每周数据法律资讯 Data Law Weekly（20251215—20251221）

1. 三部门联合发布《互联网平台价格行为规则》

12月20日，国家发展改革委、市场监管总局、国家网信办联合发布《互联网平台价格行为规则》。《规则》适用于平台经营者、平台内经营者在中华人民共和国境内通过互联网平台等信息网络销售商品或者提供服务等经营活动中的价格行为。《规则》第二十四条规定，平台经营者应当加强价格自律，建立健全价格行为合规管理制度，加强网络数据安全管理，在价格行为中依法依规处理个人信息。

【参见：

https://mp.weixin.qq.com/s/Nakktn2x6QRF8hWvlfOY1Q】

Three departments jointly issued the “Rules on Pricing Practices for Internet Platforms”（《互联网平台价格行为规则》）

On December 20, the National Development and Reform Commission, the State Administration for Market Regulation, and the Cyberspace Administration of China jointly issued the “Rules on Pricing Practices for Internet Platforms”（《互联网平台价格行为规则》）. The Rules apply to pricing practices of platform operators and merchants within platforms when selling goods or providing services through internet platforms and other information networks within the territory of the People’s Republic of China. Article 24 of the Rules stipulates that platform operators shall strengthen price self-discipline, establish and improve compliance management systems for pricing activities, enhance online data security management, and process personal information lawfully and in accordance with regulations during pricing activities.

[Reference:

https://mp.weixin.qq.com/s/Nakktn2x6QRF8hWvlfOY1Q ]

2. 关于汽车数据处理5项安全要求检测情况的通报（第四批）发布

中国汽车工业协会、国家计算机网络应急技术处理协调中心、中国信息通信研究院、国家工业信息安全发展研究中心依据《汽车数据安全管理若干规定（试行）》等有关规定，按照企业自愿送检原则，自2025年8月起，组织对汽车制造商汽车产品数据安全合规情况（涵盖车外人脸信息等匿名化处理、座舱数据车内处理、默认不收集座舱数据、处理个人信息显著告知、精度范围适用等5项合规要求）进行检测，本批次共9家企业的43款车型符合汽车数据安全5项合规要求（部分车型不涉及车外人脸信息等匿名化处理要求）。

【参见：

https://mp.weixin.qq.com/s/fbrQb1rwC9qu59-1Z9-PtA】

Announcement on the Results of Testing for Five Automotive Data Processing Security Requirements (Fourth Batch) Released

The China Association of Automobile Manufacturers, the National Computer Network Emergency Technology Coordination Center, the China Academy of Information and Communications Technology, and the National Industrial Information Security Development Research Center, in accordance with the “Several Provisions on Automotive Data Security Management (Trial)” and other relevant regulations, and based on the principle of voluntary testing by enterprises, began organizing compliance inspections of automotive manufacturers' product data security starting in August 2025. These inspections cover five compliance requirements: anonymization of external facial information, in-vehicle processing of cabin data, default non-collection of cabin data, prominent notification of personal information processing, and applicability of accuracy ranges. This batch confirms that 43 models from 9 manufacturers meet the five automotive data security compliance requirements. (Note: Some models are exempt from the anonymization requirement for external facial information).

[Reference:

https://mp.weixin.qq.com/s/fbrQb1rwC9qu59-1Z9-PtA]

3. 全国网安标委发布《网络安全标准实践指南——数据库联网安全要求》与《网络安全标准实践指南——网络数据标签标识技术规范（征求意见稿）》

12月18日，全国网安标委发布《网络安全标准实践指南——数据库联网安全要求》与《网络安全标准实践指南——网络数据标签标识技术规范（征求意见稿）》。其中，《数据库联网安全要求》规定了数据处理者使用数据库系统连接至公共网络场景下的安全技术要求、安全管理要求，适用于指导数据处理者使用数据库系统接入公共网络开展数据处理活动，也可为评估机构提供参考。《网络数据标签标识技术规范》规定了网络数据标签标识的属性格式、生成规则、打标规则、验标规则、日志留存要求、安全防护要求等内容，适用于网络数据处理者组织内部数据管理和跨组织数据流动。

