每周数据法律资讯 数据法律周刊（20260601—20260607）

1.上海市通信管理局通报2026年第三批侵害用户权益APP及SDK

6月4日，上海市通信管理局通报2026年第三批侵害用户权益APP（SDK），共56款App存在侵害用户权益的违法违规行为，上海通管局要求相关运营者自通报之日起5个工作日内报送书面整改报告和自评估报告，逾期将依法处置处罚。主要问题包括：违规收集个人信息，未明示个人信息处理规则，账号注销难，未妥善处理用户投诉，超范围收集个人信息，APP强制、频繁、过度索取权限等。

【参见：

https://mp.weixin.qq.com/s/rRfXwWe3WYzLzD0668h5Jw】

Shanghai Communications Administration Announces the Third Batch of Apps and SDKs Infringing User Rights and Interests in 2026

On June 4, the Shanghai Communications Administration announced the third batch of apps and SDKs found to have infringed users’ rights and interests in 2026. A total of 56 apps were identified as having engaged in unlawful or non-compliant practices affecting user rights, and the relevant operators were required to submit written rectification reports and self-assessment reports within five working days from the date of the announcement. Failure to complete rectification within the prescribed period may result in regulatory actions and penalties in accordance with the law. The principal issues identified included the unlawful collection of personal information, failure to clearly disclose personal information processing rules, difficulties in account cancellation, failure to properly handle user complaints, collection of personal information beyond the necessary scope, and mandatory, frequent, or excessive requests for application permissions.

[Reference: 

https://mp.weixin.qq.com/s/rRfXwWe3WYzLzD0668h5Jw]

2.国家网络与信息安全信息通报中心通报71款违法违规收集个人信息移动应用

6月3日，国家网络与信息安全信息通报中心通报71款移动应用存在一项或者多项违法违规收集使用个人信息情况，主要违规问题包括在App首次运行时未通过弹窗等明显方式提示用户阅读隐私政策等收集使用规则；隐私政策未逐一列出App（包括委托的第三方或嵌入的第三方代码、插件）收集使用个人信息的目的、方式、范围等；未在征得用户同意后才开始收集个人信息或打开可收集个人信息的权限；强制将人脸识别作为唯一身份验证方式等。

【参见：

https://mp.weixin.qq.com/s/3aIUzL0rg2_ciliywO4U6Q】

National Cyber and Information Security Information Notification Center (CNCERT) Reports 71 Mobile Applications for Illegal Collection and Use of Personal Information

On June 3, the National Cyber and Information Security Information Notification Center reported 71 mobile apps for illegal or non-compliant collection and use of personal information. The identified issues mainly include failure to prominently present privacy policies when the apps are first launched; failure to specify the purposes, methods and scope of personal information processing by the apps and their entrusted third parties, embedded third-party code or plug-ins; collection of personal information or activation of permissions before obtaining user consent; and making facial recognition the only means of identity verification.

[Reference:

https://mp.weixin.qq.com/s/3aIUzL0rg2_ciliywO4U6Q]

3.中央网信办组织召开未成年人网络保护协调机制工作会议

6月2日，中央网信办组织召开未成年人网络保护协调机制工作会议，研究部署规范和管理未成年人使用网络相关工作。会议指出要坚持分级分类，严管中高风险功能服务，划定触网安全底线；坚持管建并举，全面推广未成年人模式，升级专属内容池，优化未成年人专门设备，打造安全网络空间；坚持技术赋能，聚焦未成年人身份识别问题加大技术攻关力度，将网络保护要求融入技术规范，把法规要求通过技术标准落细，推动全覆盖、全链条、全闭环协同保护。

【参见：

https://mp.weixin.qq.com/s/iR_bEkqiHg-THcS5q_6EKQ】

CAC Holds Coordination Mechanism Meeting on Online Protection of Minors

On June 2, the Cyberspace Administration of China convened a coordination mechanism meeting on the online protection of minors, focusing on measures to regulate and manage minors’ internet use. The meeting emphasized a risk-based and category-based approach, stricter management of medium- and high-risk online functions and services, broader implementation of minor protection mode, upgraded dedicated content pools, and improved devices designed for minors. It also called for strengthened technological solutions for minor identity recognition and the integration of legal protection requirements into technical specifications and standards, with a view to building a comprehensive, full-chain and closed-loop protection mechanism for minors online.

