每周数据法律资讯 Data Law Weekly（20260330—20260405）

1. 国家网信办就《小型个人信息处理者个人信息保护简化措施规定（征求意见稿）》公开征求意见

4月3日，国家网信办发布《小型个人信息处理者个人信息保护简化措施规定（征求意见稿）》，明确小型个人信息处理者指处理不满10万人个人信息的主体，简化告知义务、个人信息处理规则、合规审计、影响评估、数据出境等要求，明确不予处罚及从轻减轻处罚情形，助力中小微企业降低合规成本。

【参见：

The Cyberspace Administration of China Seeks Comments on the ‘Provisions on Simplified Measures for Personal Information Protection by Small-Scale Personal Information Processors (Draft for Comment)’

On April 3, the Cyberspace Administration of China (“CAC”) issued the ‘Provisions on Simplified Measures for Personal Information Protection by Small-Scale Personal Information Processors (Draft for Comment)’, defining small-scale personal information processors as entities processing the personal information of fewer than 100,000 individuals. The draft simplifies requirements regarding notification obligations, personal information processing rules, compliance audits, impact assessments and cross-border data transfers, and clarifies circumstances under which penalties will not be imposed or will be mitigated, thereby helping small, medium and micro enterprises reduce compliance costs.

[Reference: 

2. 国家网信办就《数字虚拟人信息服务管理办法（征求意见稿）》公开征求意见

4月3日，国家网信办发布《数字虚拟人信息服务管理办法（征求意见稿）》，通过数字虚拟人向中华人民共和国境内公众提供互联网信息服务适用该办法，《办法》明确使用自然人敏感个人信息建模须取得单独同意；不得向未成年人提供虚拟亲属、虚拟伴侣等虚拟亲密关系，诱导过度消费、诱导信教等的数字虚拟人服务；数字虚拟人展示区域需全程持续显示含有“数字人”字样的显著提示标识。

【参见：

The CAC Seeks Public Comments on the ‘Draft Measures for the Administration of Digital Avatar Information Services’

On April 3, the CAC released the “Draft Measures for the Administration of Digital Avatar Information Service.” These measures apply to the provision of internet information services to the public within the territory of the People's Republic of China via digital avatars. The measures stipulate that separate consent must be obtained when modeling using sensitive personal information of natural persons; Digital avatar services that provide virtual intimate relationships—such as virtual relatives or virtual partners—to minors, or that induce excessive consumption or religious belief, are prohibited; areas where digital avatars are displayed must continuously show a prominent warning label containing the words “digital avatar” throughout the entire duration. 

[Reference: 
 

https://mp.weixin.qq.com/s/EHpjg2sfth0W7OE-v6hq9g]

3. 国家数据局就《数据产权登记工作指引（试行）（征求意见稿）》公开征求意见

4月3日，国家数据局综合司发布《数据产权登记工作指引（试行）（公开征求意见稿）》，明确数据产权包括持有权、使用权、经营权，建立全国统一登记平台与登记机构名录，规范初次、转让、变更、续期、注销五类登记流程，明确登记效力与全国互认规则，助力构建数据基础制度与一体化数据市场。

【参见：

https://mp.weixin.qq.com/s/p0oHElJfC3ERYNYxz3ggkg】

National Data Administration Seeks Public Comments on the ‘Guidelines for Data Property Rights Registration (Trial) (Draft for Public Comment)’

On April 3, the General Department of the National Data Administration released the ‘Guidelines for Data Property Rights Registration (Trial) (Draft for Public Comment)’, clarifying that data property rights encompass ownership, usage rights and operational rights. The guidelines establish a unified national registration platform and a directory of registration authorities, standardise five categories of registration processes—initial registration, transfer, amendment, renewal and cancellation—and clarify the legal effect of registration and rules for mutual recognition nationwide, thereby supporting the development of a foundational data system and an integrated data market. 

