每周数据法律资讯 Data Law Weekly（20260629—20260705）

1.市场监管总局、商务部就《中华人民共和国电子商务法（修正草案征求意见稿）》公开征求意见

7月4日，市场监管总局、商务部就《中华人民共和国电子商务法（修正草案征求意见稿）》公开征求意见。本次修订共二十条，主要内容包括五个方面：一是扩大法律调整范围。在当前平台和平台内经营者基础上，进一步明确平台经济其他参与主体的权利义务。二是健全平台责任制度。在当前的定额罚、责令停业整顿的基础上，丰富规制手段，支撑常态化监管。三是明确监管合力工作机制。针对平台经济跨界混业经营，增加线下线上业务归口管理一致原则，强化部门联动、央地协同的一体化监管。四是规范电子商务突出违法行为。五是深化电子商务开放合作。推动电子商务领域规则、规制、管理、标准同国际相通相容，加强行业自律，引导有序出海，增加对外反制措施，维护企业合法权益。

【参见：

https://www.samr.gov.cn/hd/zjdc/art/2026/art_41b16f1123ee4cd7acf892bb8bed5fe0.html】 

SAMR and MOFCOM Solicit Public Comments on “the Draft Amendments to the E-Commerce Law of the People’s Republic of China”

On July 4, the SAMR and MOFCOM Solicit Public Comments on “the Draft Amendments to the E-Commerce Law of the People’s Republic of China”. The draft contains 20 proposed amendments covering five key areas. First, it expands the scope of regulation by clarifying the rights and obligations of other participants in the platform economy beyond platform operators and on-platform business operators. Second, it improves the platform liability regime by introducing additional regulatory measures beyond fixed monetary penalties and business suspension orders to support routine supervision. Third, it establishes a coordinated regulatory mechanism by reinforcing the principle of consistent oversight for online and offline businesses and strengthening cooperation among competent authorities at both central and local levels. Fourth, it further regulates prominent unlawful practices in e-commerce. Fifth, it promotes greater openness and international cooperation by advancing alignment of e-commerce rules, regulation, governance, and standards with international practices, strengthening industry self-regulation, supporting the orderly expansion of enterprises overseas, introducing countermeasures against external restrictions, and safeguarding the legitimate rights and interests of enterprises.

[Reference:

https://www.samr.gov.cn/hd/zjdc/art/2026/art_41b16f1123ee4cd7acf892bb8bed5fe0.html] 

2.国家数据局发布《数据产权登记工作指引（试行）》

7月4日，国家数据局发布《数据产权登记工作指引（试行）》，共六章四十二条。文件搭建全国统一数据产权登记体系，明确数据持有权、使用权、经营权三类产权定义，划定登记机构准入硬性标准，规范初次、转让、变更、续期、注销五类登记全流程。区分党政机关履职数据、公共数据授权运营产品、公用企业数据三类差异化登记规则，细化数据来源合规性、产权明确性、个人信息及重要数据安全等审查要求，明确登记凭证可用于数据交易、资产入表、融资担保及纠纷举证，同时规定登记机构因过失或故意承担赔偿责任、申请人欺诈需担责、监管人员渎职依法追责，压实各方主体责任，为全国数据要素流通确权提供规范依据。

【参见：

https://mp.weixin.qq.com/s/cdOi12Q4eIbfLiI0r4szcQ】 
 

NDA Releases “the Guidelines for Data Property Rights Registration (Trial)”

On July 4, the NDA released “the Guidelines for Data Property Rights Registration (Trial)”, consisting of six chapters and 42 articles. The Guidelines establish a nationwide unified data property rights registration system, define three categories of data rights-data holding rights, data use rights, and data operation rights-set mandatory qualification requirements for registration authorities, and standardize the procedures for initial registration, transfer,modification, renewal, and deregistration. The Guidelines also provide differentiated registration rules for government data generated in the performance of official duties, authorized public data products, and public utility enterprise data, while specifying review requirements relating to lawful data sources, clear ownership, protection of personal information, and the security of important data. Registration certificates may be used to support data transactions, asset recognition, financing and security interests, and evidence in dispute resolution. The Guidelines further clarify the legal liabilities of registration authorities for negligence or intentional misconduct, applicants for fraudulent registration, and regulators for dereliction of duty, thereby strengthening accountability and providing a standardized framework for confirming data rights and facilitating the circulation of data elements nationwide.