[Reference:

https://mp.weixin.qq.com/s/3aIUzL0rg2_ciliywO4U6Q]

4.《国务院关于对外投资的规定》正式公布

6月1日，国务院公布《国务院关于对外投资的规定》，自2026年7月1日起施行。该规定明确投资者开展对外投资活动，不得出口、使用国家禁止出口的货物、技术、服务及相关数据，或者未经许可出口、使用国家限制出口的货物、技术、服务及相关数据；不得以跨境派遣技术人员、组织人员赴其他国家（地区）工作、跨境提供技术指导、安排人员跨境培训等方式向其他国家（地区）转移国家禁止出口的货物、技术、服务及相关数据，或者未经许可向其他国家（地区）转移国家限制出口的货物、技术、服务及相关数据；向境外提供证据或材料须遵守保守国家秘密、数据安全、个人信息保护等规定，需经主管机关准许的应履行法律程序。

【参见：

https://mp.weixin.qq.com/s/UuU52x9yIYNrRVGmJNICnQ】
 

State Council Officially Issues the Provisions on Overseas Investment

On June 1, the State Council released the Provisions on Overseas Investment, effective July 1, 2026. The Provisions prohibit investors from exporting, using, or transferring goods, technologies, services, and related data that are subject to China’s export prohibitions or restrictions, unless required approvals are obtained. They also clarify that such controlled items must not be transferred overseas through indirect means, including dispatching technical personnel abroad, providing cross-border technical guidance, or arranging overseas training. In addition, the overseas provision of evidence or materials must comply with requirements on state secrets, data security, and personal information protection, and relevant approval procedures must be completed where required.

[Reference: 

https://mp.weixin.qq.com/s/UuU52x9yIYNrRVGmJNICnQ]

二

国外资讯（Overseas news）

1.韩国PIPC就《个人信息保护法施行令》修正案公开征求意见

6月2日，韩国个人信息保护委员会（PIPC）发布《个人信息保护法施行令》修正案征求意见稿，重点内容包括：明确一定规模以上个人信息处理者在指定、变更或解除个人信息保护负责人（CPO）时，须经董事会决议并向PIPC申报；细化ISMS-P认证义务主体范围；明确在发现个人信息处理系统遭非法访问或个人信息被非法交易、流通等“泄露可能性”情形时，应在72小时内通知信息主体；同时完善个人信息泄露、伪造、篡改、毁损等情形下的通知、申报及行政罚款标准。

【参见：

https://m.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12137】

Korea’s PIPC Announces Proposed Amendments to the Enforcement Decree of the Personal Information Protection Act

On June 2, Korea’s Personal Information Protection Commission (PIPC) announced proposed amendments to the Enforcement Decree of the Personal Information Protection Act. Key changes include requiring certain large-scale personal information controllers to obtain board approval and report to the PIPC when appointing, changing or dismissing a Chief Privacy Officer (CPO); specifying the scope of entities subject to mandatory ISMS-P certification; requiring notification to data subjects within 72 hours where there is a likelihood of personal information leakage, such as illegal access to personal information systems or illegal trade or circulation of personal information; and refining notification, reporting and administrative fine standards for leakage, forgery, alteration or destruction of personal information.

[Reference:

https://m.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12137]

2.美国签署简化版AI监管行政令

6月2日，美国总统签署《促进前沿人工智能创新与安全》行政令，要求联邦部门加强国家安全系统和关键基础设施网络防护，并由财政部联合NSA、CISA及AI企业、关键基础设施运营方建立AI网络安全信息互通中心，统筹开展漏洞发现与修复。政令同步建立受控前沿AI模型自愿申报机制，企业可在模型对外发布前最长提前30天向联邦政府开放模型开展安全测评，并明确不得据此设立AI研发、发布和商用环节的强制审批制度；同时要求司法部依法打击利用AI实施非法入侵、数据窃取等网络犯罪行为。

【参见：

https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/】

United States Issues Streamlined Executive Order on AI Governance

On June 2,the President of the United States signed the Executive Order on Promoting Advanced Artificial Intelligence Innovation and Security. The Order directs federal agencies to strengthen cybersecurity protections for national security systems and critical infrastructure networks, and requires the Department of the Treasury, together with the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), AI companies, and critical infrastructure operators, to establish an AI Cybersecurity Information Sharing Center to coordinate vulnerability identification and remediation efforts. The Order also establishes a voluntary reporting mechanism for controlled frontier AI models, under which companies may voluntarily provide their models to the federal government for security evaluation up to 30 days before public release. At the same time, it expressly prohibits the establishment of any mandatory approval regime for AI research, development, deployment, or commercial use on the basis of such submissions. In addition, the Order directs the Department of Justice to combat cybercrimes involving the use of AI for illegal intrusions, data theft, and related malicious activities.

[Reference:

https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/]