每周数据法律资讯 Data Law Weekly（20251103—20251109）

1. 全国网安标委发布支撑《网络数据安全管理条例》实施的国家标准官方梳理

11月7日，全国网络安全标准化技术委员会（TC260）发布文件，梳理了支撑《网络数据安全管理条例》实施的各项国家标准。2025年1月1日，《网络数据安全管理条例》生效施行，规定了开展网络数据处理活动及其安全监管须遵守的各项要求。TC260作为负责网络安全和数据安全国家标准的专业技术组织，分析了《条例》标准化需求，梳理了69项标准文件可为《条例》37项条款落地实施提供支撑，供各方参阅。

【参见：

https://mp.weixin.qq.com/s/Hi7AWL9Wlji0YisAqWDqGQ】

TC 260 released official compilation of national standards supporting implementation of the “Regulation on the Management of Network Data Security”（《网络数据安全管理条例》）

On November 7, the TC260 issued a document compiling national standards that support the implementation of the “Regulation on the Management of Network Data Security”《网络数据安全管理条例》）. The Regulation, effective on January 1, 2025, establishes requirements for conducting network data processing activities and their security supervision. As the specialized technical organization responsible for national standards on cybersecurity and data security, TC260 analyzed the standardization needs of the Regulation and identified 69 standard documents that can support the implementation of 37 clauses within the Regulation. This document is provided for reference by all parties.

[Reference:

https://mp.weixin.qq.com/s/Hi7AWL9Wlji0YisAqWDqGQ]

2. 全国网安标委对2项网络安全标准实践指南公开征求意见

11月7日，全国网安标委发布《大模型一体机产品安全基本要求（征求意见稿）》、《人工智能加速芯片安全功能技术规范（征求意见稿）》等2项网络安全标准实践指南的征求意见稿。2项指南分别规定了大模型一体机的安全建设与评估要求，以及人工智能加速芯片的研发与应用的技术要求。

【参见：

https://mp.weixin.qq.com/s/guZ3jSxmnSJOf_HUHnom2w】

The TC260 seeks public comments on two cybersecurity standard practice guides

On November 7, the TC260 released drafts for public comment on two cybersecurity standard practice guides: “Basic Security Requirements for Large Model Appliance Products (Draft for Comment)”《大模型一体机产品安全基本要求（征求意见稿）》 and “Technical Specifications for Security Functions of Artificial Intelligence Acceleration Chips (Draft for Comment).”《人工智能加速芯片安全功能技术规范（征求意见稿）》 These guides respectively outline security construction and assessment requirements for large model appliances, as well as technical requirements for the development and application of artificial intelligence acceleration chips.

[Reference:

https://mp.weixin.qq.com/s/guZ3jSxmnSJOf_HUHnom2w]

3. 上海首例涉AI提示词著作权侵权案一审宣判

11月6日，上海市黄浦区人民法院对上海首例涉AI提示词著作权侵权案作出一审判决，该案将争议核心锁定于输入端，围绕提示词是否具备作品独创性、是否属于“表达”等问题展开论证。黄浦区法院经审理后认为，涉案提示词虽反映一定的创作意图，但没有体现出作者在表达层面的个性化智力投入，不应认定为作品。原告对提示词不享有著作权，无权主张著作权侵权。

【参见：

https://mp.weixin.qq.com/s/qjoCLmWtjb7wxZ0FYt_iSA】

Shanghai's first AI prompt copyright infringement case ruled in first instance

On November 6, the Huangpu District People's Court in Shanghai issued its first-instance ruling on the city's inaugural AI prompt copyright infringement case. The dispute centered on the input stage, focusing on whether the prompts possessed originality as works and constituted “expression.” After deliberation, the Huangpu District Court concluded that while the prompt in question reflected certain creative intent, it did not demonstrate the author's personalized intellectual investment at the level of expression and therefore should not be recognized as a work. The plaintiff does not hold copyright over the prompt and lacks standing to assert copyright infringement.