[Reference:

https://mp.weixin.qq.com/s/cdOi12Q4eIbfLiI0r4szcQ] 

3.国家网信办就《互联网信息服务管理办法（修订草案征求意见稿）》再次公开征求意见

7月3日，国家网信办就《互联网信息服务管理办法（修订草案征求意见稿）》二次征求意见，意见反馈截止2026年8月2日。全文共6章94条，厘清了多个部门监管分工；完善互联网信息服务提供者管理要求，进一步完善准入条件、规范网络资源使用、强化从业人员管理等；强化互联网信息服务活动管理规定，进一步加强用户账号管理、完善网络信息内容规范等，并针对特定情形新增制度要求；压实网络平台主体责任，要求具有较大影响力的互联网用户公众账号生产运营者不得制作、复制、发布、传播含有法律、行政法规禁止内容的信息和不良信息等；促进智能信息服务安全和发展，对应用人工智能技术提供互联网信息服务的情形进行专门规范；健全了法律责任制度和监管措施。

【参见：

https://mp.weixin.qq.com/s/TfYZaC8ULPvu9JeTqYGkKg】 

CAC Launches Second Public Consultation on “the Revised Measures for the Administration of Internet Information Services”

On July 3, the CAC released the second draft for public consultation of “the Measures for the Administration of Internet Information Services (Revised Draft)”, with the deadline for comments set for August 2, 2026. The draft consists of six chapters and 94 articles. It clarifies regulatory responsibilities among multiple government departments, improves requirements for internet information service providers including market entry conditions, standardized use of network resources, and strengthened personnel management. It further enhances regulatory provisions on internet information services by strengthening user account management and improving content governance rules, and introduces additional provisions for specific scenarios. The draft reinforces platform accountability by requiring operators of influential public accounts to refrain from producing, copying, publishing, or disseminating illegal or harmful content prohibited by laws and administrative regulations. It also promotes the safe development of intelligent information services by setting out dedicated rules for internet information services using AI technologies, while improving legal liability and supervisory mechanisms.

[Reference:

https://mp.weixin.qq.com/s/TfYZaC8ULPvu9JeTqYGkKg] 

4.中国人民银行、国家金融监督管理总局、中国证监会就《金融业网络安全管理办法（征求意见稿）》公开征求意见

7月3日，央行、国家金融监督管理总局、中国证监会就《金融业网络安全管理办法（征求意见稿）》公开征求意见。全文共五章三十三条，明确金融业网络安全总体要求与行业自律规范。第一章总则，明确制定依据、适用范围、网络安全保护总体要求和行业自律要求；第二章网络安全保护义务，明确网络运行安全、网络数据保护、网络个人信息保护总体要求，对网络安全工作责任制、网络安全治理、网络安全等级保护、商用密码使用、技术创新应用、信息服务安全管理等作出原则规定，提出金融业关键信息基础设施认定要求，并从组织架构、履职保障、供应链安全、风险评估、网络安全事件应急预案等方面对运营者提出特别合规要求；第三章监督管理协同，明确国务院金融管理部门监督管理协同原则、专项任务协同落实等内容；第四章对违反《办法》的法律责任作出规定；第五章附则中明确了相关术语定义、解释权、生效期等内容。

【参见：

https://www.csrc.gov.cn/csrc/c101981/c7643145/content.shtml】 
 

PBC, NFRA and CSRC Solicit Public Comments on “the Measures for Cybersecurity Administration in the Financial Sector”

On July 3, the PBC, NFRA and CSRC jointly released “the Measures for Cybersecurity Administration in the Financial Sector (Draft for Comments)”. The draft contains five chapters and 33 articles, setting out the overall requirements and industry self-regulatory framework for cybersecurity in the financial sector. Chapter I (General Provisions) defines the legal basis, scope of application, overall cybersecurity protection requirements, and industry self-regulation principles. Chapter II (Cybersecurity Protection Obligations) sets out general requirements for network operation security, network data protection, and personal information protection, and establishes principles on cybersecurity responsibility systems, governance, classified protection of cybersecurity, use of commercial cryptography, technological innovation, and information service security management. It also sets requirements for the identification of critical information infrastructure in the financial sector, and imposes additional compliance obligations on operators in areas such as organizational structure, duty performance safeguards, supply chain security, risk assessment, and incident response planning. Chapter III defines supervisory coordination mechanisms among financial regulators under the State Council. Chapter IV sets out legal liabilities for violations. Chapter V contains supplementary provisions including terminology definitions, interpretative authority, and effective date.

