每周数据法律资讯 Data Law Weekly（20260525—20260531）

1.上海市通信管理局启动“浦江护航”2026年电信和互联网行业数据安全专项行动

5月29日，上海市通信管理局启动“浦江护航”2026年电信和互联网行业数据安全专项行动，进一步提升电信和互联网行业数据安全综合治理水平。专项行动重点面向在电信和互联网行业处理重要数据、1000万人以上个人信息或运营重要网络信息系统的电信业务经营者，围绕人工智能数据安全治理、行业首席数据官制度建设、重要数据识别与目录管理、行业数据安全风险评估、数据对外共享安全管理、企业出海数据安全与跨境合规、互联网数据中心客户数据保护以及数据安全风险防范与应急处置等八项重点任务开展工作。通知同时提出加强重点网络信息系统监管、强化第三方服务机构监督管理以及推进数据安全人才培养等保障措施。

【参见：

https://mp.weixin.qq.com/s/e9W7GNzOANOqP9TfId7_Xg?scene=1&click_id=24】

Shanghai Communications Administration Launches the “Pujiang Escort” 2026 Data Security Special Action for the Telecommunications and Internet Industry

On May 29, the Shanghai Communications Administration launched the “Pujiang Escort” 2026 Data Security Special Action for the Telecommunications and Internet Industry to further enhance the overall data security governance capabilities of the telecommunications and internet sector. The action primarily targets telecommunications operators that process important data, process personal information of more than 10 million individuals, or operate critical network information systems. It focuses on eight key areas, including AI data security governance, establishment of the Chief Data Officer system, important data identification and catalog management, industry data security risk assessments, secure management of external data sharing, data security and cross-border compliance for overseas business operations, customer data protection by internet data centers, and data security risk prevention and emergency response. The Notice also introduces supporting measures, including strengthened supervision of critical network information systems, enhanced oversight of third-party service providers, and continued development of data security talent.

[Reference: 

https://mp.weixin.qq.com/s/e9W7GNzOANOqP9TfId7_Xg?scene=1&click_id=24]

2.网信办启动“清朗・优化营商网络环境整治恶意炒作涉企信息”专项行动

5月29日，网信办宣布即日起在全国范围启动为期2个月的专项行动，聚焦恶意炒作涉企信息、诋毁抹黑企业、牟取非法利益、侵犯企业家个人权益四类突出问题开展整治。重点查处在企业关键节点恶意炒作负面信息、虚假不实测评、AI生成抹黑信息、网络水军碰瓷、以负面信息胁迫商业合作、索要删帖费、炒作企业家隐私等行为。网信办要求平台压实主体责任，强化AI生成内容与网络测评管理，健全投诉举报与处置机制，加大惩戒曝光力度，优化营商网络环境。

【参见：

https://mp.weixin.qq.com/s/rQyuXzqZn4dmJslJHfGa9w】

CAC Launches the “Qinglang–Improving the Online Business Environment and Rectifying Malicious Online Publicity Targeting Enterprises” Special Campaign

On May 29, CAC announced the launch of a two-month nationwide special campaign aimed at rectifying four prominent issues: malicious online publicity involving enterprise-related information, defamation and smearing of enterprises, illegal profiteering, and infringement of entrepreneurs’ personal rights and interests. The campaign will focus on investigating and addressing activities such as malicious amplification of negative information at critical business stages, false or misleading reviews and evaluations, AI-generated defamatory content, online astroturfing activities, coercing commercial cooperation through negative publicity, demanding fees for deleting posts, and exploiting entrepreneurs’ privacy for online hype. CAC also required platforms to strengthen fulfilment of their primary responsibilities, enhance governance of AI-generated content and online reviews, improve complaint reporting and handling mechanisms, intensify penalties and public exposure measures, and further improve the online business environment.

[Reference:

https://mp.weixin.qq.com/s/rQyuXzqZn4dmJslJHfGa9w]

3.五部门联合发布《互联网信息内容多渠道分发服务管理规定》

5月29日，国家网信办等五部门联合发布《互联网信息内容多渠道分发服务管理规定》，自2026年9月1日起施行。这是我国首部专门规范互联网信息内容多渠道分发服务的管理规定，明确了在境内提供和使用互联网信息内容多渠道分发服务及其监督管理的基本原则和制度规则，包括相关主体在设立、运营、提供服务等环节中的义务。要求有关机构依法登记，平台对入驻机构核验、备案、分类分级管理；明确禁止流量造假、恶意炒作、虚假人设等行为，强化未成年人保护与直播营销规范。