【点击查看《数据库联网安全要求》：

https://mp.weixin.qq.com/s/D_j6ySv4gWV2m7eEMLILjg

点击查看《网络数据标签标识技术规范》：

https://mp.weixin.qq.com/s/D_j6ySv4gWV2m7eEMLILjg】

TC 260 released “Practical Guide to Cybersecurity Standards - Security Requirements for Database Networking”（《网络安全标准实践指南——数据库联网安全要求》） and “Practical Guide to Cybersecurity Standards - Technical Specifications for Network Data Labeling and Identification (Draft for Comment)”《网络安全标准实践指南——网络数据标签标识技术规范（征求意见稿）》

On December 18, the TC 260 released the “Practical Guide to Cybersecurity Standards - Security Requirements for Database Networking” （《网络安全标准实践指南——数据库联网安全要求》） and “Practical Guide to Cybersecurity Standards - Technical Specifications for Network Data Labeling and Identification (Draft for Comment)” 《网络安全标准实践指南——网络数据标签标识技术规范（征求意见稿）》. The “Security Requirements for Database Networking” specifies technical and management security requirements for data processors operating database systems connected to public networks. It guides data processors in conducting data processing activities via database systems accessing public networks and serves as a reference for assessment agencies. The “Technical Specifications for Network Data Labeling and Identification” defines the attribute formats, generation rules, labeling rules, verification rules, log retention requirements, and security protection requirements for network data tag identification. It applies to internal data management and cross-organizational data flow for network data processors.

[Click to view “Security Requirements for Database Networking”:

https://mp.weixin.qq.com/s/D_j6ySv4gWV2m7eEMLILjg

Click to view “Technical Specifications for Network Data Tagging and Identification”:

https://mp.weixin.qq.com/s/D_j6ySv4gWV2m7eEMLILjg]

4. 最高人民法院修订《民事案件案由规定》，新增案由“数据纠纷”

12月17日，最高人民法院发布修改后的《民事案件案由规定》，系对《民事案件案由规定》作出的第三次修正。本次修改，新增了案由“数据纠纷”，并将“数据权属纠纷”“数据合同纠纷”“侵害数据权益纠纷”作为项下三级案由。

【参见：

https://mp.weixin.qq.com/s/IuY_3eqRMLKI9ZkNRzlkuw】

Supreme People’s Court revised “Provisions on the Categories of Civil Cases”, adding “Data Disputes” as a new category

On December 17, the Supreme People’s Court released the amended “Provisions on the Categories of Civil Cases”, marking the third revision to this document. This update introduces the new category “Data Disputes”, with “Data Ownership Disputes” “Data Contract Disputes” and “Data Rights Infringement Disputes” designated as three-tier subcategories under this main category.

[Reference:

https://mp.weixin.qq.com/s/IuY_3eqRMLKI9ZkNRzlkuw]

5. 我国首批L3级自动驾驶车型产品获得准入许可

12月15日，工信部许可两款L3级自动驾驶车型产品，这两款车型产品分别为重庆长安汽车股份有限公司生产的长安牌SC7000AAARBEV型纯电动轿车和北汽蓝谷麦格纳汽车有限公司生产的极狐牌BJ7001A61NBEV型纯电动轿车，这是我国首批L3级自动驾驶车型产品获得准入许可。上述两款车型将分别在重庆、北京的限定区域内开展上路通行试点。

【参见：

https://mp.weixin.qq.com/s/voacedTdbGQQo8TFkbfl4g】

China’s first batch of L3-Level autonomous driving vehicle models receive market access approval

On December 15, the Ministry of Industry and Information Technology(MIIT) granted market access approval to two Level 3 autonomous driving vehicle models. These include the Changan SC7000AAARBEV pure electric sedan produced by Chongqing Changan Automobile Co., Ltd., and the ARCFOX BJ7001A61NBEV pure electric sedan manufactured by BAIC BluePark Magna Automotive Co., Ltd. This marks China’s first batch of Level 3 autonomous driving vehicle models to receive market access approval. The two models will undergo on-road pilot programs in designated areas of Chongqing and Beijing respectively.

