每周数据法律资讯 Data Law Weekly（20260518—20260524）

1.国家发改委谋划出台加快“人工智能+”落地的配套文件，进一步加大要素保障

5月22日，国家发改委召开新闻发布会，披露正在谋划出台加快“人工智能+”落地的配套文件，进一步加大要素保障。同时，还将持续推动央国企开放高价值应用场景，面向各行业领域和各地方打造人工智能标杆应用，加快引导人工智能融入生产、经营、管理等各方面各环节。关于安全监管工作，正在开展人工智能立法研究，强化安全治理能力建设。

【参见：

https://www.ndrc.gov.cn/xwdt/wszb/202605xwfbh/】

NDRC Plans Supporting Policies to Accelerate the Implementation of the “AI+” Initiative and Further Strengthen Factor Support

On May 22, the National Development and Reform Commission held a press conference and disclosed that it is planning supporting policy documents to accelerate the implementation of the “AI+” initiative and further strengthen factor support. The NDRC also stated that it will continue promoting the opening of high-value application scenarios by central state-owned enterprises and local state-owned enterprises, foster model AI application scenarios across industries and regions, and accelerate the integration of AI into production, operations, management, and other business processes. Regarding safety supervision, research on AI legislation is underway to strengthen the development of safety governance capabilities. 

[Reference:

https://www.ndrc.gov.cn/xwdt/wszb/202605xwfbh/]

2.工信部通报2026年第三批侵害用户权益APP及SDK

5月21日，工信部通报本年度第三批侵害用户权益APP及SDK（共计31款），违规行为集中体现在信息窗口点击乱跳转、违规收集个人信息、APP强制、频繁、过度索取权限及违规提供自动续费服务等。工信部责令相关运营主体按照规定整改，整改不到位将依法采取下架、处罚等处置措施。

【参见：

https://mp.weixin.qq.com/s/pI6fsJpm6O9u7Icntw8guA】

MIIT Announces the Third Batch of Apps and SDKs Infringing User Rights in 2026

On May 21, the MIIT announced the third batch of apps and SDKs infringing user rights in 2026, involving a total of 31 applications and SDKs. The violations mainly included misleading pop-up redirects, unlawful collection of personal information, coercive, frequent, or excessive permission requests, and non-compliant auto-renewal services. MIIT ordered the relevant operators to complete rectification in accordance with applicable requirements. Failure to rectify the issues may result in penalties, including app removal and administrative sanctions in accordance with the law.

[Reference:

https://mp.weixin.qq.com/s/pI6fsJpm6O9u7Icntw8guA]

3.全国网安标委发布《人工智能应用伦理安全指引1.0》

5月19日，全国网络安全标准化技术委员会发布《人工智能应用伦理安全指引1.0》。指引给出了人工智能应用伦理安全影响，即对人类主导权、公共秩序、个体认知与社会价值、社会分化和歧视、生命健康与基本权益、可持续生态的影响，提出了人工智能应用伦理安全理念与九大伦理安全原则，规定了人工智能应用开发、服务提供和应用使用等安全指引。可为组织和个人开展人工智能应用活动提供指导，也可为相关主管部门、行业组织和有关机构推进人工智能伦理安全治理提供参考。

【参见：

https://mp.weixin.qq.com/s/0KjK9smE6pJrskt02LkOpw】

National Technical Committee 260 on Cybersecurity of SAC Releases the “Guidelines on Ethical and Security Aspects of Artificial Intelligence Applications 1.0”

On May 19, the National Technical Committee 260 on Cybersecurity of SAC released the “Guidelines on Ethical and Security Aspects of Artificial Intelligence Applications 1.0”. The Guidelines identify the ethical and security impacts of AI applications, including impacts on human autonomy, public order, individual cognition and social values, social division and discrimination, life and health, fundamental rights and interests, and sustainable ecosystems. The Guidelines also propose ethical and security concepts together with nine core ethical and security principles, and set out security guidance covering AI application development, service provision, and application use. The document may serve as guidance for organisations and individuals engaging in AI application activities, and also provide reference for competent authorities, industry associations, and relevant institutions in advancing AI ethical and security governance.

[Reference:

https://mp.weixin.qq.com/s/0KjK9smE6pJrskt02LkOpw]

4.国家数据局解读数据产权制度

5月18日，国家数据局发文图解数据产权制度。明确数据产权的持有权、使用权、经营权三权之间互不影响，不存在从属或依附关系，既可以分置配置，也可并行享有。同时，强调数据产权分置应当坚持问题导向、统筹兼顾、守牢安全底线的原则，并进一步明确了采集生成、委托处理、自动化收集、融合利用、衍生数据等重点场景的数据产权配置规则。此外，要求在数据产权制度的落实中加强安全保护和事中事后监管，维护公共数据安全。

【参见：

https://mp.weixin.qq.com/s/ckGmKi4ax-rNstrOMrGEhA】

National Data Administration Interprets the Data Property Rights System

On May 18, the National Data Administration published an illustrated interpretation of the data property rights system. The interpretation clarifies that the rights of data holding, data use, and data operation are mutually independent and do not constitute subordinate or attached relationships. These rights may either be allocated separately or enjoyed concurrently. It further emphasises that the allocation of data property rights shall adhere to the principles of problem-oriented governance, balanced coordination, and safeguarding security bottom lines. In addition, it specifies allocation rules for key scenarios including data collection and generation, entrusted processing, automated collection, integrated utilisation, and derivative data. The interpretation also calls for strengthened security protection and ongoing supervision during the implementation of the data property rights system to safeguard public data security.