【参见：

https://mp.weixin.qq.com/s/pjsa5nSrsUqZSkrJcJIyfg】

Five Authorities Jointly Release the Provisions on the Administration of Multi-Channel Distribution Services for Internet Information Content

On May 29, CAC and four other authorities jointly released the “Provisions on the Administration of Multi-Channel Distribution Services for Internet Information Content”, which will take effect on September 1, 2026. The Provisions constitute China’s first dedicated regulation governing multi-channel distribution services for internet information content. They clarify the fundamental principles and regulatory framework applicable to the provision, use, and supervision of such services within China, including obligations of relevant entities during establishment, operation, and service provision. The Provisions require relevant institutions to complete lawful registration, while platforms are required to verify and register participating institutions and implement classified and tiered management. The Provisions also expressly prohibit traffic manipulation, malicious hype, and fabricated online personas, while strengthening requirements relating to the protection of minors and livestream marketing compliance.

[Reference:

https://mp.weixin.qq.com/s/pjsa5nSrsUqZSkrJcJIyfg]

4.广东省网信办通报首批属地App个人信息收集使用问题

5月29日，广东省网信办通报首批属地App（含小程序）个人信息收集使用问题，共28款App存在个人信息收集使用违法违规行为，要求相关运营者15个工作日内完成整改，逾期将依法处置处罚。主要问题包括：未在隐私政策等公示文本中清晰明示第三方SDK收集OAID信息的目的、方式和范围，用户同意隐私政策后，存在收集OAID信息的行为；App未见向用户明示分享的第三方名称、目的及个人信息类型；隐私政策中没有列出获取手机号信息的目的、方式、范围；在申请存储权限时，未同步告知用户其目的等。

【参见：

https://mp.weixin.qq.com/s/gEJfg1KkQ47mHGq15Rm-BQ】

Cyberspace Administration of Guangdong Province Announces the First Batch of Personal Information Collection and Use Issues Concerning Local Apps

On May 29, the Cyberspace Administration of Guangdong Province announced the first batch of personal information collection and use issues concerning local apps, including mini programs. A total of 28 apps were found to have engaged in unlawful or non-compliant personal information processing activities, and the relevant operators were required to complete rectification within 15 working days, failing which penalties would be imposed in accordance with the law. The main issues identified included failure to clearly disclose in privacy policies or other public notices the purpose, method, and scope of OAID information collection by third-party SDKs despite actual collection occurring after users consented to the privacy policy; failure to disclose to users the identities of third parties receiving shared information, the purpose of sharing, and the categories of personal information involved; failure to specify in privacy policies the purpose, method, and scope of mobile phone number collection; and failure to simultaneously notify users of the purpose for requesting storage permissions.

[Reference: 

https://mp.weixin.qq.com/s/gEJfg1KkQ47mHGq15Rm-BQ]

5.18项网络安全国家标准获批发布

全国网络安全标准化技术委员会归口的18项国家标准正式发布，将于2026年12月1日实施。标准涵盖网络存储安全技术要求、移动互联网未成年人模式技术要求、事件调查原则和过程、信息安全管理体系审核和认证机构要求、信息安全管理体系审核指南、存储安全指南等领域，完善网络安全全链条技术规范体系。

【参见：

https://mp.weixin.qq.com/s/0d_Z4zF76H7FB3lkBtRgKg】

18 National Cybersecurity Standards Approved and Released

Eighteen national standards under the jurisdiction of the National Technical Committee on Cybersecurity Standardization have been officially released and will take effect on December 1, 2026. The standards cover areas such as technical requirements for network storage security, technical requirements for mobile internet “minor-friendly mode,” principles and procedures for incident investigation, requirements for information security management system audit and certification bodies, guidelines for information security management system audits, and storage security guidelines, thereby enhancing the comprehensive technical specification system for cybersecurity.