[Reference:

https://mp.weixin.qq.com/s/voacedTdbGQQo8TFkbfl4g]

6. 上海通管局通报下架38款侵害用户权益行为的APP（SDK）

12月17日，上海市通信管理局通报下架38款侵害用户权益行为的APP（SDK）。通报称，2025年11月，上海通管局向社会公示了一批存在侵害用户权益行为的APP（SDK）。在规定的整改期限内，经核查复检，尚有38款APP（SDK）未按照要求落实整改，现对上述APP（SDK）采取下架处理。上海通管局将对上述APP（SDK）持续跟踪，视情况进一步采取停止接入、行政处罚、纳入电信业务经营不良名单等后续处理措施。

【参见：

https://mp.weixin.qq.com/s/6vG3y7OPD8C_k9wy9nesEg】

Shanghai Communications Administration removed 38 Apps (SDKs) for violating user rights

On December 17, the Shanghai Communications Administration announced the removal of 38 apps (SDKs) for infringing upon user rights. The notice stated that in November 2025, the Shanghai Communications Administration publicly disclosed a list of apps (SDKs) found to violate user rights. After verification and re-inspection within the stipulated rectification period, 38 apps (SDKs) failed to implement required corrections. These apps (SDKs) are now being removed from app stores. The Shanghai Communications Administration will continue monitoring these apps (SDKs) and may impose further measures including access suspension, administrative penalties, or inclusion in the telecom business blacklist as circumstances warrant.

[Reference:

https://mp.weixin.qq.com/s/6vG3y7OPD8C_k9wy9nesEg]

7. 一网站平台未建立网络安全制度和内容审核机制被处罚

近日，荣昌区网信办调查发现，某网站运营者未建立网络安全制度和内容审核机制，提供的“AI对话”功能，生成含有法律、行政法规禁止的内容，未采取有效措施停止法律法规禁止发布的信息内容，违反《中华人民共和国网络安全法》《生成式人工智能服务管理暂行办法》等法律法规。荣昌区网信办依法依规责令其限期整改，对该网站负责人给予警告的行政处罚。

【参见：

https://mp.weixin.qq.com/s/9yqHH7xpjz5YJHQCf1w3Xg】

A website platform penalized for failing to establish cybersecurity system and content review mechanism

Recently, the Rongchang District Cyberspace Administration Office investigated and discovered that the operator of a certain website had failed to establish cybersecurity systems and content review mechanisms. The “AI dialogue” feature provided by the website generated content prohibited by laws and administrative regulations, and the operator failed to take effective measures to stop the dissemination of information prohibited by laws and regulations. This violated the Cybersecurity Law of the People's Republic of China, the Interim Measures for the Administration of Generative Artificial Intelligence Services, and other laws and regulations. The Rongchang District Cyberspace Administration Office lawfully ordered the operator to rectify within a specified timeframe and imposed an administrative penalty of a warning on the website's responsible person.

[Reference:

https://mp.weixin.qq.com/s/9yqHH7xpjz5YJHQCf1w3Xg]

8. 新疆首例AI“一键成图”著作权案件判决生效

2025年9月，乌鲁木齐市天山区人民法院对一起涉及AI生成图片著作权纠纷的案件作出判决，认定由AI软件“一键生成”的图片不构成著作权法意义上的作品，驳回原告全部诉讼请求。该案系新疆首例就AI生成内容著作权归属与保护问题作出司法认定的案件，对厘清人工智能生成物的法律属性具有重要的示范意义。

【参见：

https://mp.weixin.qq.com/s/_R8QXwwwBElNxinp1Je-4w】

The verdict of the first AI "one click mapping" copyright case in Xinjiang has come into effect

On September 2025, the Tianshan District People's Court of Urumqi made a judgment on a case involving a copyright dispute over AI generated images, determining that images generated by AI software with "one click" do not constitute works in the sense of copyright law, and rejecting all of the plaintiff's claims. This case is the first judicial determination in Xinjiang regarding the ownership and protection of copyright for AI generated content, and has important demonstrative significance for clarifying the legal attributes of AI generated products.