[Reference: 

https://mp.weixin.qq.com/s/ckGmKi4ax-rNstrOMrGEhA]

5.广东网信办等三部门联合发布自贸试验区数据出境负面清单及管理办法

近日，广东省网信办等三部门联合发布《中国（广东）自由贸易试验区数据出境管理清单（负面清单）（2025版）》和《中国（广东）自由贸易试验区数据出境负面清单管理办法（试行）》。负面清单包括2个领域，分别是智能装备制造业和个人征信服务业，包含重要数据、个人信息2类数据，涉及7个业务应用场景、67个数据项。管理办法包含总则、职责及分工、负面清单制定及管理、负面清单实施、监督管理、附则共六章二十六条，明确数据出境负面清单的适用范围、职责分工、制定流程、使用管理、安全监管等内容，是制定和使用负面清单以及开展日常监管的基本规范。

【参见：

https://mp.weixin.qq.com/s/eUTkUKuvWEGluLUYflKpWw】

Cyberspace Administration of Guangdong Province and Two Other Authorities Jointly Release Free Trade Zone Data Export Negative List and Administrative Measures

Recently, the Cyberspace Administration of Guangdong Province and two other authorities jointly released the “Data Export Management List (Negative List) of the China (Guangdong) Pilot Free Trade Zone (2025 Edition)” and the “Administrative Measures for the Data Export Negative List of the China (Guangdong) Pilot Free Trade Zone (Trial)”. The negative list covers two sectors, namely intelligent equipment manufacturing and personal credit reporting services, involving two categories of data—important data and personal information—and covering seven business application scenarios and 67 data items. The Administrative Measures consist of six chapters and twenty-six articles, covering general provisions, responsibilities and division of work, formulation and management of the negative list, implementation of the negative list, supervision and administration, and supplementary provisions. The Measures clarify the applicable scope, division of responsibilities, formulation procedures, utilisation management, and security supervision requirements relating to the data export negative list, and serve as the fundamental framework for formulating, applying, and supervising such negative lists.

[Reference: 

https://mp.weixin.qq.com/s/eUTkUKuvWEGluLUYflKpWw]

6.多地开展“清朗·整治AI应用乱象”专项行动

近期，上海、浙江、重庆等地先后启动为期四个月的整治AI应用乱象专项行动，整体分两阶段推进，第一阶段聚焦AI应用服务典型违规问题，如未按规定履行大模型备案登记义务、AI数据投毒等问题；第二阶段重点整治AI信息内容乱象。上海网信办召开重点平台专项行动推进会，向属地AI平台、互联网内容平台、电商平台、应用商店、开源社区等五类17家重点网站平台部署具体要求，指导各家平台切实履行主体责任。浙江各市通过举办合规宣贯与普法活动、细化自查清单、对已备案大模型开展安全测试、进行互联网暴露大模型资产全面测绘、指导重点平台自查自纠等举措，积极推进整治工作。

【参见：

上海：https://mp.weixin.qq.com/s/O-7qJoUbrhsRtibfC71n9Q

浙江：https://mp.weixin.qq.com/s/d7PECCL38SrmQUZ4cv7dKQ

重庆：https://mp.weixin.qq.com/s/L9a64nfmMxqsxYB5RF-YUg】

Multiple Regions Launch the “Clean and Rectify AI Application Misconduct” Special Campaign

Recently, Shanghai, Zhejiang, Chongqing, and other regions successively launched a four-month special campaign targeting misconduct in AI applications. The campaign is divided into two phases. The first phase focuses on typical compliance violations in AI application services, including failure to fulfil large model filing and registration obligations in accordance with regulations and AI training data poisoning issues. The second phase focuses on rectifying unlawful and harmful AI-generated information content. The Cyberspace Administration of Shanghai convened a special campaign promotion meeting for key platforms and deployed specific compliance requirements for 17 major local platforms across five categories, including AI platforms, internet content platforms, e-commerce platforms, app stores, and open-source communities, directing them to fulfil their primary compliance responsibilities. Authorities across Zhejiang Province have also actively advanced the campaign through compliance training and legal awareness activities, refinement of self-inspection checklists, security testing of filed large models, comprehensive mapping of internet-exposed large model assets, and guidance for key platforms to conduct self-inspection and rectification.

