每周数据法律资讯 Data Law Weekly（20260608—20260614）

1.六部门联合印发《金融信息服务数据分类分级指南》

6月13日，国家网信办等六部门联合印发《金融信息服务数据分类分级指南》，适用于在中华人民共和国境内从事金融信息服务的金融信息服务提供者开展数据分类分级和重要数据识别工作。指南按照金融信息服务数据的业务属性进行分类，其中一级分类为业务数据、用户数据和企业数据3类，在此基础上进一步细分二级分类9类、三级分类67类。在分级方面，指南根据金融信息服务数据在经济社会发展中的重要程度和敏感程度，以及一旦遭到泄露、篡改、损毁或者非法获取、非法使用、非法共享，对国家安全、经济运行、社会秩序、公共利益、组织权益、个人权益造成的危害程度，将数据从高到低分为四级，分别为核心数据、重要数据、敏感一般数据、常规一般数据。同时，明确了编制分类分级清单、动态更新管理等全流程操作要求，指导金融机构完成重要数据识别与重要数据目录备案。

【参见：

https://mp.weixin.qq.com/s/bdKVawpQJdrDuAXWvEZ7wQ】

Six Authorities Jointly Issue the Guidelines for Data Classification and Grading in Financial Information Services

On June 13, the CAC and five other authorities jointly issued the Guidelines for Data Classification and Grading in Financial Information Services, applicable to financial information service providers conducting data classification, grading, and important data identification within China. The Guidelines classify financial information service data into three primary categories—business data, user data, and enterprise data—which are further subdivided into nine secondary categories and 67 tertiary categories. Based on the level of importance and sensitivity of the data, as well as the potential harm caused by leakage, tampering, destruction, or illegal access, use, or sharing, data is categorized into four levels: core data, important data, sensitive general data, and ordinary general data. The Guidelines also set out full-process requirements for compiling classification lists, dynamic updates, and filing of important data directories, guiding financial institutions in identifying and managing important data.

[Reference:

https://mp.weixin.qq.com/s/bdKVawpQJdrDuAXWvEZ7wQ]

2.中央网信办开设涉AI应用乱象专项举报专区

6月12日，中央网信办举报中心正式上线“涉AI应用乱象举报专区”，专项受理公众举报。受理范围主要包括：未按规定履行大模型备案登记义务、AI平台安全和审核过滤能力不足、大模型训练语料安全问题、AI数据投毒问题、生成合成内容标识落实不到位、滥用AI技术开展违法违规活动、开源模型安全管理不到位、利用AI“魔改”经典、生成“数字泔水”、制作发布虚假不实信息、假冒仿冒他人、制作发布暴力低俗等不良信息、侵害未成年人权益、利用AI“托管”从事网络水军活动、AI产品服务和应用程序违规等14类问题。

【参见：

https://mp.weixin.qq.com/s/VpNYmV15h7ogO4MPbl-iRg】

CAC Launches Dedicated Reporting Channel for Irregularities in AI Applications

On June 12, the Reporting Center of the CAC officially launched a dedicated reporting channel for irregularities involving AI applications, specifically to accept public complaints. The scope of complaints mainly includes: failure to comply with large model filing and registration requirements, insufficient security and content filtering capabilities of AI platforms, security issues in large model training data, data poisoning of AI systems, inadequate implementation of labeling requirements for AI-generated and synthesized content, misuse of AI technologies to carry out illegal and non-compliant activities, inadequate security management of open-source models, use of AI to improperly modify or distort classic works, generation of low-quality or meaningless content, production and dissemination of false or misleading information, impersonation or fraudulent identity use, production and dissemination of violent or vulgar content, infringement of minors’ rights and interests, use of AI for online astroturfing activities, and other violations related to AI products, services, and applications, totaling 14 categories of issues.

[Reference:

https://mp.weixin.qq.com/s/VpNYmV15h7ogO4MPbl-iRg]

3.中央网信办通报30款App个人信息收集使用问题

6月11日，中央网信办通报30款存在个人信息收集使用违规行为的App和小程序，要求相关运营主体在15个工作日内完成整改并提交整改材料，逾期将依法采取进一步处置措施。本次发现的问题主要包括未公开个人信息收集使用规则、频繁索取非必要权限、未完整披露第三方SDK收集使用个人信息情况以及未提供有效账号注销功能等四类违规行为。

【参见：

https://mp.weixin.qq.com/s/6lY8jw9fdBDb6sueEkD-4g】

CAC Reports Personal Information Collection and Use Issues in 30 Apps

On June 11, the CAC reported that 30 mobile apps were found to have violated rules on personal information collection and use. Relevant operators are required to complete rectification and submit materials within 15 working days, failing which further regulatory actions may follow. The violations mainly include failure to disclose personal information collection rules, excessive requests for unnecessary permissions, incomplete disclosure of third-party SDK data collection practices, and lack of effective account deletion mechanisms.