[Reference:

https://www.csrc.gov.cn/csrc/c101981/c7643145/content.shtml] 

5.工信部通报2026年第4批侵害用户权益APP及SDK

7月2日，工业和信息化部通报2026年第4批侵害用户权益APP及SDK，共32款APP/SDK存在违规收集个人信息、强制、频繁、过度索取权限、信息窗口无法关闭、信息窗口点击乱跳转、APP频繁自启动和关联启动、SDK信息公示不到位等问题。上述APP及SDK应按有关规定进行整改，整改落实不到位的，工信部将依法依规组织开展相关处置工作。

【参见：

https://mp.weixin.qq.com/s/G78E18tu1YG6gdRSMGNQhw】 

MIIT Reports the Fourth Batch of APPs and SDKs Infringing User Rights and Interests in 2026

On July 2, the MIIT released the fourth batch of APPs and SDKs found to infringe user rights and interests in 2026, identifying 32 apps and SDKs with violations such as unlawful collection of personal information, forced, frequent or excessive permission requests, non-closable pop-up windows, misleading redirects triggered by information windows, frequent self-start and mutual wake-up behavior, and insufficient disclosure of SDK information. The identified apps and SDKs are required to complete rectification in accordance with relevant regulations, and MIIT stated that it will take further regulatory actions in accordance with the law against entities failing to implement corrective measures.

[Reference:

https://mp.weixin.qq.com/s/G78E18tu1YG6gdRSMGNQhw] 

6.全国网安标委发布《网络安全标准实践——智能体部署使用安全指引》

7月1日，全国网安标委发布《网络安全标准实践——智能体部署使用安全指引》，指导使用者安全部署使用智能体，降低相关安全风险隐患。该实践指南给出了评估、准备、部署、使用、停用等阶段的智能体部署使用安全指引，适用于智能体部署使用的安全风险防范，也可为选择使用商业智能体服务提供参考。

【参见：

https://mp.weixin.qq.com/s/HlIeJuUMJzmjc4TBlcCktg】 

TC260 Releases “the Cybersecurity Standard Practice-Security Guidelines for the Deployment and Use of AI Agents”

On July 1, the TC260 released “the Cybersecurity Standard Practice-Security Guidelines for the Deployment and Use of AI Agents”, providing guidance for the secure deployment and use of AI agents and reducing associated security risks. The Guidelines provide security recommendations across the full lifecycle of AI agents, including assessment, preparation, deployment, operation, and decommissioning. They are applicable to risk prevention in AI agent deployment and use, and may also serve as a reference for selecting commercial AI agent services.

[Reference:

https://mp.weixin.qq.com/s/HlIeJuUMJzmjc4TBlcCktg] 

7.国家能源局印发《能源行业数据分类分级指南（2026年版）》

6月30日，国家能源局印发《能源行业数据分类分级指南（2026年版）》，共4章15条，自7月1日正式实施。第一章为总则，介绍指南的目的依据、适用范围和总体原则；第二章明确能源行业数据分类和分级规则，以及衍生数据、脱敏数据的分级规则；第三章明确能源行业重要数据、核心数据的识别规则；第四章为附则，包括名词解释、补充修订、解释权及生效日期。指南明确，与《能源行业数据安全管理办法（试行）》保持一致的相关定义，并进一步细化重要数据与核心数据的认定标准，其中部分重要能源设施的精确地理坐标、实时控制指令及能源消费类数据被纳入重要数据和核心数据范围。

【参见：

https://www.nea.gov.cn/20260630/3b456b6f83144abcb989110dcfba4d7d/c.html】 

NEA Issues “the Guidelines for Data Classification and Grading in the Energy Sector (2026 Edition)”

On June 30, the NEA issued “the Guidelines for Data Classification and Grading in the Energy Sector (2026 Edition)”, consisting of four chapters and 15 articles, which entered into force on July 1. Chapter I sets out the purpose, legal basis, scope of application, and general principles of the Guidelines. Chapter II defines data classification and grading rules in the energy sector, including rules for derived data and anonymized data. Chapter III specifies the identification criteria for important and core data in the energy sector. Chapter IV contains supplementary provisions, including terminology definitions, revision procedures, interpretative authority, and effective date. The Guidelines maintain consistency with the existing Energy Industry Data Security Management Measures (Trial) and further refine criteria for identifying important and core data. Certain data, including precise geographic coordinates of key energy facilities, real-time control instructions, and energy consumption data, are explicitly included within the scope of important and core data.

[Reference:

https://www.nea.gov.cn/20260630/3b456b6f83144abcb989110dcfba4d7d/c.html] 

8.上海市通信管理局通报2026年第四批侵害用户权益行为APP（SDK）

6月29日，上海市通信管理局通报2026年第四批侵害用户权益行为APP（SDK），共76款APP（SDK）存在侵害用户权益行为，包括未明示个人信息处理规则、未妥善处理用户投诉、账号注销难、强制、频繁、过度索取权限、强制用户使用定向推送功能等问题。相关主体应立即整改，并开展全面自评估，在通报之日起5个工作日内提交书面整改报告及自评估报告。

【参见：

https://mp.weixin.qq.com/s/P2yWBibG71w1De1a7qrF0Q】 

Shanghai Communications Administration Announces the Fourth Batch of APPs and SDKs Infringing User Rights and Interests in 2026

On June 29, the Shanghai Communications Administration announced the fourth batch of APPs and SDKs found to infringe user rights and interests in 2026, identifying 76 apps and SDKs with violations including failure to disclose personal information processing rules, inadequate handling of user complaints, difficulty in account cancellation, forced, frequent or excessive permission requests, and compulsory use of targeted push notification functions. Relevant operators are required to immediately rectify the issues, conduct a comprehensive self-assessment, and submit written rectification and assessment reports within five working days from the date of notification.

