每周数据法律资讯 Data Law Weekly（20260323—20260329）

1.  第二批个人信息保护合规审计专业机构名单公布

3月26日，中央网信办数据与技术保障中心发布通过个人信息保护合规审计服务认证的专业机构名单（第二批）。本批次共14家机构获个人信息保护合规审计服务认证证书。

【具体名单见：

https://mp.weixin.qq.com/s/7954rkJ863q5Kw1UXdJIHA】

List of Professional Organizations for Personal Information Protection Compliance Audits (Second Batch) Announced

On March 26, the Data and Technology Support Center of the Cyberspace Administration of China released the list of professional organizations that have passed the certification for personal information protection compliance audit services (second batch). A total of 14 organizations received the certification for personal information protection compliance audit services in this batch.

[For the full list, see:

https://mp.weixin.qq.com/s/7954rkJ863q5Kw1UXdJIHA]

2. 《汽车数据安全保障要求》等2项汽车行业推荐性国家标准报批公示

3月23日，工业和信息化部科技司发布公示，就《汽车数据安全保障要求》《汽车安全漏洞分类分级评价》两项汽车行业推荐性国家标准公开征求报批意见。其中《汽车数据安全保障要求》明确了汽车数据全生命周期管理、安全监测与处置等要求，适用于所有汽车数据处理者；《汽车安全漏洞分类分级评价》确立了漏洞分类分级原则和评价指标体系，为汽车漏洞管理提供技术规范。

【参见：

http://www.bzw.com.cn/page/standardpublicitydetail/53】

Public Notice on the Submission for Approval of Two Recommended National Standards for the Automotive Industry, Including the ‘Requirements for vehicle data security assurance’

On March 23, the Department of Science and Technology of the Ministry of Industry and Information Technology issued a public notice soliciting comments on the approval of two recommended national standards for the automotive industry: the ‘Requirements for vehicle data security assurance’ and the ‘Evaluation for categorization and classification of vehicle security vulnerability’. The‘Requirements for vehicle data security assurance’ specifies requirements for the full lifecycle management, security monitoring and response of automotive data, and applies to all automotive data processors; The‘Evaluation for categorization and classification of vehicle security vulnerability’ establishes principles for the classification and grading of vulnerabilities, as well as an evaluation indicator system, providing technical specifications for the management of automotive vulnerabilities.

[Reference:

http://www.bzw.com.cn/page/standardpublicitydetail/53]

3. 《促进和规范数据跨境流动规定》实施两周年，数据出境安全管理工作再上新台阶

3月23日，国家网信办通报《促进和规范数据跨境流动规定》实施两周年工作成效。两年来，数据出境安全管理制度体系持续完善，相继出台个人信息出境认证、金融业数据跨境、汽车数据出境等配套指引，多地开展预评估试点与数据出境负面清单管理，企业合规成本显著降低、跨境效率有效提升。

【参见：

https://mp.weixin.qq.com/s/35rC2XL0MRg03JlZai9s0g】

Two Years Since the Implementation of the ‘Provisions on Promoting and Regulating Cross-border Data Flow’: Data Outbound Security Management Reaches New Heights

On March 23, the Cyberspace Administration of China reported on the achievements of the ‘Provisions on Promoting and Regulating Cross-border Data Flow’ two years after their implementation. Over the past two years, the regulatory framework for the security of data outbound transfers has been continuously refined, with supporting guidelines successively issued on the certification of personal data outbound transfers, cross-border data flows in the financial sector, and automotive data outbound transfers. Many regions have launched pilot schemes for pre-assessment and implemented negative list management for data outbound transfers, resulting in a significant reduction in compliance costs for enterprises and an effective improvement in cross-border efficiency.

[Reference:

https://mp.weixin.qq.com/s/35rC2XL0MRg03JlZai9s0g]

4. 迪奥数据泄露案行政处罚决定书公布

近日，克丽丝汀迪奥商业（上海）有限公司数据泄露案的行政处罚决定书正式披露，上海市公安局静安分局认定该公司在数据传输中未采取必要保护措施，依据《个人信息保护法》对其作出警告并责令改正的处罚。经查，该公司此前还存在违规向境外总部传输用户信息、未取得用户单独同意等问题，但本次处罚仅针对数据传输安全措施瑕疵。

【参见：

https://mp.weixin.qq.com/s/XzNghcFQvOxiE28gIN5I3Q】

Administrative Penalty Decision in the Dior Data Breach Case Published

Recently, the administrative penalty decision regarding the data breach case involving Christian Dior Commercial (Shanghai) Co., Ltd. was officially disclosed. The Jing'an Branch of the Shanghai Public Security Bureau determined that the company had failed to implement necessary protective measures during data transmission, and pursuant to the Personal Information Protection Law, issued a warning and ordered the company to rectify the situation. Investigations revealed that the company had previously been found to have engaged in a number of violations, including the unauthorised transfer of user information to its overseas headquarters, failure to obtain individual user consent. However, as this penalty focused solely on deficiencies in data transmission security measures.

