每周数据法律资讯 Data Law Weekly（20250913—20251019）

1. 国家网信办与市场监管总局联合发布《个人信息出境认证办法》

10月17日，国家互联网信息办公室与国家市场监督管理总局联合发布《个人信息出境认证办法》。《办法》规定了个人信息处理者通过个人信息出境认证的方式向境外提供个人信息应当符合的情形，明确个人信息出境认证的申请方式、认证要求及证书有效期，规定了明确专业认证机构应当履行的义务。

【点击查看全文：

https://mp.weixin.qq.com/s/wgzO0X1YZGmQ_JqCQJub2w】

The CAC and the SAMR jointly issued the “Measures for the Cross-Border Certification of Personal Information”（《个人信息出境认证办法》）

On October 17, the Cyberspace Administration of China(CAC) and the State Administration for Market Regulation‌(SAMR) jointly issued the “Measures for the Certification of Personal Information Cross-Border”（《个人信息出境认证办法》）. The Measures specify the circumstances under which personal information processors may provide personal information overseas through certification, clarify the application procedures, certification requirements, and validity period of the certification, and set out the obligations that professional certification bodies must fulfill.

[Click to view the full text:

https://mp.weixin.qq.com/s/wgzO0X1YZGmQ_JqCQJub2w]

2. 全国网安标委发布《网络安全标准实践指南——数据库联网安全要求（征求意见稿）》

10月17日，全国网络安全标准化技术委员会发布《网络安全标准实践指南——数据库联网安全要求（征求意见稿）》。《实践指南》旨在应对数据库联网过程中和联网状态下的安全风险，减少因安全防护措施不足、安全配置不当、管理不当引发的数据泄露等安全事件。《实践指南》规定了数据库系统连接至公共网络场景下的安全技术要求、安全管理要求，适用于指导数据库系统接入公共网络开展数据处理活动。

【参见：

https://www.tc260.org.cn/front/postDetail.html?id=20251017153843】

The TC260 issued the “Practice Guide of Cybersecurity Standards — Database Networking Security Requirements (Draft for Comment)”（《网络安全标准实践指南——数据库联网安全要求（征求意见稿）》）

On October 17, the TC260 issued the “Practice Guide of Cybersecurity Standards —Database Networking Security Requirements (Draft for Comment)” （《网络安全标准实践指南——数据库联网安全要求（征求意见稿）》）. The Practice Guide aims to deal with the security risks in the process and state of database networking, and reduce security incidents such as data leakage caused by insufficient security protection measures, improper security configuration and improper management. The Practice Guide specifies the security technical requirements and security management requirements when the database system is connected to the public network, which is suitable for guiding the database system to access the public network to carry out data processing activities.

[Reference:

https://www.tc260.org.cn/front/postDetail.html?id=20251017153843]

3. 杭州发布市场监管系统数据保护行政执法十大案件

10月15日，杭州市市场监督管理局发布市场监管系统数据保护行政执法十大案件（2017-2025年）。案件聚焦于2017年原《中华人民共和国反不正当竞争法》至今的数据保护执法案件，涉及广告投放流量劫持、“数据搬家”、侵犯数据产品商业秘密、“数据嫁接”、关键词广告商标侵权、侵犯数据企业商业秘密、互联网应用程序新流量劫持等。

【参见：

https://mp.weixin.qq.com/s/0WSafB4-HjsqMv8KksFCNw?scene=25#wechat_redirect】

Hangzhou released Top 10 data protection enforcement cases in market regulation system

On October 15, the Hangzhou Market Supervision Administration released Top 10 data protection enforcement cases in market regulation system (2017-2025). The cases focus on data protection enforcement actions from 2017 (under the original Anti-Unfair Competition Law of the People’s Republic of China) to the present, involving ad network flow hijacking, “data relocation”, infringement of commercial secrets in data products, “data grafting”, trademark infringement in keyword advertising, infringement of commercial secrets of data enterprises, and new network flow hijacking in internet applications.

[Reference:

https://mp.weixin.qq.com/s/0WSafB4-HjsqMv8KksFCNw?scene=25#wechat_redirect]

4. 工信部修订多项汽车领域准入要求，涉网络安全与数据安全

10月13日，工业和信息化部装备工业一司发布《道路机动车辆生产企业准入审查要求（征求意见稿）》《道路机动车辆产品准入审查要求（征求意见稿）》《关于修改<新能源汽车生产企业及产品准入管理规定>的决定（征求意见稿）》及对应解读。本次修订，在企业审查要求上，将全面提高企业智能化、网联化生产准入能力要求，明确网络安全、数据安全通用要求。在数据安全保障要求方面，应建立汽车数据安全管理制度并实施数据分类分级管理，建立数据安全机制并实施安全保护措施，建立数据出境安全评估机制及对数据处理相关方的数据安全管理能力。

【参见：

https://www.miit.gov.cn/gzcy/yjzj/art/2025/art_8ba915c8c46c4dde82dfa91931a56000.html】

The MIIT revised multiple automotive sector access requirements, covering cybersecurity and data security

On October 13, the Department of Equipment Industry I of the Ministry of Industry and Information Technology (MIIT) released the “Review Requirements for Access to Road Motor Vehicle Manufacturers (Draft for Comment)”, “Review Requirements for Access to Road Motor Vehicle Products (Draft for Comment)”, “Decision on Amending the ‘Administrative Provisions on Access for New Energy Vehicle Manufacturers and Products’ (Draft for Comment)”, along with corresponding interpretations. These revisions comprehensively elevate enterprise requirements for intelligent and connected production access, establishing universal cybersecurity and data security standards. Regarding data security safeguards, manufacturers must implement automotive data security management systems with data classification and grading, data security mechanisms and protective measures, cross-border data transfer security assessment protocols, data security management capabilities for data processing partners.

[Reference:

1. 携程因数据安全风险面临韩国国会听证

近日，韩国媒体报道，在近期的韩国国会审计中，中国在线旅行网站携程（Trip.com）的客户数据泄露问题被曝光，引发广泛关注，正面临进一步调查和听证。韩国国会议员在国家政策委员会审计会上表示，Trip.com的服务条款中规定，其可以与关联公司共享用户的个人信息，因此，韩国公民的个人信息被泄露给中国关联公司的可能性很高，他要求修改与关联公司共享用户信息的条款。个人信息保护委员会（PIPC）委员长宋庆熙表示，PIPC此前已对Trip.com进行了调查并采取了行动，之后PIPC将进一步调查是否存在违规行为。

【参见：

https://biz.chosun.com/en/en-retail/2025/10/16/QXVDZRF44BC2ZBW7AWW67LQTE4/】

Trip.com faces a hearing in the South Korean National Assembly due to data security risks

Recently, South Korean media reported that in the recent audit of South Korean Parliament, the customer data leakage of China online travel agency (OTA) Trip.com was exposed, which caused widespread concern and was facing further investigation and hearing. At the audit meeting of the National Policy Committee, South Korean parliamentarians said that Trip.com’s terms of service stipulate that it can share users’ personal information with affiliated companies, so there is a high possibility that Korean citizens’ personal information will be leaked to affiliated companies in China, and he requested to amend the terms of sharing users’ information with affiliated companies. Song Kyung-hee, Chairperson of the Personal Information Protection Committee (PIPC), said that PIPC had investigated Trip.com and took action before, and PIPC would further investigate whether there was any violation.

[Reference:

https://biz.chosun.com/en/en-retail/2025/10/16/QXVDZRF44BC2ZBW7AWW67LQTE4/]

2. 欧盟EDPB宣布将透明度和信息提供义务作为2026年的协调执法行动主题

10月14日，欧洲数据保护委员会EDPB宣布将透明度和信息提供义务作为第五次协调执法行动的主题。该行动将聚焦《通用数据保护条例》（GDPR）规定的透明度与信息告知义务。GDPR规定，个人对其个人数据处理享有知情权，知情权是透明度的核心要素，其确保了个人对自身数据有更多的控制。该行动将在2026年启动。

【参见：

https://www.edpb.europa.eu/news/news/2025/coordinated-enforcement-framework-edpb-selects-topic-2026_en】

EDPB announced transparency and information obligations as topic for 2026 coordinated enforcement action

On October 14, the European Data Protection Board (EDPB) announced that transparency and information obligations would be the focus of its fifth coordinated enforcement action, which will concern compliance with the obligations of transparency and information under the General Data Protection Regulation (GDPR). The GDPR ensures that individuals are informed when their data is being processed. This right to be informed is a core element of transparency and ensures that individuals have more control over their data. The action will commence in 2026.

[Reference:

https://www.edpb.europa.eu/news/news/2025/coordinated-enforcement-framework-edpb-selects-topic-2026_en]

3. 美国加州发布《人工智能透明法》

10月13日，美国加州州长签署了《人工智能透明法》（Artificial Intelligence Transparency Act, AB 853），对2024年发布的原加州人工智能透明法（SB 942）的规定进行了补充和扩展，AB 853明确了大型在线平台、生成式AI托管平台以及采集设备制造商的相关义务，包括要求大型在线平台检测内容中是否包含溯源数据等。AB853将加州人工智能透明法的生效日期延后至2026年8月2日。

【参见：

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853】

California issued the Artificial Intelligence Transparency Act

On October 13, the Governor of California signed the Artificial Intelligence Transparency Act (AB 853), supplementing and expanding provisions from the original California Artificial Intelligence Transparency Act (SB 942) enacted in 2024. AB 853 clarifies obligations for large online platforms, Generative AI Hosting Platform, and Capture Device Manufacturer, including requiring large online platforms to detect whether content contains provenance data. AB 853 extends the effective date of California's Artificial Intelligence Transparency Act to August 2, 2026.

[Reference:

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853]