[Reference:

https://mp.weixin.qq.com/s/0d_Z4zF76H7FB3lkBtRgKg]

6.上海市网信办通报属地App个人信息收集使用问题（2026年第二批-消费零售专项）

5月25日，上海市网信办通报属地App个人信息收集使用问题（2026年第二批-消费零售专项），共计13款App及小程序存在个人信息收集使用违法违规行为，上海网信办要求相关运营者15个工作日内完成整改，逾期将依法处置处罚。所涉问题主要包括：告知收集使用个人信息目的、方式、范围与实际收集使用情况不一致，注销后未及时删除个人信息，频繁征求用户同意收集个人信息，强制用户同意收集非必要个人信息，收集敏感个人信息未同步告知目的及必要性，在无关场景收集位置、通讯录、短信等个人信息的问题。

【参见：

https://mp.weixin.qq.com/s/vf-XKni9ywG-hUL76yaNeQ】

Cyberspace Administration of Shanghai Announces Personal Information Collection and Use Issues Concerning Local Apps (2026 Second Batch–Consumer Retail Special Campaign)

On May 25, the Cyberspace Administration of Shanghai announced personal information collection and use issues concerning local apps under the 2026 second batch consumer retail special campaign. A total of 13 apps and mini programs were found to have engaged in unlawful or non-compliant personal information processing activities, and the relevant operators were required to complete rectification within 15 working days, failing which penalties would be imposed in accordance with the law. The issues identified mainly included inconsistencies between disclosed and actual purposes, methods, and scope of personal information collection and use; failure to timely delete personal information after account cancellation; repeated requests for user consent to collect personal information; compulsory collection of unnecessary personal information; failure to simultaneously notify users of the purpose and necessity when collecting sensitive personal information; and collection of location, contact lists, SMS messages, and other personal information in unrelated scenarios.

[Reference:

https://mp.weixin.qq.com/s/vf-XKni9ywG-hUL76yaNeQ]

二

国外资讯（Overseas news）

1.欧盟依据《数字服务法》对Temu处以2亿欧元罚款

5月28日，欧盟委员会宣布对电商平台Temu处以2亿欧元罚款，本次处罚系依据《数字服务法》对超大型在线平台（VLOP）作出的处罚。欧盟认定Temu存在三方面违规：一是风险评估不具体，未结合自身业务开展针对性分析；二是对非法商品风险识别不足，平台内有大量商品非法或者不合规；三是未评估平台机制放大非法商品的传播风险。Temu需在2026年8月28日之前向欧盟委员会提交一份行动计划，阐明其将如何纠正违反风险评估义务的行为。此后，欧洲数字服务委员会将在收到该计划后的一个月内发表意见；欧盟委员会则在此后一个月内作出最终决定，并设定合理的整改执行期限。

【参见：

https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1178】

EU Imposes EUR 200 Million Fine on Temu under the Digital Services Act

On May 28, the European Commission announced a EUR 200 million fine against e-commerce platform Temu under the Digital Services Act, constituting an enforcement action against a Very Large Online Platform. The European Commission identified three categories of violations by Temu. First, Temu’s risk assessments lacked specificity and failed to conduct targeted analysis based on its business operations. Second, Temu failed to adequately identify risks relating to illegal products, with a significant number of products on the platform being illegal or non-compliant. Third, Temu failed to assess the risks arising from platform mechanisms that could amplify the dissemination of illegal products. Accordingly, Temu is required to submit an action plan to the European Commission by August 28, 2026, explaining how it intends to remedy the identified breaches of its risk assessment obligations. Following submission, the European Board for Digital Services will issue an opinion within one month, after which the European Commission will issue a final decision and determine a reasonable compliance deadline.

[Reference:

https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1178]

2.美国加州参议院通过关于消费者删除权的法案

5月27日，参议院第923号法案《消费者隐私请求：删除请求记录及请求提交方式》（SB 923）在加州参议院获得通过。该法案将扩大删除权范围，允许消费者要求删除企业收集的任何与其相关的个人信息，而不仅限于企业直接从消费者处收集的信息。对于企业未直接从消费者处获取的个人信息，该法案允许企业保留删除请求记录，并保留确保消费者信息保持删除状态且不被用于任何其他目的所需的最低限度数据。此外，该法案要求企业向消费者提供在线渠道（如网页表单或在线门户），以便其提交个人信息相关请求。

【参见：

https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB923】

California Senate Passes Bill on Consumers’ Right to Erasure

On May 27, Senate Bill 923 (SB 923), titled ‘Consumer privacy requests: deletion request records and request submission methods’, was passed by the California Senate. The bill expand the scope of the right to erasure, allowing consumers to request the deletion of any personal information collected by businesses relating to them, rather than being limited to information collected directly from the consumer. For personal information not obtained directly from the consumer, the bill permits businesses to maintain a record of deletion requests and to retain the minimum data necessary to ensure that the consumer’s information remains deleted and is not used for any other purpose. Furthermore, the bill requires businesses to provide consumers with an online channel (such as a web form or online portal) through which they may submit requests regarding their personal information.

[Reference:

https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB923]