[Reference: 

https://mp.weixin.qq.com/s/p0oHElJfC3ERYNYxz3ggkg]

4. 中央网信办、工业和信息化部、公安部部署开展2026年个人信息保护系列专项行动

4月2日，中央网信办、工业和信息化部、公安部联合部署2026年个人信息保护专项行动，聚焦App/SDK以及互联网广告、教育、交通、医疗健康、金融等重点领域，重点整治超范围收集个人信息、强制授权、未提供账户注销渠道、违规人脸识别等突出问题，严厉打击侵犯公民个人信息犯罪。

【参见：

The CAC, the Ministry of Industry and Information Technology, and the Ministry of Public Security Launch a Series of Special Campaigns on Personal Information Protection for 2026

On April 2, the CAC, the Ministry of Industry and Information Technology (“MIIT”), and the Ministry of Public Security jointly launched the 2026 Personal Information Protection Special Campaign. The campaign focuses on apps/SDKs and key sectors such as internet advertising, education, transportation, healthcare, and finance. It prioritizes addressing prominent issues such as the collection of data beyond the scope of consent, forced authorisation, failure to provide account deletion channels, and non-compliant facial recognition, whilst rigorously cracking down on crimes involving the infringement of citizens’ personal information.

[Reference:

https://mp.weixin.qq.com/s/vyyzdKV5AqvumivAsJsoKg]
 

5. 工信部等十部门印发《人工智能科技伦理审查与服务办法（试行）》

4月2日，工信部等十部门印发《人工智能科技伦理审查与服务办法（试行）》，《办法》规定开展特定人工智能科技活动的，应当申请开展科技伦理审查，科技伦理审查重点关注人类福祉、公平公正、可控可信、透明可解释、责任可追溯、隐私保护等方面。开展高风险的人工智能科技活动的，还需要进一步申请专家复核。

【参见：

https://www.miit.gov.cn/jgsj/kjs/wjfb/art/2026/art_2995f16b28504ddcbb604e918eb15759.html】

The MIIT and Nine Other Departments Issue the ‘Measures for the Review and Services of Artificial Intelligence Technology Ethics (Trial)’

On April 2, the MIIT and nine other departments issued the “Measures for the Review and Services of Artificial Intelligence Technology Ethics (Trial).” The Measures stipulate that entities conducting specific artificial intelligence technology activities must apply for a technology ethics review. Such reviews focus on aspects including human well-being, fairness and justice, controllability and trustworthiness, transparency and explainability, traceability of responsibility, and privacy protection. Entities conducting high-risk artificial intelligence technology activities must also apply for an expert review.

[Reference:

https://www.miit.gov.cn/jgsj/kjs/wjfb/art/2026/art_2995f16b28504ddcbb604e918eb15759.html]

6. 国家网络安全通报中心通报37款违法违规收集使用个人信息的移动应用

4月2日，国家网络安全通报中心通报37款违法违规收集使用个人信息的移动应用，该等移动应用所涉问题主要包括在未公开收集规则、超授权范围收集、征得用户同意前就开始收集个人信息、未提供注销账户的途径和方式、提前要求用户打开非当前功能所需的可收集个人信息权限等。

【参见：

https://mp.weixin.qq.com/s/jR6AqawzJNpVliCiocJLnQ】

National Cybersecurity Information Center Identifies 37 Mobile Apps That Illegally Collect and Use Personal Information

On April 2, the National Cybersecurity Information Center identified 37 mobile apps that illegally collect and use personal information. The issues associated with these apps primarily include failing to disclose data collection rules, collecting data beyond authorized scope, beginning to collect personal information before obtaining user consent, failing to provide methods for account deletion, and prematurely requiring users to enable permissions for collecting personal information that are not necessary for current functions.

[Reference:

https://mp.weixin.qq.com/s/jR6AqawzJNpVliCiocJLnQ]

7. 全国数标委就《数据基础术语（征求意见稿）》等22项国家标准征求意见

4月1日，全国数据标准化技术委员会发布22项国家标准征求意见稿，包括《数据基础术语》、《数据匿名化流通实施及评估指南》、《数据利用管理技术要求》等。

【参见：

https://mp.weixin.qq.com/s/T4JrCE_GCO1wAiu9f9TBgA】

The National Technical Committee 609 on Data of Standardization Administration of China Seeks Comments on 22 National Standards, Including “Data: Basic Terminology (Draft for Comment)”

On April 1, the National Technical Committee 609 on Data of Standardization Administration of China released drafts for comment on 22 national standards, including “Data: Basic Terminology”, “Guidelines for the Implementation and Evaluation of Data Anonymization and Circulation”, and “Technical Requirements for Data Utilization Management”.

