每周数据法律资讯 Data Law Weekly（20250922—20250928）

1. 中国证券业协会发布《证券公司投资者个人信息保护技术规范》团体标准

9月25日，中国证券业协会发布《证券公司投资者个人信息保护技术规范》团体标准。该团体标准规定了证券公司投资者个人信息的保护要求，包含基本原则、投资者个人信息分类分级、投资者个人信息保护体系、投资者个人信息全生命周期保护要求、特定场景中的投资者个人信息保护、个人信息保护政策模板等。本文件适用于证券公司以及其开展证券、期货、基金等业务的子公司在提供相关产品和服务的过程中开展投资者个人信息保护工作参考使用。

【参见：

https://www.sac.net.cn/tzgg/202509/t20250925_68439.html】

China Securities Association released group standard “Technical Specification on Investors’ Personal Information Protection of Securities Companies”（《证券公司投资者个人信息保护技术规范》）

On September 25, the China Securities Association released the group standard “Technical Specification on Investors’ Personal Information Protection of Securities Companies”（《证券公司投资者个人信息保护技术规范》）. This group standard stipulates requirements for protecting investor personal information by securities firms, covering fundamental principles, classification and grading of investor personal information, investor personal information protection systems, full lifecycle protection requirements for investor personal information, protection of investor personal information in specific scenarios, and templates for personal information protection policies. This document serves as a reference for securities companies and their subsidiaries engaged in securities, futures, fund, and other businesses to protect investor personal information when providing relevant products and services.

[Reference:

https://www.sac.net.cn/tzgg/202509/t20250925_68439.html]

2. 中国网络空间安全协会发布《人工智能服务未成年人伦理规范共识》

9月24日，中国网络空间安全协会发布《人工智能服务未成年人伦理规范共识》。《共识》聚焦人工智能服务未成年人面临的现实挑战，从健康优先、内容保障、隐私守护、规则清晰、透明可信、协同共治、伦理先行等七个方面提出行业规范，倡导人工智能服务提供者在产品设计、内容管理、隐私保护、心理健康引导等方面切实履行社会责任，共同营造安全、健康、可信的数字环境。

【参见：

https://mp.weixin.qq.com/s/PXm7Ma0-b--8hinRLX1P9A】

Cyberspace Security Association of China released “Consensus on Ethical Standards for AI Services Targeting Minors”（《人工智能服务未成年人伦理规范共识》）

On September 24, the Cyberspace Security Association of China released the “Consensus on Ethical Standards for AI Services Targeting Minors”（《人工智能服务未成年人伦理规范共识》）. The Consensus addresses real-world challenges in AI services for minors, proposing industry standards across seven dimensions: prioritizing health, ensuring content safety, safeguarding privacy, clarifying rules, promoting transparency and trust, fostering collaborative governance, and upholding ethics. It advocates that AI service providers fulfill their social responsibilities in product design, content management, privacy protection, and mental health guidance to jointly cultivate a secure, healthy, and trustworthy digital environment.

[Reference:

https://mp.weixin.qq.com/s/PXm7Ma0-b--8hinRLX1P9A]

3. 工信部公开征求《汽车整车信息安全技术要求》等强制性国家标准修改单的意见

9月24日，工信部发布了《汽车整车信息安全技术要求》（第1号修改单）等三项强制性国家标准修改单的的征求意见稿。具体修改内容，包括全文将“信息安全管理体系”“信息安全管理体系要求”均修改为“信息安全保障要求”；全文将“检查”修改为“检验”；将第 9 章同一型式判定 9.1 和 9.2 中的第一条列项“汽车信息安全管理体系有效”均修改为：汽车整车信息安全技术要求检验检测报告中的汽车信息安全保障要求相关内容有效且其签发日期未超过三年。

【参见：

https://wap.miit.gov.cn/jgsj/zbys/qcgy/art/2025/art_6c5ea37e866f43f8815d75c45920d21e.html】

