围规定》等法律法规，重点针对超范围收集个人信息、过度调用敏感权限、权限设置和账号注销不便等个人信息收集使用问题完成了优化改进。12款App运营方已在应用商店或者官网上架优化改进版本，并承诺升级版本持续保持合规水平。

【参见：

https://mp.weixin.qq.com/s/tcUKSjzOWw-yTRbw-yBsYQ】

Announcement by the Cybersecurity Association of China on the completion of the list of Apps optimized for personal information collection and use (Batch 4, 2025)

On September 16, the Cybersecurity Association of China announced that it had organized and guided the operators of 12 apps across 10 categories—including educational learning, transportation ticketing, tourism services, medical consultation and appointment booking, utility tools, local lifestyle services, online gaming, online payments, app stores, and matchmaking—to align with the Cybersecurity Law of the People's Republic of China the Personal Information Protection Law of the People's Republic of China, and the Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications. The improvements primarily address issues such as excessive collection of personal information, overuse of sensitive permissions, inconvenient permission settings, and difficulties in account cancellation. The operators of these 12 apps have released optimized versions on app stores or their official websites and committed to maintaining compliance levels through ongoing updates.

[Reference:

https://mp.weixin.qq.com/s/tcUKSjzOWw-yTRbw-yBsYQ]

11. 国家网信办发布《国家网络安全事件报告管理办法》

9月15日，国家网信办发布《国家网络安全事件报告管理办法》。《管理办法》规定，按照《网络安全事件分级指南》进行研判，若构成较大及以上网络安全事件，一般网络运营者应当及时向属地省级网信部门报告，最迟不得超过4小时。网络运营者未按照办法规定报告网络安全事件的，有关主管部门将按照有关法律、行政法规的规定进行处罚。

【点击查阅办法全文：

https://mp.weixin.qq.com/s/xU48SqBRu9rayWrb2xtLMQ】

The CAC issued “Administrative Measures for Reporting National Cybersecurity Incidents”（《国家网络安全事件报告管理办法》）

On September 15, the Cyberspace Administration of China (CAC) issued the “Administrative Measures for Reporting National Cybersecurity Incidents.”（《国家网络安全事件报告管理办法》） The Measures stipulate that following an assessment based on the “Cybersecurity Incident Classification Guidelines” （《网络安全事件分级指南》）, if an incident constitutes a significant or higher-level cybersecurity incident general network operators must promptly report it to the provincial-level cyberspace administration department within their jurisdiction, with a maximum reporting delay of 4 hours. Network operators failing to report cybersecurity incidents as required by these Measures will be subject to penalties imposed by the competent authorities in accordance with relevant laws and administrative regulations.

[Click to view the full text of the Measures:

https://mp.weixin.qq.com/s/xU48SqBRu9rayWrb2xtLMQ]

12. 某人工智能服务科技有限公司因未履行个人信息保护影响评估义务被公安网安部门行政处罚

9月15日，国家网络安全通报中心发布公告称，公安网安部门在“护网—2025”专项工作中发现，某主营业务为对外提供人工智能模型训练基础数据（算料）的科技有限公司，在处理人脸等生物识别类敏感个人信息前，未按《个人信息保护法》有关规定进行个人信息保护影响评估。属地公安机关依据《个人信息保护法》规定，对该公司依法予以行政处罚，并责令整改。

【参见：

https://mp.weixin.qq.com/s/JS2hSkgt7-xurIY_6skMqg】

An AI service technology company was punished by the public security cybersecurity department for failing to perform the obligation of personal information protection impact assessment

On September 15, the National Cyber Security Notification Center announced that cybersecurity department of the public security bureau found in the special work of “Protecting the Internet-2025” that a technology company whose main business is to provide basic data (calculation) of AI model training failed to conduct personal information protection impact assessment according to the relevant provisions of the PRC Personal Information Protection Law before dealing with sensitive personal information of biometrics such as face. According to the provisions of the PRC Personal Information Protection Law, the local public security organs imposed administrative penalties on the company according to law and ordered it to make rectification.

