每周数据法律资讯 Data Law Weekly（20260622—20260628）

1.中央网信办发布关于征求《政务移动互联网应用程序管理要求》强制性国家标准（征求意见稿）意见的通知

6月26日，中央网信办就《政务移动互联网应用程序管理要求》（征求意见稿）对外公开征求意见。该标准适用于各级行政机关、群团组织、事业单位等运营的政务APP、小程序、快应用，不含政务公众号、工作群组。标准在功能层面明确减负约束：除安保、应急等特殊场景外，不得设置打卡、积分排名、在线时长统计功能；禁止以登录使用频次、下载率、安装率、阅读和点赞数量等数据作为考评依据，配套投诉举报入口。标准全流程规范备案、日常使用、安全保密管理，包括要求落实网络安全等级保护、数据分类分级、国家密码应用管理要求；建立安全监测与应急机制；严禁存储传输国家秘密，接入AI智能体需进行合规管控。

【参见：

https://www.cac.gov.cn/2026-06/26/c_1784217637474922.htm?sessionid=】

CAC Issues Notice Soliciting Comments on Draft Mandatory National Standard “Requirements for Management of Government Mobile Internet Applications”

On June 26, the Cyberspace Administration of China (CAC) issued a notice to solicit public comments on the draft mandatory national standard “Requirements for Management of Government Mobile Internet Applications”. The draft standard applies to government Apps, mini programs, and quick apps operated by administrative authorities, mass organizations, and public institutions at all levels, excluding government official accounts and work groups. The draft standard specifies burden reduction requirements at the functional level. Except for special scenarios such as security and emergency response, government mobile applications shall not provide functions such as attendance check-ins, ranking systems, or online time statistics. Data including login frequency, download rate, installation rate, reading volume, and likes shall not be used as assessment criteria, and complaint and reporting channels shall be provided. The draft also standardizes filing, daily operation, security, and confidentiality management throughout the lifecycle, requiring compliance with cybersecurity multi-level protection, data classification and grading, and national cryptography application requirements. It requires security monitoring and emergency response mechanisms, prohibits storage and transmission of state secrets, and requires compliance management for applications integrating AI agents.

[Reference:

https://www.cac.gov.cn/2026-06/26/c_1784217637474922.htm?sessionid=]

2.上海市首个数据出境负面清单备案落地静安

6月26日，在静安区数据跨境服务中心的指导协助下，爱特思亚太企业管理有限公司顺利通过上海市网信办与上海市数据局的数据出境负面清单备案审核，并正式获得全市首份数据出境负面清单备案结果通知书。该通知书也是上海市数据出境负面清单管理办法及配套文件落地实施后，首次颁发的备案成果。爱特思亚太在日常运营中涉及大量跨国订单处理、客户沟通及供应链协同等数据交互需求，其会员信息出境原本需要申报数据出境安全评估。但根据负面清单新规要求，仅需完成个人信息出境标准合同备案即可，合规门槛明显降低。

【参见：

https://mp.weixin.qq.com/s/Q4k_aJLExeUoVX5aEf0ucg】

Shanghai’s First Negative List Filing for Cross-Border Data Transfer Implemented in Jing’an District

On June 26, with guidance and assistance from the Jing’an District Data Cross-Border Services Center, Aitec Asia Pacific Enterprise Management Co., Ltd. successfully passed the review for the filing of the negative list for cross-border data transfer conducted by the Shanghai Cyberspace Administration Office and Shanghai Data Bureau, and officially obtained the first negative list filing result notification issued in Shanghai. The notification is also the first filing result issued after the implementation of Shanghai’s negative list management measures for cross-border data transfer and related supporting documents. In its day-to-day operations, Aites Asia-Pacific handles a significant volume of data interactions, including the processing of cross-border orders, client communications and supply chain coordination. Previously, the transfer of its members’ information abroad required the submission of a data transfer security assessment. However, under the new regulations governing the negative list, it is now sufficient to complete the registration of a standard contract for the cross-border transfer of personal data, thereby significantly lowering the compliance threshold.

[Reference:

https://mp.weixin.qq.com/s/Q4k_aJLExeUoVX5aEf0ucg]

3.上海市网信办发布关于属地App个人信息收集使用问题的通报（2026年第三批-交通出行专项）

6月25日，上海市网信办发布关于属地App个人信息收集使用问题的通报（2026年第三批-交通出行专项），所涉应用存在超出必要范围收集使用个人信息、强制用户同意收集非必要个人信息、超出最低必要频率调用个人信息权限、告知收集使用个人信息目的、方式、范围与实际收集使用情况不一致、收集敏感个人信息未同步告知目的及必要性、处理敏感个人信息未取得个人的单独同意、未建立、公布个人信息安全投诉举报渠道、过度索要权限、隐私政策难以访问等违规情形。监管要求相关运营主体自通报发布起15个工作日内完成全面整改并报送整改材料，主管部门将复核验收，逾期整改不力将依法处置。

【参见：

https://mp.weixin.qq.com/s/jxSAjdneG8KY2Z7Bmj5XNQ?scene=1】

Shanghai Cyberspace Administration Office Releases Notice on Personal Information Collection and Use Issues of Local Apps (2026 Third Batch-Transportation Sector Special Campaign)

On June 25, the Shanghai Cyberspace Administration Office released the notice on personal information collection and use issues of local Apps (2026 Third Batch-Transportation Sector Special Campaign). The applications involved were found to have issues including collecting and using personal information beyond necessary scope, forcing users to consent to unnecessary personal information collection, accessing personal information permissions beyond the minimum necessary frequency, inconsistency between disclosed purposes, methods, and scope of collection and actual practices, failure to inform purposes and necessity when collecting sensitive personal information, failure to obtain separate consent for processing sensitive personal information, failure to establish and disclose personal information security complaint and reporting channels, excessive permission requests, and inaccessible privacy policies. Relevant operators are required to complete comprehensive rectification and submit rectification materials within 15 working days from the date of the notice. The competent authorities will conduct review and acceptance, and legal measures will be taken against failure to rectify.