[Reference:

1. 美国纽约州通过《负责任人工智能安全与教育法》

12月19日，美国纽约州通过《负责任人工智能安全与教育法》（Responsible AI Safety and Education Act，简称“RAISE Act”）。该法案适用于全部或部分在纽约州开发、部署或运营的人工智能前沿模型，规定了开发商在训练和部署前沿模型时的透明度要求，包括制定安全计划和披露安全事故等。立法理由强调，法案仅针对少数几种极其严重风险的人工智能，并不会要求大多数人工智能公司对其现有做法做出太多改变。相反，它只确保任何公司都不会出于经济动机减损或放弃其安全计划。同时，该法案并没有试图解决人工智能的每一个问题：关于偏见、真实性、劳动力影响等重要问题可通过且应通过额外的立法来处理。本法案侧重于可能造成超过10亿美元损失的严重风险。

【参见：

https://www.nysenate.gov/legislation/bills/2025/S6953/amendment/B】

New York State passed the “Responsible AI Safety and Education Act”

On December 19, New York State passed the “Responsible AI Safety and Education Act” (“RAISE Act”). This legislation applies to all frontier models developed, deployed, or operated wholly or partially within New York State. It mandates transparency requirements for developers when training and deploying such models, including establishing safety plans and disclosing safety incidents. The legislative purposes emphasizes that the bill targets only a small set of very severe risks and will not require many changes from what the vast majority of AI companies are currently doing. instead, it will simply ensure that no company has an economic incentive to cut corners or abandon its safety plan. Notably, this bill does not attempt to tackle every issue with AI: important questions about bias, authenticity, workforce impacts, and other concerns can and should be handled with additional legislation. The Act focuses on severe risks that could cause over $1 billion.

[Reference:

https://www.nysenate.gov/legislation/bills/2025/S6953/amendment/B]

2. 欧盟发布《生成式人工智能标记和标签实践准则（草案）》

12月17日，欧盟委员会发布《生成式人工智能标记和标签实践准则（草案）》（the first draft of the Code of Practice on marking and labelling of AI-generated content）。根据《人工智能法案》第50条的规定，提供商有义务以机器可读格式标记人工智能生成或操纵的内容，出于专业用途部署生成式人工智能系统的用户有义务明确标识涉及公共利益的深度伪造和人工智能文本发布内容。为帮助提供商与部署者满足这些要求，欧盟委员会推动制定了一份由独立专家起草的自愿性准则，该准则将早于相关规则正式适用前出台。该准则草案包含两部分：第一部分涵盖了标记和检测人工智能内容的规则，适用于生成式人工智能系统的提供者。第二部分涵盖了在公共利益问题上标识深度伪造和特定的人工智能生成或操纵的文本，适用于生成式人工智能系统的部署者。

【参见：

https://digital-strategy.ec.europa.eu/en/news/commission-publishes-first-draft-code-practice-marking-and-labelling-ai-generated-content】

EU released the first draft of the “Code of Practice on marking and labelling of AI-generated content”

On December 17, the European Commission released the first draft of the “Code of Practice on marking and labelling of AI-generated content”. Article 50 of the AI Act includes obligations for providers to mark AI-generated or manipulated content in a machine-readable format, and for users who deploy generative AI systems for professional purposes to clearly label deepfakes and AI-text publications on matters of public interest. To help providers and deployers meet these requirements, the Commission is facilitating the development of a voluntary Code of Practice drafted by independent experts, ahead of these rules entering into application. The draft Code of Practice consists of two sections. The first section covers rules for marking and detecting AI content, applicable to providers of generative AI systems. The second section covers labelling deepfakes and certain AI-generated or manipulated text on matters of public interest and is applicable to deployers of generative AI systems.

[Reference: 
 

https://digital-strategy.ec.europa.eu/en/news/commission-publishes-first-draft-code-practice-marking-and-labelling-ai-generated-content]