The Ministry of Industry and Information Technology seeks public comments on amendments to compulsory national standards including “Technical Requirements for Information Security of Motor Vehicles”(《汽车整车信息安全技术要求》)

On September 24, the Ministry of Industry and Information Technology released draft amendments for three compulsory national standards, including the “Technical Requirements for Information Security of Motor Vehicles” (Amendment No. 1). Specific modifications include: throughout the text, replacing “information security management system” and “information security management system requirements” with “information security assurance requirements”; Replacing “inspection” with ‘verification’ throughout the text; Amending the first item listed in Sections 9.1 and 9.2 of Chapter 9 (Identification of the Same Type) from “The automotive information security management system is effective” to: “The relevant content regarding automotive information security assurance requirements in the automotive information security technical requirements verification and testing report is valid, and its issuance date does not exceed three years.”

[Reference:

https://wap.miit.gov.cn/jgsj/zbys/qcgy/art/2025/art_6c5ea37e866f43f8815d75c45920d21e.html]

4. 今日头条与UC平台因破坏网络生态被网信部门查处

9月23日，国家网信办发布资讯，称针对今日头条平台未落实信息内容管理主体责任，不仅在热搜榜单主榜呈现不良信息内容，还在落地页面置顶呈现相关话题，破坏网络生态的问题，国家网信办指导北京市网信办，依据《网络信息内容生态治理规定》等有关规定，对今日头条平台采取约谈、责令限期改正、警告、从严处理责任人等处置处罚措施。针对UC平台未落实信息内容管理主体责任，在热搜榜单主榜扎堆呈现极端敏感恶性案事件词条等非权威部门、权威媒体发布的信息，涉及网络暴力、未成年人隐私等相关话题，破坏网络生态秩序的问题，国家网信办指导广东省网信办，依据《网络信息内容生态治理规定》等有关规定，对UC平台采取约谈、责令限期改正、警告、从严处理责任人等处置处罚措施。

【参见：

https://mp.weixin.qq.com/s/0A30JLrxaukPNKxjceMbPQ；

https://mp.weixin.qq.com/s/JY23md99hClCL4QUSpzFoQ】

Toutiao and UC Platforms were penalized by cyberspace administration for disrupting online ecosystem

On September 23, the CAC announced that, in response to Toutiao’s failure to fulfill its primary responsibility for information content management—specifically displaying harmful content on its main trending topics list and prominently featuring related topics on landing pages, thereby undermining the online ecosystem—the CAC directed the Beijing Cyberspace Administration to impose disciplinary measures on Toutiao. These measures, based on the “Regulations on the Governance of the Online Information Content Ecosystem”（《网络信息内容生态治理规定》） and other relevant provisions, include formal interviews, orders to rectify within a specified timeframe, warnings, and strict disciplinary actions against responsible personnel. Regarding the UC platform’s failure to fulfill its primary responsibility for information content management, which resulted in the mass display of entries related to extremely sensitive and malicious cases and incidents on its main trending topics list—information not released by authoritative departments or media outlets—involving topics such as cyberbullying and minors' privacy, thereby disrupting the online ecosystem order, The CAC directed the Cyberspace Administration of Guangdong to impose disciplinary measures on the UC platform, including interviews, orders to rectify within a specified timeframe, warnings, and strict handling of responsible personnel, in accordance with the “Regulations on the Governance of the Online Information Content Ecosystem” （《网络信息内容生态治理规定》）  and other relevant provisions.