[Reference:

8. 《证券期货经营机构数据出境安全自评估规范》公开征求意见

3月31日，中证数据牵头起草的金融行业标准《证券期货经营机构数据出境安全自评估规范》公开征求意见。该文件规定了证券期货经营机构开展数据出境安全自评估的前提条件、工作流程及主要内容，旨在聚焦证券期货业数据出境应用场景，在遵循相关国家法律法规及行业监管要求的前提下，明确评估要点和操作细则，推动提升行业经营机构数据出境安全自评估的规范化和标准化水平。

【参见：
 

https://www.csisc.cn/zbscbzw/c100285/202603/c16fd88f319a49b89030e87fbbbda24b.shtml?sessionid=】

Public Consultation on the ‘Specifications for Self-Assessment of Data Cross-Border Transfer Security by Securities and Futures Institutions’

On March 31, the financial industry standard “Specifications for Security Self-Assessment of Data Transfer Abroad by Securities and Futures Firms,” led by China Securities Data, was released for public consultation. This document specifies the prerequisites, workflows, and key components for securities and futures operating institutions to conduct self-assessments of data cross-border transfer security. It aims to focus on data cross-border transfer scenarios in the securities and futures industry, clarify assessment criteria and operational guidelines while adhering to relevant national laws, regulations, and industry regulatory requirements, and promote the standardization and normalization of self-assessments of data cross-border transfer security among industry institutions. 

[Reference:

https://www.csisc.cn/zbscbzw/c100285/202603/c16fd88f319a49b89030e87fbbbda24b.shtml?sessionid= ]

9. 修订版《通信短信息服务管理规定》公布，自5月1日起施行

近日，工信部公布修订版《通信短信息服务管理规定》，自2026年5月1日起施行，管理规定要求通信短信息服务提供者传输商业性通信短信息的，应当要求通信短信息发送方提供通信短信息接收方同意或者请求接收商业性通信短信息的承诺或者证明材料。通信短信息服务提供者应当建立健全用户信息保护制度，采取技术措施和其他必要措施，确保用户信息安全。

【参见：

https://www.miit.gov.cn/zcfg/xxtxl/art/2026/art_20183ad07ad740f7b59bb5b1212df241.html】

Revised “Regulations on the Administration of Short Message Services” Published, Effective May 1

Recently, the MIIT published the revised “Regulations on the Administration of Short Message Services,” which will take effect on May 1, 2026. The regulations stipulate that providers of short message services transmitting commercial short messages must require the sender to provide proof or documentation demonstrating that the recipient has consented to or requested the receipt of such commercial messages. Short message service providers shall establish and improve user information protection systems and take technical and other necessary measures to ensure the security of user information. 

[Reference: 

https://www.miit.gov.cn/zcfg/xxtxl/art/2026/art_20183ad07ad740f7b59bb5b1212df241.html]

10. 全国网络安全标准化技术委员会发布《工业企业数据安全能力成熟度模型》

3月31日，全国网络安全标准化技术委员会发布《工业企业数据安全能力成熟度模型》，提出工业数据全生命周期安全与通用安全成熟度等级要求，指导工业企业开展数据安全能力建设与等级评估。

【参见：

The TC260 Releases the ‘Data Security Capability Maturity Model for Industrial Enterprises’

On March 31, the TC260 released the ‘Data Security Capability Maturity Model for Industrial Enterprises’, setting out requirements for the security of industrial data throughout its entire lifecycle and general security maturity levels, to guide industrial enterprises in building data security capabilities and conducting level assessments.

[Reference: 

11. 全国网络安全标准化技术委员会就OpenClaw类智能体部署使用安全指引征求意见

3月31日，全国网安标委就《网络安全标准实践指南——OpenClaw类智能体部署使用安全指引（征求意见稿）》征求意见。该文件给出了个人使用者部署OpenClaw类智能体的安全指引，提出了组织对内部人员部署使用OpenClaw类智能体进行管理的安全措施指引。

【参见：

The TC260 Seeks Comments on Security Guidelines for the Deployment and Use of OpenClaw-type Agents

On March 31, the TC260 solicited public comments on the “Cybersecurity Standards Practice Guide—Security Guidelines for the Deployment and Use of OpenClaw-type Agents (Draft for Comment)”. The document provides security guidelines for individual users deploying OpenClaw-type agents and outlines security measures for organizations to manage the deployment and use of such agents by their internal personnel.

