每周数据法律资讯 Data Law Weekly（20251110—20251116）

1. 网信部门从严整治利用AI仿冒公众人物开展直播营销问题乱象

11月14日，国家网信办发布资讯称，近期有网络账号利用AI技术仿冒公众人物形象，在直播、短视频等环节发布营销信息，误导网民，涉嫌虚假宣传和网络侵权，严重破坏网络生态，造成不良影响。督促网站平台发布治理公告，举一反三，开展集中清理整治，目前已累计清理相关违规信息8700余条，处置仿冒公众人物账号1.1万余个。下一步，网信部门将继续压实网站平台主体责任，对利用AI仿冒公众人物开展直播营销问题保持高压严管态势。

【参见：

https://mp.weixin.qq.com/s/ZpnNduZQz0Z28_EzawIcig】

Cyberspace administration crackdowns on AI impersonation of public figures for live-stream marketing

On November 14, the Cyberspace Administration of China (CAC) announced that certain online accounts have recently exploited AI technology to impersonate public figures, disseminating marketing content through live streams and short videos. These activities mislead netizens, constitute suspected false advertising and online infringement, severely disrupt the online ecosystem, and cause adverse impacts. Platform operators have been urged to issue governance announcements, learn from this incident, and conduct concentrated cleanup efforts. To date, over 8,700 pieces of non-compliant information have been removed, and more than 11,000 accounts impersonating public figures have been dealt with. Moving forward, the cyberspace administration will continue to hold platform operators accountable and maintain a high-pressure stance against AI-powered impersonation for live-stream marketing.

[Reference:

https://mp.weixin.qq.com/s/ZpnNduZQz0Z28_EzawIcig]

2. 国家网信办发布生成式人工智能服务已备案信息公告（2025年9月至10月）

11月11日，国家网信办发布生成式人工智能服务已备案信息公告（2025年9月至10月）。公告称，截至2025年11月1日，新增73款生成式人工智能服务在国家网信办完成备案，对于通过API接口或其他方式直接调用已备案模型能力的生成式人工智能应用或功能，由地方网信办开展登记，本阶段新增35款完成登记。截至11月1日，累计有611款生成式人工智能服务完成备案，306款生成式人工智能应用或功能完成登记。

【参见：

https://mp.weixin.qq.com/s/AZBB1p7u3zwyjq0EqYnkrg】

CAC released announcement on generative AI services with filed information (September–October 2025)

On November 11, the CAC released an announcement detailing generative AI services that have completed filing procedures (September–October 2025).The announcement stated that as of November 1, 2025, 73 new generative AI services had completed filing with the Cyberspace Administration. For generative AI applications or features that directly invoke filed model capabilities via API interfaces or other methods, registration is conducted by local cyberspace administrations, with 35 new entries completing registration during this phase. As of November 1, a cumulative total of 611 generative AI services had completed filing, while 306 generative AI applications or functionalities had completed registration.

[Reference:

https://mp.weixin.qq.com/s/AZBB1p7u3zwyjq0EqYnkrg]

3. 上海新增11款已完成备案的生成式人工智能服务

11月11日、11月12日，上海网信办各发布一期上海市生成式人工智能服务已备案信息公告。公告称，截至11月11日，上海市新增2款已完成备案的生成式人工智能服务，累计已完成106款生成式人工智能服务备案。截至11月12日，上海市新增9款已完成备案的生成式人工智能服务，累计已完成115款生成式人工智能服务备案。已上线的生成式人工智能应用或功能，应在显著位置或产品详情页面公示所使用已备案生成式人工智能服务情况，注明模型名称及备案号。

【11月11日公告参见：
 

https://mp.weixin.qq.com/s/tUxz8vG2v3VUcGzKaWGBXw

11月12日公告参见：
 

https://mp.weixin.qq.com/s/tUxz8vG2v3VUcGzKaWGBXw】

Shanghai adds 11 new generative AI services to completed filing list

On November 11 and 12, the Shanghai Cyberspace Administration released two announcements detailing newly filed generative AI services in the city. As of November 11, Shanghai added two generative AI services to its completed filing list, bringing the cumulative total to 106. As of November 12, Shanghai added 9 new generative AI services that have completed filing, bringing the cumulative total to 115 filed generative AI services. Generative AI applications or features that have gone live must prominently display information about the filed generative AI services used, including the model name and filing number, either in a conspicuous location or on the product details page.