[Reference:

https://mp.weixin.qq.com/s/0A30JLrxaukPNKxjceMbPQ；

https://mp.weixin.qq.com/s/JY23md99hClCL4QUSpzFoQ]

5. 中央网信办部署开展“清朗·整治恶意挑动负面情绪问题”专项行动

9月22日，中央网信办发布资讯称，为整治恶意挑动对立、宣扬暴力戾气等负面情绪问题，营造更加文明理性的网络环境，将在全国范围内部署开展为期2个月的“清朗·整治恶意挑动负面情绪问题”专项行动。本次专项行动聚焦社交、短视频、直播等平台，全面排查话题、榜单、推荐、弹幕、评论等重点环节，着力整治挑动群体极端对立情绪、宣扬恐慌焦虑情绪、挑起网络暴力戾气、过度渲染消极悲观情绪等问题。

【参见：

https://mp.weixin.qq.com/s/313azhTNzzrpztVCRBVcdA】

The CAC launched special campaign titled “Clear and Bright: Tackling Malicious Incitement of Negative Sentiments”

On September 22, the Cyberspace Administration of China (CAC) announced a nationwide two-month special campaign titled “Clear and Bright: Tackling Malicious Incitement of Negative Sentiments.” This initiative aims to address issues such as deliberately provoking division and promoting violent rhetoric, fostering a more civil and rational online environment. This campaign will focus on social media, short video, and live streaming platforms, conducting comprehensive inspections of key areas including trending topics, charts, recommendations, bullet comments, and comments. It will target issues such as inciting extreme group antagonism, spreading panic and anxiety, provoking online violence and hostility, and excessively exaggerating negative and pessimistic emotions.

[Reference:

https://mp.weixin.qq.com/s/313azhTNzzrpztVCRBVcdA]

6. 全国网安标委发布《网络安全标准实践指南——生成式人工智能服务安全应急响应指南》

9月22日，全国网络安全标准化技术委员会发布《网络安全标准实践指南——生成式人工智能服务安全应急响应指南》。《实践指南》描述了生成式人工智能服务安全事件的分类、分级方法和生成式人工智能服务安全应急响应过程的管理措施和技术方法，适用于生成式人工智能服务提供者以及相关部门开展安全应急响应活动。

【参见：

https://www.tc260.org.cn/front/postDetail.html?id=20250909095834】

TC 260 released “Practical Guide to Cybersecurity Standards: Emergency Response Guidelines for Generative AI Services”（《网络安全标准实践指南——生成式人工智能服务安全应急响应指南》）

On September 22, the TC260 released the “Practical Guide to Cybersecurity Standards: Emergency Response Guidelines for Generative AI Services”（《网络安全标准实践指南——生成式人工智能服务安全应急响应指南》）. The Practical Guide outlines classification and grading methods for security incidents in generative AI services, along with management measures and technical approaches for security emergency response processes. It applies to generative AI service providers and relevant departments conducting security emergency response activities.

[Reference:

https://www.tc260.org.cn/front/postDetail.html?id=20250909095834]

7. 商务部、中央网信办等九部门联合发布《关于促进服务出口的若干政策措施》

9月22日，商务部、中央网信办等九部门印发《关于促进服务出口的若干政策措施》。《措施》第十一点提出，将促进和规范数据跨境流动，制订重要数据目录，出台更具操作性的重要数据识别指南。优化调整和动态更新自由贸易试验区数据出境负面清单，研究探索形成全国自由贸易试验区数据出境负面清单。支持具备条件的地区探索跨国公司内部个人信息跨境传输便捷化安排，允许通过评估或认证的跨国公司内部自由跨境流动个人信息。在遵守国家网络管理制度前提下，支持相关企业、科研机构更便利地使用网络开展国际贸易和学术研究，参与国际竞争。

【参见：

https://fms.mofcom.gov.cn/zcfg/zhzcfg/art/2025/art_2aa3821acbf744b8ad325c320024b47f.html】

Nine Departments including the Ministry of Commerce and the CAC jointly issued “Several Policy Measures to Promote Service Exports”（《关于促进服务出口的若干政策措施》）