[Reference:

https://mp.weixin.qq.com/s/qjoCLmWtjb7wxZ0FYt_iSA]

4. 北京互联网法院审结一起关联APP共享用户数据引发的人格权侵权纠纷案件

近日，北京互联网法院审结了一起关联APP共享用户数据引发的人格权侵权纠纷案件，最终认定APP运营方构成侵权需承担相应责任。本案中，二被告通过合同约定基于“统一服务平台体系”，在三款应用软件间共享涉案用户数据，属于共同处理用户个人信息的行为。法院认为，对于一般个人信息的处理，二被告的共同处理行为无需取得原告的单独同意，但仍应符合告知同意的一般要求，而对于敏感个人信息的处理，即便是共同处理行为，仍需取得个人单独同意，但二被告未取得原告的单独同意，侵害了原告的隐私权。

【参见：

https://mp.weixin.qq.com/s/kQmpkpDU2WwhM06zN9GzwA】

Beijing Internet Court Concludes Case Involving Personal Rights Infringement from Shared User Data Among Linked Apps

Recently, the Beijing Internet Court concluded a case involving personal rights infringement stemming from shared user data among linked apps, ultimately ruling that the app operators were liable for infringement. In this case, the two defendants agreed via contract to share user data across three applications based on a “unified service platform system,” constituting joint processing of personal information. The court held that while the joint processing of general personal information by the two defendants did not require obtaining the plaintiff's separate consent, it still had to meet the general requirements for informed consent. However, for the processing of sensitive personal information, even in cases of joint processing, separate consent from the individual was still required. The two defendants failed to obtain the plaintiff's separate consent, thereby infringing upon the plaintiff's right to privacy.

[Reference:

https://mp.weixin.qq.com/s/kQmpkpDU2WwhM06zN9GzwA]

5. 国家网信办发布第十四批深度合成服务算法备案信息公告

11月6日，国家网信办公开发布第十四批境内深度合成服务算法备案信息。具体信息可通过互联网信息服务算法备案系统（https://beian.cac.gov.cn）进行查询。《互联网信息服务深度合成管理规定》第十九条明确规定，具有舆论属性或者社会动员能力的深度合成服务提供者，应当按照《互联网信息服务算法推荐管理规定》履行备案和变更、注销备案手续。深度合成服务技术支持者应当参照履行备案和变更、注销备案手续。

【参见：

https://www.cac.gov.cn/2025-11/06/c_1764156698314535.htm】

CAC released announcement on the 14th batch of deep synthesis service algorithm filing Information

On November 6, the CAC publicly released the 14th batch of filing information for deep synthesis service algorithms within China. Specific information can be queried through the Internet Information Service Algorithm filing System (https://beian.cac.gov.cn). Article 19 of the Provisions on the Administration of Deep Synthesis Services for Internet Information Services （《互联网信息服务深度合成管理规定》）explicitly stipulates that providers of deep synthesis services with public opinion attributes or social mobilization capabilities shall comply with the filing, amendment, and cancellation procedures as stipulated in the Provisions on the Administration of Algorithm Recommendation for Internet Information Services（《互联网信息服务算法推荐管理规定》）. Technical support providers for deep synthesis services shall refer to these provisions for filing, amendment, and cancellation procedures.

[Reference:

https://www.cac.gov.cn/2025-11/06/c_1764156698314535.htm]

6. 上海市通管局发布关于侵害用户权益行为APP（SDK）的通报（2025年第九批）

11月4日，上海市通信管理局发布关于侵害用户权益行为APP（SDK）的通报（2025年第九批），通管局组织第三方检测机构对上海市APP（SDK）进行抽查，共发现53款APP（SDK）存在侵害用户权益行为。通管局要求相关APP（SDK）应对存在的问题立即整改，并对该APP（SDK）个人信息和用户权益保护工作开展全面自评估，自通报之日起5个工作日内将整改报告和自评估报告书面报送通管局。对未能在限期内完成整改并提交报告的，通管局将依法依规予以处理。

【参见：

https://mp.weixin.qq.com/s/2nh8sAxEnWxTybOlPTPT5w】

Shanghai Communications Administration issued notice on Apps (SDKs) violating user rights (batch 9, 2025)

On November 4, the Shanghai Communications Administration released its Notice on Apps (SDKs) Violating User Rights (Batch 9, 2025). The Administration organized third-party testing agencies to conduct random inspections of Shanghai-based apps (SDKs), identifying 53 apps (SDKs) engaging in practices that infringe upon user rights. The Administration requires the relevant apps (SDKs) to immediately rectify the identified issues and conduct a comprehensive self-assessment of their personal information and user rights protection practices. A written rectification report and self-assessment report must be submitted to the Administration within five working days from the date of this notice. Apps (SDKs) failing to complete rectification and submit reports within the deadline will be subject to handling in accordance with laws and regulations.

[Reference:

https://mp.weixin.qq.com/s/2nh8sAxEnWxTybOlPTPT5w]

7. 上海首例人工智能大模型著作权侵权案一审宣判

11月3日，上海市金山区人民法院一审宣判了《斗破苍穹》系列动漫中美杜莎角色形象著作权侵权案，该案系上海首例人工智能大模型著作权侵权案。该案中，法院认为，被告李某以商业使用为目的，在素材截取阶段及LoRA模型训练、发布及使用阶段再现在先作品的独创性表达、将“美杜莎”图集和短视频等素材通过网络提供给公众，侵害了原告对“美杜莎”作品享有的复制权和信息网络传播权。然而，本案中案涉美杜莎LoRA模型及美杜莎人工智能文生图，未见被告李某的实质性智力投入，不构成作品，因此被告李某不构成改编权侵权。此外，被告公司（某头部AI图像生成平台）并未直接参与LoRA模型的素材截取、训练、发布和使用，其仅提供了促进生成式人工智能发展的中立技术，属于网络服务提供者，其主观上并无过错，客观上也尽到了“采取必要措施”“转通知”义务，不应认定构成侵权。

【参见：

https://mp.weixin.qq.com/s/Plae0snaOEsqqmodLU9j4g】

Shanghai’s first AI large model copyright infringement case ruled in first instance

On November 3, the Jinshan District People’s Court of Shanghai delivered its first-instance ruling in the copyright infringement case involving the character design of Medusa from the “Fights Break Sphere” animated series. This is the first case of copyright infringement involving an AI large model in Shanghai . The court determined that defendant Li, acting for commercial purposes, reproduced the original creative expressions of the prior work during the material extraction phase and the training, release, and use of the LoRA model. By making the “Medusa” image collection and short videos available to the public online, Li infringed upon the plaintiff’s reproduction rights and information network dissemination rights for the “Medusa” works. However, the Medusa LoRA model and AI-generated images at issue in this case did not involve substantial intellectual input from Defendant Li and thus did not constitute original works. Consequently, Defendant Li was not found liable for infringement of adaptation rights. Furthermore, the defendant company(a leading AI image generation platform) did not directly participate in the material extraction, training, release, or use of the LoRA model. It merely provided neutral technology facilitating generative AI development, acting as a network service provider. Subjectively, it bore no fault, and objectively, it fulfilled its obligations to “take necessary measures” and “forward notifications.” It should not be deemed liable for infringement.