5. 无锡某公司因未按规定开展AIGC安全评估被约谈

近期，无锡市网信办发现当地一家公司通过API接口调用已备案大模型能力提供生成式人工智能服务，未履行应用登记手续，也未按国家规定开展安全评估，存在网络安全风险。网信部门依据《生成式人工智能服务管理暂行办法》等法规对该公司负责人进行约谈，责令其立即下线相关服务，并按要求完成安全评估程序。

【参见：

https://mp.weixin.qq.com/s/YwJirDtVPsWoST0rU2Ysng】

A Wuxi Company Summoned for Failing to Conduct AIGC Safety Assessment as Required

Recently, Wuxi Cyberspace Administration discovered that a local company was providing generative AI services by calling on the capabilities of a registered large language model via an API interface. The company had failed to complete the required application registration procedures and had not conducted security assessments in accordance with national regulations, thereby posing cybersecurity risks. The cyber administration department, in accordance with regulations such as the‘Interim Measures for the Management of Generative Artificial Intelligence Services’, summoned the company’s responsible person for a meeting, ordering them to immediately take the relevant services offline and complete the security assessment procedures as required.

[Reference:

https://mp.weixin.qq.com/s/YwJirDtVPsWoST0rU2Ysng]

1. 欧洲议会就简化人工智能规则的提案达成一致

3月26日，欧洲议会通过了关于修订《人工智能法案》的简化（“综合”）提案的立场。该提案将推迟针对高风险人工智能（AI）系统的某些规则的适用，以确保协助企业实施的指导方针和标准已准备就绪。提案同时将提高灵活性并采取支持中小企业的措施。

【参见：

https://www.europarl.europa.eu/news/en/press-room/20260323IPR38829/artificial-intelligence-act-delayed-application-ban-on-nudifier-apps】

European Parliament Agreed on Proposals to Simplify Artificial Intelligence Rules

On March 26, the European Parliament adopted its position on a simplification (“omnibus”) proposal amending the Artificial Intelligence Act. The proposal would delay the application of certain rules on high-risk artificial intelligence (AI) systems, to ensure that guidance and standards to help companies with implementation are ready. The proposal will also increase flexibility and introduce measures to support small mid-cap enterprises.

[Reference:

https://www.europarl.europa.eu/news/en/press-room/20260323IPR38829/artificial-intelligence-act-delayed-application-ban-on-nudifier-apps]

2. 意大利法院撤销对OpenAI就ChatGPT开出的1500万欧元罚款

3月19日，罗马法院撤销了意大利数据保护机构此前对OpenAI作出的1500万欧元罚款。该罚款由意大利数据保护机构于2024年12月作出，相关调查认为，OpenAI在ChatGPT 相关个人数据处理中存在违法问题，包括在缺乏充分法律依据的情况下处理用户个人数据用于训练模型、违反透明度和信息告知义务，以及年龄核验机制不足。法院尚未公布撤销罚款的具体理由。

【参见：

https://www.reuters.com/technology/italian-court-scraps-15-million-euro-privacy-watchdog-fine-chatgpt-maker-openai-2026-03-19/?utm_source=chatgpt.com】

Italian Court Scraps 15-million-euro Privacy Watchdog Fine on ChatGPT-maker OpenAI

On March 19, a Rome court annulled a 15-million-euro fine previously imposed on OpenAI by Italy’s data protection authority. The fine had been issued in December 2024 after the authority concluded that OpenAI had engaged in unlawful personal data processing in connection with ChatGPT, including processing users’ personal data to train the model without an adequate legal basis, breaching transparency and information obligations, and failing to implement an adequate age-verification mechanism. The court did not release its reasoning for the ruling.

[Reference:

https://www.reuters.com/technology/italian-court-scraps-15-million-euro-privacy-watchdog-fine-chatgpt-maker-openai-2026-03-19/?utm_source=chatgpt.com]