On September 22, nine departments including the Ministry of Commerce and the CAC issued the “Several Policy Measures to Promote Service Exports”（《关于促进服务出口的若干政策措施》）. The eleventh point of the Measures proposes to promote and regulate cross-border data flows, establish a catalog of important data, and introduce more operational guidelines for identifying important data. Optimize, adjust, and dynamically update the negative list for data cross-border transfers in pilot free trade zones, and explore establishing a unified national negative list for data outbound transfers across all pilot free trade zones. Support eligible regions in exploring streamlined arrangements for cross-border personal information transfers within multinational corporations, permitting the free cross-border flow of personal information within multinational corporations that have passed assessments or certifications. Under the premise of complying with national cyber management systems, support relevant enterprises and research institutions in more conveniently utilizing networks for international trade and academic research, and participating in international competition.

[Reference：

https://fms.mofcom.gov.cn/zcfg/zhzcfg/art/2025/art_2aa3821acbf744b8ad325c320024b47f.html]

1. 欧盟委员会发布关于严重人工智能事件的指南和报告模板草案

9月26日，欧盟委员会发布了关于严重人工智能事件的指南和报告模板草案（draft guidance and reporting template on serious AI incidents），根据《欧盟人工智能法》，高风险人工智能系统的提供商将被要求向国家当局报告严重事件。虽然这些规则将从2026年8月开始生效，但指南草案和模板草案将帮助提供商做好准备。

【参见：

https://digital-strategy.ec.europa.eu/en/consultations/ai-act-commission-issues-draft-guidance-and-reporting-template-serious-ai-incidents-and-seeks】

European Commission released draft guidance and reporting template on serious AI incidents

On September 26, the European Commission published draft guidance and a reporting template on serious AI incidents. Under the EU AI Act, providers of high-risk AI systems will be required to report serious incidents to national authorities. Although these rules will take effect starting in August 2026, the draft guidance and template will help providers prepare.

[Reference:

https://digital-strategy.ec.europa.eu/en/consultations/ai-act-commission-issues-draft-guidance-and-reporting-template-serious-ai-incidents-and-seeks]

2. 美国总统特朗普发布《保护国家安全的同时保留TikTok》（Saving Tiktok while Protecting National Security）行政命令

9月25日，美国总统特朗普发布《保护国家安全的同时保留TikTok》（Saving Tiktok while Protecting National Security）行政命令。该行政命令显示，根据TikTok美国业务“合格剥离”计划的框架协议，TikTok美国版应用程序将由一家新成立的位于美国的合资公司运营。该合资公司将由美国人持有多数股权并掌控，同时不再受任何外国对手的控制，因为字节跳动有限公司及其关联方对该实体的持股比例将低于20%，剩余股权由特定投资人持有。新合资公司将由新董事会管理，并需遵守旨在妥善保护美国用户数据及美国国家安全的相关规定。据此，行政命令认定，拟议的剥离计划既能让数百万日常使用TikTok的美国人继续使用该应用，同时也能维护国家安全。

【参见：

https://www.whitehouse.gov/presidential-actions/2025/09/saving-tiktok-while-protecting-national-security/】

US President Trump issued Executive Order “Saving TikTok While Protecting National Security”

On September 25, U.S. President Trump issued the executive order “Saving TikTok While Protecting National Security.” The order states that under the framework agreement for TikTok’s “qualified divestiture” plan, TikTok’s United States application will be operated by a newly established joint venture based in the United States. It will be majority-owned and controlled by United States persons and will no longer be controlled by any foreign adversary, since ByteDance Ltd. and its affiliates will own less than 20 percent of the entity, with the remainder being held by certain investors (Investor Parties). This new joint venture will be run by a new board of directors and subject to rules that appropriately protect Americans’ data and our national security. Accordingly, the executive order determines that the proposed divestiture would allow the millions of Americans who enjoy TikTok every day to continue using it while also protecting national security.

[Reference:

https://www.whitehouse.gov/presidential-actions/2025/09/saving-tiktok-while-protecting-national-security/]