[Reference:

https://mp.weixin.qq.com/s/Plae0snaOEsqqmodLU9j4g]

8. 上海通管局通报下架27款侵害用户权益行为的APP（SDK）

11月3日，上海市通信管理局通报下架27款侵害用户权益行为的APP（SDK）。通报称，2025年10月，上海通管局向社会公示了一批存在侵害用户权益行为的APP（SDK）。在规定的整改期限内，经核查复检，尚有27款APP（SDK）未按照要求落实整改，现对上述APP（SDK）采取下架处理。上海通管局将对上述APP（SDK）持续跟踪，视情况进一步采取停止接入、行政处罚、纳入电信业务经营不良名单等后续处理措施。

【参见：

https://mp.weixin.qq.com/s/8cVH5AmYlZRBp5NhPV-I6A】

Shanghai Communications Administration removed 27 Apps (SDKs) for violating user rights

On November 3, the Shanghai Communications Administration announced the removal of 27 apps (SDKs) for infringing upon user rights. The notice stated that in October 2025, the Shanghai Communications Administration publicly disclosed a list of apps (SDKs) found to violate user rights. After verification and re-inspection within the stipulated rectification period, 27 apps (SDKs) failed to implement required corrections. These apps (SDKs) are now being removed from app stores. The Shanghai Communications Administration will continue monitoring these apps (SDKs) and may impose further measures including access suspension, administrative penalties, or inclusion in the telecom business blacklist as circumstances warrant.

[Reference:

https://mp.weixin.qq.com/s/8cVH5AmYlZRBp5NhPV-I6A]

9. 上海新增8款已完成登记的生成式人工智能服务

11月3日，上海市网信办发布《上海市生成式人工智能服务登记信息公告（11月3日）》。公告显示，截至10月31日，上海市新增8款已完成登记的生成式人工智能服务，累计已完成127款生成式人工智能服务登记。已上线的生成式人工智能应用或功能，应在显著位置或产品详情页面标明所取得的上线编号。

【参见：

https://mp.weixin.qq.com/s/q--ekU-yRHbDMonXICm1Zw】

Shanghai adds 8 new registered generative AI services

On November 3, the Shanghai Cyberspace Administration released the “Announcement on Generative AI Service Registration Information in Shanghai (November 3).” The announcement indicates that as of October 31, Shanghai has added 8 new registered generative AI services, bringing the cumulative total to 127 registered generative AI services. Generative AI applications or features that have gone live must display their official launch number in a prominent location or on the product details page.

[Reference:

https://mp.weixin.qq.com/s/q--ekU-yRHbDMonXICm1Zw]

1. 澳大利亚宣布《社交媒体最低年龄法案》将适用于Facebook、Instagram、TikTok等九家平台

11月5日，澳大利亚通信部长宣布《社交媒体最低年龄法案》（the Social Media Minimum Age Bill）将适用于Facebook、Instagram、Snapchat、TikTok、YouTube、X、Threads、Reddit 和 Kick。澳大利亚网络安全专员（eSafety Commissioner）已将上述平台评估为受年龄限制的社交媒体平台，其认为这些服务目前符合社交媒体最低年龄法规中规定的 16 岁以下限制标准，特别是其“唯一或主要目的是实现在线社交互动”这一关键要求。这意味着，从 12 月 10 日起，这些平台必须采取合理措施，防止 16 岁以下的人在其服务上持有账户。否则，这些平台将面临最高 4950 万澳元的罚款。

【参见：

https://minister.infrastructure.gov.au/wells/media-release/social-media-minimum-age-platform-assessments】

Australia announced Social Media Minimum Age Bill will apply to nine platforms including Facebook, Instagram, and TikTok

On November 5, Australia’s Minister for Communications announced that the Social Media Minimum Age Bill will apply to Facebook, Instagram, Snapchat, TikTok, YouTube, X, Threads, Reddit, and Kick. The eSafety Commissioner has assessed these platforms as age-restricted social media services, determining they currently meet the under-16 restriction criteria outlined in the Social Media Minimum Age legislation—particularly the key requirement that their “sole or significant purpose is to enable online social interaction”.” This means that starting December 10, these platforms must take reasonable measures to prevent individuals under 16 from holding accounts on their services. Failure to do so could result in fines of up to $49.5 million.

[Reference:

https://minister.infrastructure.gov.au/wells/media-release/social-media-minimum-age-platform-assessments]