[Reference:

https://mp.weixin.qq.com/s/6lY8jw9fdBDb6sueEkD-4g]

4.工业和信息化部指导规范APP信息窗口跳转行为

6月9日，针对部分APP在开屏及弹窗信息窗口中采用诱导点击、高灵敏度“摇一摇”等方式误导用户触发页面跳转的问题，工业和信息化部召开专题整治会议。会议要求相关企业全面排查已上线和拟上线信息窗口设计，及时下线违规内容，并建立完善在线巡查和内部审核机制。工信部表示，将持续开展常态化监测，对违规主体依法采取约谈、通报和下架APP等措施。

【参见：

https://mp.weixin.qq.com/s/K4pi5npYZ9oVXnNl1E3yMA】
 

MIIT Strengthens Regulation of APP Information Window Redirect Practices

On June 9, the MIIT convened a special rectification meeting targeting misleading interface behaviors in mobile applications, including inducive clicks in splash screens and pop-up windows, as well as high-sensitivity “shake-to-redirect” mechanisms. The MIIT required relevant companies to comprehensively review existing and planned interface designs, promptly remove non-compliant content, and establish robust internal review and monitoring mechanisms. MIIT stated it will continue routine inspections and take regulatory actions such as interviews, public notices, and app removals against violators.

[Reference:

https://mp.weixin.qq.com/s/K4pi5npYZ9oVXnNl1E3yMA]

5.国家网信办、市场监管总局联合印发《网络测评活动规范》

6月8日，国家网信办、市场监管总局联合发布《网络测评活动规范》，明确网络测评活动应遵守法律法规、商业道德、公序良俗以及客观、公正、全面、准确原则。涉及产品功能、性能等测试的，应委托具有法定资质的检验检测机构按照相关标准开展测试；涉及食品检测的，应采用符合国家标准的方法，不得使用非标准方法或测评无国家标准检验方法的项目。同时，不得采用不同标准或方法对同类产品进行比较。对于未实际测试、仅基于主观体验形成的评价，应当明确说明。规范还要求网络平台加强测评内容管理，及时受理和处置投诉举报。

【参见：

https://mp.weixin.qq.com/s/VPLVMyoSueTLmwQyxN-tQA】

CAC and SAMR Jointly Issue Standards for Online Product Evaluation Activities

On June 8, the CAC and SAMR jointly issued the Standards for Online Product Evaluation Activities. The Standards require that online evaluation activities comply with laws and regulations, business ethics, public order and good customs, and the principles of objectivity, fairness, comprehensiveness, and accuracy. Testing related to product functions or performance must be conducted by legally qualified testing institutions in accordance with relevant standards and technical specifications; food testing must follow national standard methods, and non-standard methods are prohibited. The Standards also prohibit comparing similar products using inconsistent testing standards or methods. Where evaluations are based solely on subjective impressions without actual testing, this must be clearly disclosed. Platforms are required to strengthen content governance and improve complaint-handling mechanisms.

[Reference:

https://mp.weixin.qq.com/s/VPLVMyoSueTLmwQyxN-tQA]

6.携程公司因违法出境个人信息被罚款1000万元

近期，上海市互联网信息办公室针对部分企业在数据出境过程中存在的数据安全主体责任落实不到位、合规审计不严等问题开展执法检查。其中，上海携程商务有限公司因未履行数据出境安全评估义务、违法出境个人信息等行为，被依据《个人信息保护法》处以1000万元罚款并责令整改。

【参见：

https://mp.weixin.qq.com/s/f1-b4qGK7sDNO7YErI8Low】

Ctrip Fined RMB 10 Million for Illegally Transferring Personal Information Overseas

The Shanghai Cyberspace Administration has conducted enforcement actions targeting enterprises for deficiencies in data security responsibility implementation and inadequate compliance auditing in cross-border data transfers. In one case, Shanghai Ctrip Commerce Co., Ltd. was fined RMB 10 million for failing to comply with data export security assessment requirements and illegally transferring personal data overseas, in violation of the Personal Information Protection Law.

[Reference:

https://mp.weixin.qq.com/s/f1-b4qGK7sDNO7YErI8Low]

1.欧盟发布《AI生成内容透明度行为准则》最终版

6月10日，欧盟委员会正式发布《AI生成内容透明度行为准则》最终版，用于落地《人工智能法》第50条透明度相关义务，该准则自2026年8月2日起正式生效，该准则系自愿性质，不签署的企业也可以通过其他方式合规。准则区分生成式AI系统提供者与部署者两类主体：其中提供者需对AI生成或操纵的音频、图像、视频及文本内容实施机器可读标记，并提供相应内容检测能力，标记通常以数字签名元数据与不可感知水印等多层技术实现；部署者则需对深度伪造内容及特定AI生成文本进行可见标注，可使用准则附件提供的“EU图标”作为统一标识，以确保用户在首次接触内容时即可清晰识别其AI属性。