[Announcement of November 11:

https://mp.weixin.qq.com/s/tUxz8vG2v3VUcGzKaWGBXw

Announcement of November 12:

https://mp.weixin.qq.com/s/tUxz8vG2v3VUcGzKaWGBXw]

4. 工信部通报39款侵害用户权益行为的APP（SDK）

11月10日，工业化和信息化部通信管理局发布《关于侵害用户权益行为的APP（SDK）通报》（2025年第7批，总第52批），共涉及39款APP（SDK）。这些APP（SDK）所涉问题有：隐私政策默认同意、强制用户使用定向推送功能、APP强制、频繁、过度索取权限、违规收集个人信息、未明示收集个人信息清单、强制用户使用定向推送功能、超范围收集个人信息、强制自动续费、强制下载第三方APP、SDK信息公示不到位、信息窗口无法关闭等。

【参见：

https://mp.weixin.qq.com/s/3oAp3AvSBl2HitFZf7UTxA】

MIIT issued notice on 39 Apps (SDKs) violating user rights

On November 10, the Department of Communications of the Ministry of Industry and Information Technology (MIIT) released the “Notice on Apps (SDKs) Violating User Rights” (Batch 67of 2025, Total Batch 52), which involved a total of 39 Apps (SDKs). The issues identified in these Apps (SDKs) include: default consent to privacy policies, forcing users to use targeted push notification functions, APPs compelling, frequently, and excessively requesting permissions, illegally collecting personal information, failing to explicitly disclose the list of collected personal information, forcing users to use targeted push notification functions, collecting personal information beyond the specified scope, forcing automatic subscription renewals, forcing the download of third-party APPs, inadequate disclosure of SDK information, and inability to close information windows.

[Reference:

https://mp.weixin.qq.com/s/3oAp3AvSBl2HitFZf7UTxA]

5. 某科技公司因未及时修复安全漏洞被网警处罚

11月10日，公安部网安局发布资讯称，山东青岛公安网安部门在日常工作中发现，某机构对外提供公共服务的网络平台长时间持续存在SQL注入漏洞、越权访问漏洞，存在网络数据安全隐患。经查，某科技公司在为该机构提供系统运行、维护时，未按照法律法规相关规定和合同约定履行网络数据安全保护义务，未采取必要的技术措施，未及时修复安全漏洞，存在数据泄露风险。青岛崂山网安部门依据《网络数据安全管理条例》对该公司予以行政处罚。《网络数据安全管理条例》第十六条规定“网络数据处理者为国家机关、关键信息基础设施运营者提供服务，或者参加其他公共基础设施、公共服务系统建设、运行、维护的，应当依照法律、法规的规定和合同约定履行网络数据安全保护义务，提供安全、稳定、持续的服务”。

【参见：

https://mp.weixin.qq.com/s/YbJzP10hnVKxBlq7zq04eQ】

A technology company was penalized by cyber police for failing to promptly address security vulnerabilities

On November 10, the Ministry of Public Security’s Cyber Security Bureau announced that during routine operations, Qingdao’s cyber security authorities discovered that a public service platform operated by a certain institution had persistently harbored SQL injection vulnerabilities and unauthorized access risks, posing significant cybersecurity threats. Upon investigation, it was found that while providing system operation and maintenance services for this institution, the technology company failed to fulfill its cyber data security protection obligations as stipulated by relevant laws, regulations, and contractual agreements. It neglected to implement necessary technical measures and promptly address security vulnerabilities, thereby creating risks of data leakage. The Qingdao Laoshan Cybersecurity Department imposed administrative penalties on the company in accordance with the “Regulation on the Management of Cyber Data Security” 《网络数据安全管理条例》. Article 16 of the Regulation stipulates: “When cyber data processors provide services to state organs or critical information infrastructure operators, or participate in the construction, operation, or maintenance of other public infrastructure or public service systems, they shall fulfill their cyber data security protection obligations in accordance with laws, regulations, and contractual agreements, and provide secure, stable, and continuous services.”

[Reference:

https://mp.weixin.qq.com/s/YbJzP10hnVKxBlq7zq04eQ]

6. 北京拟将自贸区数据出境负面清单推广应用到北京全市域

近日，北京市人民政府新闻办公室举行新闻发布会，会上指出北京市自贸区数据出境负面清单将采取“自主扩容+跨省互认”方式双轨推进，。一方面，在首批发布的5个领域基础上，着眼北京市重点产业发展方向，加紧自主编制第二批负面清单；另一方面，按照“一地制定、多地适用”原则，与外省市自贸区建立清单互认机制，将外省市已发布的清单全部在北京市参照使用。后续将持续探索将原自贸区负面清单推广应用到北京全市域。

【参见：

https://mp.weixin.qq.com/s/K9mqLCzTBrZZ4rvexpv2vw】

Beijing plans to extend free trade zone data export negative list to entire city

Recently, the Beijing Municipal People's Government Information Office held a press conference announcing that the city's Free Trade Zone data export negative list will advance through a dual-track approach of “independent expansion and cross-provincial mutual recognition.” On one hand, building upon the initial five sectors, Beijing will expedite the independent compilation of a second batch of negative lists aligned with the city's key industrial development priorities. On the other hand, following the principle of “one jurisdiction formulates, multiple jurisdictions apply,” Beijing will establish a mutual recognition mechanism with free trade zones in other provinces and municipalities. This will enable all lists already released by other regions to be referenced and applied in Beijing. Subsequent efforts will continue to explore extending the original free trade zone negative list to the entire city of Beijing.

[Reference:

https://mp.weixin.qq.com/s/K9mqLCzTBrZZ4rvexpv2vw]

1. 欧盟委员会计划简化GDPR和人工智能法

近日，欧盟委员会拟提出一项数字领域的一揽子修正提案（Digital Omnibus），这项改革计划侧重于四个监管领域：数据保护、数据使用规则、网络安全事件处理和人工智能法规。欧盟委员会计划放宽《通用数据保护条例》（GDPR）的规定，并削减部分内容，其中涉及AI数据训练、Cookie监管、敏感个人数据保护等问题；此外，欧盟委员会计划提出有针对性的简化措施，以确保《人工智能法》能够及时、顺利和相称的实施。

【参见：

https://netzpolitik.org/2025/digitaler-omnibus-eu-kommission-will-datenschutzgrundverordnung-und-ki-regulierung-schleifen/#!】

European Commission plans to simplify GDPR and AI Act

Recently, the European Commission proposed a Digital Omnibus. This reform initiative focuses on four regulatory areas: data protection, data usage rules, cybersecurity incident handling, and AI regulations. The Commission plans to relax provisions of the General Data Protection Regulation (GDPR) and streamline certain aspects concerning AI data training, cookie regulation, and protection of sensitive personal data. Additionally, the Commission intends to introduce targeted simplification measures to ensure the timely, smooth, and proportionate implementation of the AI Act.

[Reference: 

https://netzpolitik.org/2025/digitaler-omnibus-eu-kommission-will-datenschutzgrundverordnung-und-ki-regulierung-schleifen/#! ]

2. 现代汽车集团子公司泄露270万北美客户的个人数据

近日，现代汽车集团向客户发布数据泄露事件警示，称其旗下负责IT服务的美国子公司Hyundai AutoEver America（HAEA）在今年2月22日至3月2日期间遭受网络攻击，导致多达270万北美客户的个人数据遭到泄露，涉及数据类型包括姓名、驾驶证号码及社会安全号码等。报道指出，现代汽车集团于今年3月1日发现信息安全异常，随后展开调查，整个过程历时近七个月。在向受影响客户发出的通知信中，现代汽车表示将为受影响的客户提供由第三方提供的两年免费信用监控服务。

【参见：

https://www.caranddriver.com/news/a69384313/hyundai-data-breach-details/】

Hyundai subsidiary leaks personal data of 2.7 million north American customers

Hyundai recently issued a data breach alert to customers, stating that its US IT services subsidiary Hyundai AutoEver America (HAEA) suffered a cyberattack between February 22 and March 2 this year. The incident resulted in the leakage of personal data for up to 2.7 million North American customers, including names, driver’s license numbers, and social security numbers. Reports indicate Hyundai Motor Group detected an information security anomaly on March 1 this year and subsequently launched an investigation, a process that took nearly seven months. In notification letters sent to affected customers, Hyundai stated it would provide two years of free credit monitoring services from a third-party provider.

[Reference:

https://www.caranddriver.com/news/a69384313/hyundai-data-breach-details/]

3. OpenAI使用德国音乐人创作歌词训练模型被判侵权

11月11日，德国慕尼黑地方法院裁定，OpenAI未经授权使用德国音乐人创作的歌词，构成侵犯版权，应向德国一家主要音乐版权协会所代表的原告支付赔偿金。该协会指控OpenAI在未经许可、未付费情况下“系统性”使用了协会版权曲库内容用于训练人工智能模型ChatGPT。法院认定，OpenAI语言模型中的记忆行为，以及ChatGPT输出中对歌词的再现，均构成侵犯版权。

【参见：

https://content-static.cctvnews.cctv.com/snow-book/index.html?item_id=2887457545924479705&toc_style_id=feeds_default&track_id=29940333-412A-4BAA-BE10-5A49B28759AC_784579992522&share_to=wechat】

OpenAI found guilty of copyright infringement for training model using German musician's lyrics

On November 11, the Munich Regional Court in Germany ruled that OpenAI's unauthorized use of lyrics created by German musician constitutes copyright infringement. OpenAI must pay damages to the plaintiff represented by a major German music copyright association. The association accused OpenAI of “systematically” using content from its copyrighted music library to train the AI model ChatGPT without permission or payment. The court determined that both the memorization behavior within OpenAI's language model and the reproduction of lyrics in ChatGPT's outputs constituted copyright infringement.

[Reference:

https://content-static.cctvnews.cctv.com/snow-book/index.html?item_id=2887457545924479705&toc_style_id=feeds_default&track_id=29940333-412A-4BAA-BE10-5A49B28759AC_784579992522&share_to=wechat]