[Reference:

https://mp.weixin.qq.com/s/jxSAjdneG8KY2Z7Bmj5XNQ?scene=1]

4.上海市通信管理局发布关于下架46款侵害用户权益行为APP（SDK）的通报

6月24日，上海市通信管理局发布关于下架46款侵害用户权益行为APP（SDK）的通报：针对本月专项整治中公示过的存在违规收集个人信息等侵害用户权益行为的APP/SDK，经复检仍有46款未落实整改，现统一采取下架处置。上海市通信管理局将对上述APP（SDK）持续跟踪，视情况进一步采取停止接入、行政处罚、纳入电信业务经营不良名单等处理措施。

【参见：

https://mp.weixin.qq.com/s/-GIQ6ELVGH9ppMkCIDDhDg】

Shanghai Communications Administration Issues Notice on Removal of 46 Apps (SDKs) Violating User Rights and Interests

On June 24, the Shanghai Communications Administration issued a notice on the removal of 46 Apps (SDKs) that violated users’ rights and interests. During the special rectification campaign, certain Apps/SDKs that had been publicly identified as violating user rights and interests, including illegal collection of personal information, were subject to re-inspection. A total of 46 Apps/SDKs were found to have failed to complete rectification requirements and were subject to unified removal measures. The Shanghai Communications Administration will continue to track the rectification status of the above Apps (SDKs) and may further take measures including suspension of access, administrative penalties, and inclusion in the list of entities with poor performance in telecommunications business operations depending on the circumstances.

[Reference:

https://mp.weixin.qq.com/s/-GIQ6ELVGH9ppMkCIDDhDg]

5.公安部计算机信息系统安全产品质量监督检验中心检测发现40款违法违规收集使用个人信息的移动应用

6月22日，公安部计算机信息系统安全产品质量监督检验中心完成移动应用专项检测，通报40款移动应用存在一项或者多项违法违规收集使用个人信息情况，共涉及11大类个人信息违规问题：含未成年人信息处理无监护人同意、未经授权采集信息、超范围索取权限、未提供注销通道、投诉渠道缺失、频繁弹窗广告、告知信息不实或不完整、收集敏感个人信息未告知使用目的、未设置易于理解、便于访问和操作的个性化推荐关闭选项等。此外，上期通报的41款违法违规移动应用，经复测仍有8款存在问题，相关移动应用分发平台已予以下架。

【参考：

https://mp.weixin.qq.com/s/ShTcWsTG5LLW4dDQDdpskg】

MPS Quality Supervision and Testing Center of Security Products for Computer Information Systems Detects 40 Mobile Applications Illegally Collecting and Using Personal Information

On June 22, the MPS Quality Supervision and Testing Center of Security Products for Computer Information Systems completed a special inspection of mobile applications and reported that 40 mobile applications had one or more violations involving the illegal or non-compliant collection and use of personal information. The identified violations involved 11 categories of personal information compliance issues, including processing minors’ information without guardian consent, unauthorized collection of information, excessive permission requests, failure to provide account cancellation channels, lack of complaint channels, frequent pop-up advertisements, inaccurate or incomplete disclosure information, failure to inform the purpose of collecting sensitive personal information, and failure to provide easily understandable, accessible, and operable options for disabling personalized recommendations. In addition, among the 41 mobile applications previously reported, 8 were still found to have issues after re-inspection, and relevant mobile application distribution platforms have removed them.

[Reference:

https://mp.weixin.qq.com/s/ShTcWsTG5LLW4dDQDdpskg]

1. 韩国PIPC公布2026年度个人信息处理政策评估计划

韩国个人信息保护委员会（PIPC）近日审议通过《2026年度个人信息处理政策评估计划》，并将自2026年6月末起对公共App、大学、招聘平台、婚恋服务、海外奢侈品牌、粉丝平台及加盟连锁等7个领域共52项服务开展评估。根据PIPC公告，本次评估将重点核查个人信息处理政策是否符合韩国《个人信息保护法》（PIPA）要求，包括处理目的、收集项目、保存期限、第三方提供、委托处理、跨境传输等内容是否充分、清晰披露，并将结合实际服务运营情况，评估处理政策的适当性、可读性、可访问性及与实际处理活动的一致性。PIPC表示，本次评估旨在提升个人信息处理透明度和问责性，并推动企业和机构主动完善隐私合规管理。

【参见：

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=&nttId=12130】

South Korea’s PIPC Announces 2026 Evaluation Plan for Personal Information Processing Policies

The Personal Information Protection Commission of Korea (PIPC) has approved its 2026 Evaluation Plan for Personal Information Processing Policies. Starting from late June 2026, the PIPC will assess 52 services across seven sectors, including public apps, universities, recruitment platforms, matchmaking services, foreign luxury brands, fandom platforms and franchise businesses. The evaluation will focus on whether privacy policies comply with the Personal Information Protection Act (PIPA), including whether they clearly disclose processing purposes, categories of personal information collected, retention periods, third-party provision, outsourcing and overseas transfers. The PIPC will also review whether the published policies are appropriate, readable, accessible and consistent with actual processing practices, with a view to enhancing transparency and accountability in personal information processing.

[Reference:

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=&nttId=12130]