[Reference:

12. 国家网络安全通报中心通报71款违法违规收集使用个人信息的移动应用

3月31日，国家网络安全通报中心通报71款违法违规收集使用个人信息的移动应用，该等移动应用所涉主要问题包括在App首次运行时未通过弹窗等明显方式提示用户阅读隐私政策等收集使用规则；隐私政策未逐一列出App（包括委托的第三方或嵌入的第三方代码、插件）收集使用个人信息的目的、方式、范围等；实现相同目的或者达到同等业务要求，存在其他非人脸识别技术方式的，将人脸识别技术作为唯一验证方式等。

【参见：
 

https://mp.weixin.qq.com/s/aI36S5HCT7fUFiQBV6rndw】

National Cybersecurity Reporting Center Identifies 71 Mobile Apps for Illegal Collection and Use of Personal Information

On March 31, the National Cybersecurity Reporting Center identified 71 mobile apps for illegally collecting and using personal information. The primary issues with these apps include failing to prompt users to read privacy policies and other collection and usage rules through prominent means, such as pop-up windows, when the app is first launched; failure to list in detail within the privacy policy the purposes, methods, and scope of personal information collection and use by the app (including by commissioned third parties or embedded third-party code and plugins); and using facial recognition technology as the sole verification method when other non-facial recognition technologies are available to achieve the same purpose or meet equivalent business requirements.

[Reference:

https://mp.weixin.qq.com/s/aI36S5HCT7fUFiQBV6rndw]

13. 市场监管总局发布关于进一步贯彻实施《中华人民共和国反不正当竞争法》的通知

3月30日，国家市场监督管理总局发布关于进一步贯彻实施《中华人民共和国反不正当竞争法》的通知。通知指出要强化网络不正当竞争行为监管，运用好禁止侵害数据权益的专款规定、商业秘密保护规则，准确识别数据不正当竞争行为，平衡好数据保护和数据利用的关系，加大对人工智能等新兴产业的保护力度，有效保护数据要素各参与方的合法权益，维护数据市场竞争秩序。

【参见：

https://www.samr.gov.cn/zw/zfxxgk/fdzdgknr/jjjzs/art/2026/art_84f7d42f9e474529bd4c369e84721300.html】

State Administration for Market Regulation Issues Notice on Further Implementing the “Anti-Unfair Competition Law of the People's Republic of China”

On March 30, the State Administration for Market Regulation issued a notice regarding the further implementation of the Anti-Unfair Competition Law of the People’s Republic of China. The notice emphasizes the need to strengthen supervision of unfair competition online, effectively apply provisions prohibiting the infringement of data rights and rules for the protection of trade secrets, accurately identify acts of unfair competition involving data, strike a balance between data protection and data utilization, enhance protection for emerging industries such as artificial intelligence, effectively safeguard the legitimate rights and interests of all parties involved in data as a production factor, and maintain the competitive order of the data market.

[Reference: 
 

https://www.samr.gov.cn/zw/zfxxgk/fdzdgknr/jjjzs/art/2026/art_84f7d42f9e474529bd4c369e84721300.html]

14. 北京互联网法院：AI生成非免责事由，未尽核实义务侵害名誉权应担责

3月30日，北京互联网法院审结一起AI生成内容名誉权侵权案。法院明确，在使用、传播及发布AI生成内容的过程中，内容使用者、发布者及相关运营主体均负有不可推卸的主体责任与法定核实义务，不得以“内容由AI生成”作为免责借口，逃避对信息真实性、合法性、合规性的审慎审核责任。

【参见：

Beijing Internet Court: AI Generation Is Not a Ground for Exemption; Failure to Fulfil Verification Obligations Constitutes Defamation and Entails Liability

On March 30, the Beijing Internet Court concluded a case involving infringement of the right to reputation through AI-generated content. The court made it clear that in the process of using, disseminating, and publishing AI-generated content, content users, publishers, and relevant operators all bear inescapable primary responsibility and a statutory duty to verify the content; they may not use the fact that “the content was generated by AI” as an excuse to evade their duty to exercise due diligence in verifying the authenticity, legality, and compliance of the information. 