[Reference:

https://mp.weixin.qq.com/s/P2yWBibG71w1De1a7qrF0Q] 

1.法国国家信息与自由委员会发布网联车辆地理位置数据合规专项指引

6月30日，法国国家信息与自由委员会发布第2026-063号决议配套指引，废止2010年旧有规范，将车辆定位信息明确界定为高度敏感个人数据。该指引围绕数据收集、存储、传输及匿名化等环节，系统设置全链条合规要求，包括严格落实数据最小化原则、限定存储期限、隐私设计原则以及强化加密与访问控制措施。同时，针对车辆防盗、事故救援、车队运营及产品优化等四类核心应用场景，分别明确适用的合法处理依据。此外，该指引对车载远程设备与数据聚合平台提出专项安全要求，明确定位数据匿名化技术标准，并对自然人再识别风险提出防控措施。对于涉及大规模地理位置数据处理的活动，必须开展数据保护影响评估，以降低对个人出行隐私的潜在风险。

【参见：

https://www.legifrance.gouv.fr/download/file/cgoT2shUC4j_CSVUsEOCvSHZAROah7GQaBDs48fbpng=/JOE_TEXTE】

French Data Protection Authority Releases Dedicated Guidance on Compliance for Geolocation Data of Connected Vehicles

On June 30, the French Data Protection Authority issued Decision No.2026-063 and accompanying guidance, repealing its 2010 framework and classifying vehicle geolocation data as highly sensitive personal data. The guidance establishes end-to-end compliance requirements covering data collection, storage, transmission, and anonymization, including strict application of data minimization principles, limitation of retention periods, privacy-by-design requirements, and strengthened encryption and access control measures. It further identifies four key use cases—vehicle theft prevention, accident assistance, fleet management, and product optimization—and specifies the applicable legal bases for each scenario. The guidance also introduces dedicated security requirements for onboard telematics devices and data aggregation platforms, defines technical standards for geolocation anonymization, and addresses risks of re-identification. Where large-scale geolocation data processing is involved, data protection impact assessments (DPIAs) are required to mitigate privacy risks associated with individuals’ mobility patterns.

[Reference:

https://www.legifrance.gouv.fr/download/file/cgoT2shUC4j_CSVUsEOCvSHZAROah7GQaBDs48fbpng=/JOE_TEXTE]

2.欧盟理事会正式批准简化修订版《人工智能法案》

6月29日，欧盟理事会通过《人工智能法案》修订简化方案，对高风险人工智能系统的g规定适用时间作出调整：独立式高风险系统适用时间延后至2027年12月2日，嵌入产品中的高风险人工智能系统适用时间延后至2028年8月2日。同时，新增禁止性规定，自2026年12月起禁止未经同意生成或变造性相关深度伪造内容以及儿童性虐待相关人工智能图像。在监管结构方面，该修订进一步明确欧盟人工智能办公室与成员国监管机构之间的职责分工，并减少行业专项法规与《人工智能法案》之间的重复合规要求。针对机械设备等部分产品类别，允许在特定条件下适用豁免规则。该修订将在欧盟官方公报发布后第三日生效，旨在为企业提供更清晰的过渡期安排，同时确保高风险人工智能系统的监管要求顺利落地实施。

【参见：

https://www.consilium.europa.eu/en/press/pressreleases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/】

Council of the European Union Formally Approves the Simplified Amendments to the “AI Act”

On June 29, the Council of the European Union adopted a simplified amendment package to the EU Artificial Intelligence Act, adjusting the implementation timeline for high-risk AI systems: standalone high-risk systems will become applicable on December 2, 2027, while high-risk AI systems embedded in regulated products will become applicable on August 2,2028. The amendment also introduces a new prohibition effective from December 2026, banning the generation or manipulation of non-consensual sexual deepfakes and AI-generated child sexual abuse material. In terms of governance structure, the reform further clarifies the division of responsibilities between the EU AI Office and national supervisory authorities and reduces overlapping compliance requirements arising from sectoral legislation. Certain product categories, including machinery-related systems, may benefit from limited exemptions under specified conditions. The amendment will enter into force on the third day following its publication in the Official Journal of the European Union, providing a clearer transition period while ensuring the orderly enforcement of high-risk AI governance rules.

[Reference:

https://www.consilium.europa.eu/en/press/pressreleases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/]