【点击查阅原文：

https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content】

EU Releases Final Code of Practice on Transparency of AI-Generated Content

On June 10, the European Commission officially released the final version of the Code of Practice on Transparency of AI-Generated Content, which is intended to implement transparency obligations under Article 50 of the AI Act. The Code will take effect on August 2, 2026. It is voluntary in nature, and companies that do not sign it may comply through other means. The Code distinguishes between providers and deployers of generative AI systems: providers are required to apply machine-readable labeling to AI-generated or AI-manipulated audio, image, video, and text content, and to provide corresponding detection capabilities; such labeling is typically implemented through layered technologies such as digital signature metadata and imperceptible watermarking. Deployers are required to visibly label deepfakes and certain AI-generated text, and may use the “EU icons” provided in the annex of the Code as a unified identifier to ensure users can clearly recognize AI-generated content at first contact.

[Click here to view the original article: 

https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content]

2.欧盟EDPB就数据泄露通知模板公开征求意见

6月10日，欧洲数据保护委员会宣布通过个人数据泄露通知通用模板，并同步启动公开征求意见程序，意见征集截止时间为2026年8月5日。该模板旨在帮助组织与各成员国数据保护机构构建、协调并统一数据泄露通知流程。该模板通过预设标准化选项与结构化填写指引，确保通知内容完整覆盖GDPR第33条所要求的信息，使企业能够更及时提交数据泄露报告，同时便于监管机构对相关案件进行评估与处理；该设计亦有助于降低合规成本，尤其对缺乏数据保护官或专门法律资源的小型组织具有实务意义。

【参见：

https://www.edpb.europa.eu/news/news/2026/edpb-meets-eu-commissioner-mcgrath-and-adopts-common-data-breach-notification_fr】

EDPB Launches Consultation on Data Breach Notification Template

On June 10, the European Data Protection Board (EDPB) announced the adoption of a common personal data breach notification template and simultaneously launched a public consultation. The consultation period runs until August 5, 2026. The template is intended to assist organizations and national data protection authorities in building, coordinating, and standardizing data breach notification procedures. By providing predefined structured options and guidance for completion, the template ensures that notifications fully cover the information required under Article 33 of the GDPR, enabling organizations to submit breach reports more promptly and facilitating assessment and handling by supervisory authorities. It is also designed to reduce compliance costs, particularly for small organizations that lack a data protection officer or dedicated legal resources.

[Reference:

https://www.edpb.europa.eu/news/news/2026/edpb-meets-eu-commissioner-mcgrath-and-adopts-common-data-breach-notification_fr]

3.爱尔兰高等法院就TikTok数据跨境案作出判决

6月3日，爱尔兰高等法院就 TikTok v DPC [2026] 案作出判决，整体维持爱尔兰数据保护委员会（IDPC）对 TikTok 在 GDPR 第46(1)条跨境数据传输义务与第13(1)(f)条透明度义务方面的违规认定，核心争议围绕EEA用户数据通过中国境内人员远程访问所引发的跨境合规问题。在实体认定上，法院认为 TikTok 未能证明其通过SCC、加密及Project Clover等措施实现GDPR要求的“实质等同保护”，支持IDPC对第46条的违规认定及罚款基础；同时其隐私政策未充分披露数据可能被中国境内人员访问及处理的跨境路径与目的地信息，透明度不足。在纠正性措施部分，法院认为IDPC虽审查相关补充材料，但未充分说明其未改变结论的理由，因此发回其就暂停跨境数据传输相关措施重新审查；罚款金额另行裁定。

【点击下载判决：

https://www.highcourtsearch.courts.ie/judgments】

Irish High Court Issues Judgment in TikTok Cross-Border Data Transfer Case

On June 3, the Irish High Court delivered its judgment in TikTok v DPC [2026], broadly upholding the Irish Data Protection Commission’s (IDPC) findings that TikTok had infringed Article 46(1) on cross-border data transfer obligations and Article 13(1)(f) on transparency obligations under the GDPR. The core dispute concerned compliance issues arising from remote access to EEA user data by personnel located in China. On the merits, the Court held that TikTok failed to demonstrate that its safeguards, including SCCs, encryption, and Project Clover, achieved the GDPR requirement of “essential equivalence of protection,” thereby supporting the IDPC’s finding of infringement under Article 46. The Court also found that TikTok’s privacy policy did not sufficiently disclose cross-border access pathways and destinations involving personnel in China, constituting a lack of transparency under Article 13. On corrective measures, the Court held that although the IDPC reviewed supplementary materials, it did not provide sufficient reasoning for maintaining its conclusion, and therefore remitted the matter for reconsideration of measures related to suspension of data transfers. The level of fines is to be determined separately.

[Click to download the judgment:

https://www.highcourtsearch.courts.ie/judgments]