[Reference: 

15. 北京市发布数据跨境流动便利化综合配套改革3.0版

近日，北京市发布数据跨境流动便利化综合配套改革3.0版，提出进一步优化数据跨境流动政策应用，包括全面推进负面清单推广应用，畅通重要数据识别认定机制等重点任务。聚焦医疗健康、人工智能、智能网联汽车、贸易物流、科技金融及其他新兴领域，打造重点行业数据跨境流动利用标杆。

【参见：

Beijing Releases Version 3.0 of Comprehensive Supporting Reforms for the Facilitation of Cross-border Data Flow

Recently, Beijing released Version 3.0 of its Comprehensive Reform Plan for Facilitating Cross-Border Data Flow, proposing to further optimize the implementation of cross-border data flow policies. Key tasks include fully promoting the adoption of the negative list and streamlining the mechanism for identifying and certifying critical data. The plan focuses on healthcare, artificial intelligence, intelligent connected vehicles, trade and logistics, fintech, and other emerging sectors to establish benchmarks for the utilization of cross-border data in key industries.

[Reference:

1. 欧盟更新人工智能法FAQ，明确AI智能体监管适用规则

近日，欧盟委员会更新AI Act常见问题官方解答，明确《人工智能法》中对“人工智能系统”的定义以及对“通用人工智能（GPAI）模型”的定义已足以涵盖AI智能体，《人工智能法》中适用于人工智能系统和通用人工智能模型的规则同样适用于AI智能体。同时，问答指出委员会拟通过“Digital Omnibus”修订《人工智能法》，以解决实施阶段的合规难点并推动更简化、可操作、促进创新的监管框架，核心措施包括延后高风险规则适用并与标准等支持工具挂钩、降低中小企业合规负担、强化AI Office集中监管，以及扩大监管沙盒等合规支持工具。

【参见：

https://ai-act-service-desk.ec.europa.eu/en/faq】

EU Updates AI Act FAQs, Clarifying the Regulatory Treatment of AI Agents

Recently, the European Commission updated the official FAQs of the Artificial Intelligence Act (AI Act), clarifying that the definitions of “AI systems” and “general-purpose AI (GPAI) models” under the Act are sufficiently broad to cover AI agents. Accordingly, the rules applicable to AI systems and GPAI models under the AI Act also apply to AI agents. The FAQs further note that the Commission intends to amend the AI Act through the “Digital Omnibus” initiative to address implementation challenges and promote a more simplified, operational, and innovation-friendly regulatory framework. Key measures include delaying the application of high-risk rules and linking them to the availability of standards and support tools, reducing compliance burdens for SMEs, strengthening the centralised oversight role of the AI Office, and expanding compliance support tools such as regulatory sandboxes.

[Reference: 

https://ai-act-service-desk.ec.europa.eu/en/faq]

2. 纽约州州长签署修订版《负责任的人工智能安全与教育法案》（RAISE Act）

近日，纽约州州长签署纽约州参议院法案S8828，对此前已通过的《负责任的人工智能安全与教育法案》(RAISE Act) 进行协商性修订（chapter amendment）。修订后的法案聚焦对“前沿人工智能模型”（frontier AI models）开发者的监管，要求其建立并披露安全治理框架，在发生可能造成重大危害（critical harm）的安全事件后72小时内向监管机构报告。同时，法案在纽约州金融服务部（DFS）下设立专门监督办公室，并赋予州总检察长民事执法权。整体来看，该修订版进一步强化了以透明度、风险治理及事件报告为核心的AI监管路径，并被认为在制度设计上接近加州相关立法方案。

【参见：

https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-require-ai-frameworks-ai-frontier-models?utm_source】

New York Governor Signs Amended ‘Responsible AI Safety and Education Act’ (RAISE Act) 

Recently, the Governor of New York signed Senate Bill S8828, a negotiated chapter amendment to the previously enacted RAISE Act. The amended law focuses on regulating developers of frontier AI models, requiring them to establish and disclose safety governance frameworks and to report critical harm incidents to regulators within 72 hours. It also establishes a dedicated oversight office within the New York State Department of Financial Services (DFS) and grants enforcement authority to the Attorney General. Overall, the amendment strengthens a regulatory approach centered on transparency, risk governance, and incident reporting, and is viewed as aligning more closely with emerging California AI legislative frameworks.

[Reference: 

https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-require-ai-frameworks-ai-frontier-models?utm_source]