[Reference:

Shanghai:https://mp.weixin.qq.com/s/O-7qJoUbrhsRtibfC71n9Q

Zhejiang:https://mp.weixin.qq.com/s/d7PECCL38SrmQUZ4cv7dKQ

Chongqing:https://mp.weixin.qq.com/s/L9a64nfmMxqsxYB5RF-YUg] 

7.国家药监局印发《药品试验数据保护实施办法》

近日，国家药监局发布《药品试验数据保护实施办法》（2026年第47号），数据保护是指，符合条件的化学药品和生物制品获批上市时，国家药监局对申请人提交的自行取得且未披露的试验数据和其他数据实施保护，给予最长不超过6年的数据保护期。数据保护期自该药品注册申请在境内获得批准之日起计算。在数据保护期内，其他申请人未经药品上市许可持有人同意，依赖前款数据申请药品上市许可或者补充申请的，国家药监局不予许可；其他申请人自行取得并未依赖他人受保护数据的除外。

【参见：

https://www.gov.cn/zhengce/zhengceku/202605/content_7069003.htm】

The National Medical Products Administration Issues the “Implementation Measures for the Protection of Drug Trial Data”

Recently, the National Medical Products Administration (NMPA) issued the “Implementation Measures for the Protection of Drug Trial Data” (No. 47 of 2026). Data protection refers to the protection granted by the NMPA to trial data and other data submitted by applicants—which were independently obtained and have not been disclosed—when eligible chemical drugs and biological products are approved for marketing, with a data protection period of up to six years. The data protection period shall be calculated from the date the drug registration application is approved within the country. During the data protection period, if other applicants apply for a drug marketing authorization or submit a supplemental application relying on the data referred to in the preceding paragraph without the consent of the marketing authorization holder, the NMPA shall not grant such authorization; this does not apply to other applicants who have independently obtained the data and have not relied on protected data from others.

[Reference:

https://www.gov.cn/zhengce/zhengceku/202605/content_7069003.htm]
 

1.韩国PIPC将自6月起启动风险导向的个人信息处理检查

5月21日，韩国个人信息保护委员会（PIPC）宣布，将自2026年6月起正式实施风险导向的个人信息处理检查，推动个人信息保护体系由事后应对转向事前预防。PIPC将根据个人信息处理规模、敏感程度及行业特征，将处理领域划分为高、中、低风险，并对平台、金融机构、公共机构、教育科技、疗养医院等涉及大规模个人信息或敏感信息的高风险领域开展定期及不定期检查。同时，韩国还将推动隐私保护设计（PbD）制度化、建立风险地图、运行个人信息威胁预警机制，并加强对SaaS、云服务、专业受托处理者等供应链环节的管理。

【参见：

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12090】

Korea’s PIPC to Launch Risk-Based Privacy Compliance Inspections from June 2026

On May 21, Korea’s Personal Information Protection Commission (PIPC) announced that it will begin full-scale risk-based inspections of personal information processing practices from June 2026, as part of a broader shift toward a preventive privacy management framework. The PIPC will classify sectors into high-, medium- and low-risk groups based on processing scale, sensitivity and industry characteristics, and will prioritize inspections of high-risk sectors such as platforms, financial institutions, public agencies, edtech companies and nursing hospitals that handle large volumes of personal data or sensitive information. The plan also includes institutionalizing Privacy by Design, developing a baseline privacy risk map, operating an early-warning communication system for privacy threats, and strengthening supply-chain oversight over SaaS providers, cloud services and specialized processors. Source: Personal Information Protection Commission of Korea.

[Reference:

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12090]

2.欧盟委员会发布关于高风险人工智能系统分类的指南草案

5月19日，欧盟委员会关于高风险人工智能系统分类的指南草案，该指南旨在协助人工智能系统的提供者和部署者，以及主管市场监督机构，评估某人工智能系统是否应被归类为高风险，从而促进《人工智能法案》第6条的统一适用和有效执行。该指南阐述了欧盟委员会对分类相关概念的解释，并根据《人工智能法》第6条第5款，列举了应被或不应被归类为高风险的人工智能系统的实际案例。

【参见：

https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems】

European Commission Publishes Draft Commission guidelines on the classification of high-risk AI systems

On May 19, the European Commission published draft guidelines on the classification of high-risk AI systems. These Guidelines aim to support providers and deployers of AI systems, as well as competent market surveillance authorities, in assessing whether an AI system should be classified as high-risk, thereby facilitating the uniform application and effective enforcement of Article 6 AI Act.The Guidelines set out the Commission’s interpretation of certain concepts that are relevant for classification purposes and, in accordance with Article 6(5) AI Act, contain practical examples of AI systems that should or should not be classified as high-risk.

[Reference:

https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems]