每周数据法律资讯 Data Law Weekly（20251117—20251123）

1. 国家网信办、公安部发布关于《大型网络平台个人信息保护规定（征求意见稿）》

11月22日，国家网信办、公安部发布《大型网络平台个人信息保护规定（征求意见稿）》。《规定》将适用于在中华人民共和国境内建设、运营的大型网络平台的个人信息保护。其中，国家网信部门将会同国务院公安部门等有关部门制定发布大型网络平台目录并动态更新。对大型网络平台的认定，将主要考虑以下因素：（一）注册用户5000万以上或者月活跃用户1000万以上；（二）提供重要网络服务或者经营范围涵盖多个类型业务；（三）掌握处理的数据一旦被泄露、篡改、损毁，对国家安全、经济运行、国计民生等具有重要影响；（四）国家网信部门、国务院公安部门规定的其他情形。

【参见：

https://mp.weixin.qq.com/s/QQAhkamcqgBMikTYJZYv0g】

CAC and MPS released draft “Regulation on Personal Information Protection for Large-Scale Online Platforms”（《大型网络平台个人信息保护规定》）

On November 22, the Cyberspace Administration of China (CAC) and the Ministry of Public Security (MPS) released the draft “Regulation on Personal Information Protection for Large-Scale Online Platforms”（《大型网络平台个人信息保护规定》）. The regulation will govern personal information protection for large-scale online platforms established and operated within the People’s Republic of China. The Cyberspace Administration, in collaboration with the MPS and other relevant departments, will formulate and publish a directory of large-scale online platforms, which will be dynamically updated. The identification of large-scale online platforms will primarily consider the following factors: (1) having over 50 million registered users or over 10 million monthly active users; (2) providing critical network services or operating across multiple business categories; (3) possessing data whose leakage, tampering, or destruction would significantly impact national security, economic operations, or public welfare; (4) other circumstances specified by the Cyberspace Administration and the Ministry of Public Security.

[Reference:

https://mp.weixin.qq.com/s/QQAhkamcqgBMikTYJZYv0g]

2. 国家网信办发布《网络安全标识管理办法》（征求意见稿）

11月21日，国家网信办发布《网络安全标识管理办法》（征求意见稿）。《管理办法》所称的网络安全标识，是指能够反映产品本身网络安全能力水平的信息标识。《管理办法》适用于具有互联网联网功能的产品，具体产品实施目录管理。其中，第一批实施网络安全标识的产品包括消费类网联摄像头，适用于由消费者购买、使用，为个人和家庭提供音视频信息采集和处理服务的、具有互联网联网功能的独立摄像头。

【参见：

https://mp.weixin.qq.com/s/O0q0ihFOSkSYfs7H79g5lA】

CAC released draft “Measures for the Administration of Cybersecurity Labels”（《网络安全标识管理办法》）

On November 21, the CAC released the draft “Measures for the Administration of Cybersecurity Labels”（《网络安全标识管理办法》）. The cybersecurity label referred to in these Measures denotes an information identifier reflecting the cybersecurity capability level of the product itself. These Measures apply to products with internet connectivity functions, with specific products subject to catalog management. The first batch of products subject to cybersecurity labeling includes consumer-grade networked cameras. This applies to standalone cameras with internet connectivity purchased and used by consumers, providing audio-visual information collection and processing services for individuals and households.

[Reference:

https://mp.weixin.qq.com/s/O0q0ihFOSkSYfs7H79g5lA]

3. 国家网络与信息安全信息通报中心通报40款违法违规收集使用个人信息的移动应用

11月17日，国家网络与信息安全信息通报中心对40款存在违法违规收集使用个人信息情况的移动应用进行了通报。这些移动应用存在的问题包括，未逐一列出收集、使用个人信息的目的、方式、范围；在申请打开可收集个人信息的权限时，未同步告知用户其目的；征得用户同意前就开始收集个人信息；实际收集的个人信息超出用户授权范围；个人信息保护政策中描述需要收集的个人信息超出相关功能的必要范围；配置文件中声明的可收集个人信息的权限超出相关功能的必要范围；实际收集的个人信息超出相关功能的必要范围；未向用户提供个人信息相关投诉渠道或功能；未向用户提供更正或补充其个人信息的具体途径；未向用户提供删除其个人信息的具体途径；未向用户提供注销账户的途径和方式；注销账户的流程中设置不合理的条件或提出额外要求；未提供退出或关闭个性化展示模式的选项；广告存在误导、欺骗用户行为等。

【参见：

https://mp.weixin.qq.com/s/iEoej_qigNd_zNIsBS6mww】

National Cybersecurity Information Sharing Center reported 40 mobile apps for illegal collection and use of personal information

On November 17, the National Cybersecurity Information Sharing Center reported 40 mobile applications found to be illegally collecting and using personal information. Issues identified include: failure to explicitly list the purpose, method, and scope of each personal information collection and usage; failure to simultaneously inform users of the purpose when requesting permissions to access personal information; commencing personal information collection before obtaining user consent; actual collection of personal information exceeding the authorized scope; - Personal information protection policies describing required collection exceeding the necessary scope for relevant functions; permissions declared in configuration files for collecting personal information exceeding the necessary scope for relevant functions; the actual scope of personal information collected exceeded the necessary scope for related functions; failure to provide users with channels or functions for filing complaints regarding personal information; failure to provide users with specific means to correct or supplement their personal information; failure to provide users with specific means to delete their personal information; failure to provide users with methods and procedures for account cancellation; setting unreasonable conditions or imposing additional requirements during the account cancellation process; failure to provide options to opt out of or disable personalized display modes; advertisements contained misleading or deceptive practices targeting users.

[Reference:

https://mp.weixin.qq.com/s/iEoej_qigNd_zNIsBS6mww]

4. 上海新增3款已完成登记的生成式人工智能服务

11月19日，上海市网信办发布《上海市生成式人工智能服务登记信息公告（11月19日）》。公告显示，截至11月19日，上海市新增3款已完成登记的生成式人工智能服务，累计已完成130款生成式人工智能服务登记。已上线的生成式人工智能应用或功能，应在显著位置或产品详情页面标明所取得的上线编号。

【参见：

https://mp.weixin.qq.com/s/I4RKLCgfHmsz_qysu207-g】

Shanghai adds 3 new registered generative AI services

On November 19, the Shanghai Cyberspace Administration released the “Announcement on Generative AI Service Registration Information in Shanghai (November 19).” The announcement indicates that as of November 19, Shanghai has added 3 new registered generative AI services, bringing the cumulative total to 130 registered generative AI services. Generative AI applications or features that have gone live must display their official launch number in a prominent location or on the product details page.

[Reference:

https://mp.weixin.qq.com/s/I4RKLCgfHmsz_qysu207-g]

5. 湖南某学校因监控系统未采取数据安全防护措施被网信办处罚

近日，湖南省湘西州网信办对湘西某学校作出行政处罚。相关资讯称，该学校的视频监控系统未采取相应防护措施履行数据安全保护义务，存在较大数据泄漏风险，其行为违反了《中华人民共和国数据安全法》第二十七条：建立健全全流程数据安全管理制度，组织开展数据安全教育培训，采取相应的技术措施和其他必要措施，保障数据安全。湘西州互联网信息办公室根据《中华人民共和国数据安全法》第四十五条之规定，对该学校作出警告的行政处罚，并责令限期整改。

【参见：

https://mp.weixin.qq.com/s/qKfr4zwrX2IK7yQ_ZnHCPw】

A Hunan school penalized by Cyberspace Administration for failing to implement data security measures in surveillance system

Recently, the Cyberspace Administration of Xiangxi prefecture in Hunan imposed administrative penalties on a school in Xiangxi. Reports indicate the school’s video surveillance system failed to implement corresponding protective measures to fulfill data security obligations, posing significant data leakage risks. This violated Article 27 of the Data Security Law of the PRC: “Establish and improve comprehensive data security management systems, organize data security education and training, and adopt corresponding technical measures and other necessary measures to ensure data security.” Pursuant to Article 45 of the Data Security Law, the Xiangxi Prefecture Cyberspace Administration issued a warning to the school and ordered it to rectify the violations within a specified timeframe.

[Reference:

https://mp.weixin.qq.com/s/qKfr4zwrX2IK7yQ_ZnHCPw]

1. 欧盟发布数字化领域一揽子修正提案（Digital Omnibus），旨在全面改革欧盟数字规体系

11月19日，欧盟委员会发布数字化领域一揽子修正提案（Digital Omnibus），旨在全面改革欧盟数字法规体系。提案包括对大量数字立法的一系列技术修正案，覆盖GDPR、人工智能法案（AI Act）、数字法案（Data Act）、数据治理法案（Data Governance Act）等，其目标是确保以较低的成本遵守规则，实现相同的目标，并为负责任的企业带来竞争优势。

【参见：

https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-regulation-proposal】

EU has released the Digital Omnibus Regulation Proposal, aiming to comprehensively reform the EU’s digital regulatory framework

On November 19, the European Commission released the Digital Omnibus Regulation Proposal, aiming to comprehensively reform the EU's digital regulatory framework. The proposal includes a series of technical amendments to numerous digital laws, covering the GDPR, the AI Act, the Data Act, the Data Governance Act, and others. Its goal is to ensure compliance with lower costs, achieve the same objectives, and provide a competitive advantage for responsible businesses.