[Reference:

https://mp.weixin.qq.com/s/JS2hSkgt7-xurIY_6skMqg]

13. 《人工智能安全治理框架》2.0版正式发布

9月15日，在国家网信办的指导下，国家计算机网络应急技术处理协调中心组织专业机构、科研院所、行业企业等持续跟踪人工智能风险变化演进，梳理调整风险分类，研究形成风险分级方法，动态调整更新防范治理措施，制定《人工智能安全治理框架》2.0版，作为网安标委技术文件发布。旨在推动增进人工智能安全治理共识，促进协同共治、普惠共享，为应对人工智能快速发展的新⻛险新挑战，安全有效地释放应用需求，促进人工智能技术和产业发展提供参考指引。

【点击查阅治理框架全文：

https://mp.weixin.qq.com/s/aFGCdWSxHxGdxC9e76wuXw】

Artificial Intelligence Security Governance Framework Version 2.0 (《人工智能安全治理框架》2.0版) officially released

On September 15, under the guidance of the Cyberspace Administration of China, the National Computer Network Emergency Response Technical Team Coordination Center organized professional institutions, research institutes, and industry enterprises to continuously track the evolution of AI risks. They refined risk classifications, developed risk grading methodologies, dynamically adjusted prevention and governance measures, and formulated the Artificial Intelligence Security Governance Framework Version 2.0. This framework was released as a technical document by the Cybersecurity Standardization Committee. This framework aims to foster consensus on AI security governance, promote collaborative and inclusive governance, and provide reference guidance for addressing new risks and challenges arising from rapid AI development. It seeks to safely and effectively unlock application demands while advancing AI technology and industrial growth.

[Click to view the full governance framework:

https://mp.weixin.qq.com/s/aFGCdWSxHxGdxC9e76wuXw]

14. 中美就妥善解决TikTok问题达成基本框架共识

当地时间9月15日，中美经贸会谈中方新闻发布会在西班牙马德里举行。发布会上，中国国家互联网信息办公室副主任王京涛在回答媒体提问时指出，中美双方在充分尊重企业意愿和市场规律的基础上，就通过TikTok美国用户数据和内容安全业务委托运营、算法等知识产权使用权授权等方式解决TikTok问题，达成了基本共识。中国政府将依法审批TikTok所涉及的技术出口、知识产权使用权授权等事宜。

【参见：

https://mp.weixin.qq.com/s/etgGBi1OESZyWLY_XEd0vQ】

China and the U.S. reach basic framework consensus on properly resolving TikTok issue

On September 15 local time, the Chinese side held a press conference on Sino-U.S. economic and trade talks in Madrid, Spain. At the press conference, Wang Jingtao, Deputy Director of the Cyberspace Administration of China, responded to media inquiries by stating that based on full respect for corporate intentions and market principles, both sides have reached a basic consensus on resolving the TikTok issue through measures including entrusting the operation of U.S. user data and content security services, as well as granting intellectual property rights licenses for algorithms. The Chinese government will review and approve matters related to TikTok's technology exports and intellectual property licensing in accordance with the law.

[Reference:

https://mp.weixin.qq.com/s/etgGBi1OESZyWLY_XEd0vQ]

1. 韩国与欧盟的个人信息流转体系构建完成

9月16日，韩国个人信息保护委员会（PIPC）宣布承认欧盟的个人数据保护水平与韩国实质相同，即所谓“同等性认定”。自此，今后韩国境内的企业或公共机构，在将员工或顾客等的个人信息传输至位于欧盟的分公司或其他企业时，无需额外取得数据主体同意等附加条件，即可实现跨境传输。此前，2021年12月，欧盟便已对韩国的个人数据保护水平作出充分性决定(Adequacy Decision)，允许欧盟地区向韩国自由传输个人数据，自此，韩国与欧盟已实现个人信息的双向自由流动。

【参见：
 

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=11507#LINK】

The construction of personal information transfer system between South Korea and EU is completed.

On September 16, South Korea’s Personal Information Protection Committee (PIPC) announced that it recognized that the EU’s personal data protection level is essentially the same as that of South Korea, that is, the so-called “equivalency recognition”. Since then, in the future, enterprises or public institutions in Korea can transmit personal information of employees or customers to branches or other enterprises located in the EU without additional conditions such as obtaining the consent of the data subject. Previously, in December, 2021, the EU made an Adequacy Decision on the level of personal data protection in South Korea, allowing the EU region to freely transmit personal data to South Korea. Since then, South Korea and the European Union have realized the two-way free flow of personal information.

[Reference:

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=11507#LINK]