[Reference:

https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-regulation-proposal]

2. 爱尔兰高等法院裁决暂缓执行TikTok数据跨境传输禁令

近日，爱尔兰高等法院裁决暂缓执行爱尔兰数据保护委员会（DPC）针对TikTok数据跨境传输作出的暂停和纠正令（“Suspension and Corrective Orders”）。Rory Mulcahy法官认为，如要求TikTok在上诉听证会之前执行该暂停和纠正令，TikTok将会遭受巨大的损失。同时表示，DPC应该接受，当有一个严重的问题需要法院审理时，法院的目标是在审理之前确保最大程度地减少不公正风险。他认为，如果不批准暂缓执行，TikTok的损失规模几乎无法量化，即便上诉成功，该公司能够追回损失的前景也有限，而损害赔偿不能被视为充分的补救措施。他认为，尽管延误实施DPC的任何决定有可能对基本权利构成风险，而基本权利在综合考量过程中起着重要作用，但证据表明，目前这种风险是有限且暂时的。然而，他表示，暂缓执行期应尽可能短，因此，只要TikTok有权上诉，就将在明年3月前审理上诉。他还命令TikTok以清晰易懂的语言通知所有用户DPC的决定。任何此类通知还应提及TikTok的上诉和法官批准的暂缓执行。

【参见：

https://www.irishtimes.com/business/2025/11/17/high-court-continues-stay-on-decision-tiktok-should-stop-transferring-data-to-china/】

Irish High Court ruled to suspend enforcement of an order that TikTok suspend data transfers to China

Recently, the Irish High Court ruled to suspend enforcement of the Irish Data Protection Commission’s (DPC) “Suspension and Corrective Orders” regarding TikTok’s cross-border data transfers. Mr Justice Rory Mulcahy held that requiring TikTok to comply with the orders prior to the appeal hearing would cause substantial harm to the company. He further stated that the DPC should recognize that when a serious issue requires judicial review, the court’s objective is to minimize the risk of injustice to the greatest extent possible before the hearing. He held that the scale of TikTok’s potential losses without a stay would be nearly impossible to quantify, and even if the appeal succeeded, the company’s prospects for recovering those losses would be limited. Damages alone could not be considered an adequate remedy. While acknowledging that delaying implementation of any DPC decision could pose risks to fundamental rights—which play a significant role in the balancing exercise—the evidence indicated such risks were currently limited and temporary. However, he stated that the stay period should be as brief as possible, hence the appeal would be heard before March next year, provided TikTok retains its right to appeal. He further ordered TikTok to notify all users of the DPC’s decision in clear and understandable language. Any such notification must also mention TikTok’s appeal and the judge-approved stay.

[Reference:

https://www.irishtimes.com/business/2025/11/17/high-court-continues-stay-on-decision-tiktok-should-stop-transferring-data-to-china/]

3. 加州发布《加州消费者隐私法案》（CCPA）的7个注意事项

近日，随着新版《加州消费者隐私法案》（CCPA）将于2026年1月1日生效，加州政府发布相关注意事项, 强调了7项企业应当知晓并提前准备的工作，具体包括：风险评估（risk assessments）、选择退出出售/共享请求(requests to opt-out of selling/sharing)、知情权请求(requests to know)、更正权请求(requests to correct)、维护数据准确性(maintaining correct data)、健康相关的数据更正(health data corrections)、青少年数据的敏感性(sensitivity of youth data)。

【参见：

https://cppa.ca.gov/pdf/things_to_know_before_2026_updates.pdf】

California released seven key considerations for California Consumer Privacy Act (CCPA)

With the revised California Consumer Privacy Act (CCPA) set to take effect on January 1, 2026, the California government has issued guidance highlighting seven critical tasks businesses must understand and prepare for in advance. These include: risk assessments, requests to opt-out of selling/sharing, requests to know, requests to correct, maintaining correct data, health data corrections, and sensitivity of youth data.

[Reference:

https://cppa.ca.gov/pdf/things_to_know_before_2026_updates.pdf]