每周数据法律资讯 Data Law Weekly（20260706—20260712）

1.国家金融监督管理总局就《银行业保险业网络安全管理办法（征求意见稿）》公开征求意见

7月10日，国家金融监督管理总局发布《银行业保险业网络安全管理办法（征求意见稿）》公开征求意见，意见反馈截止2026年8月10日。文件共计8章72条，围绕网络安全治理、网络安全建设和运行管理、网络安全风险监测、网络安全事件响应与处置、关键信息基础设施管理、监督管理等核心领域提出明确要求。充分考虑了银行业保险业金融机构的业务特点，推动落实网络安全保护责任，体现大网络安全的概念，强调全集团统一管理、科技与业务协同、三道防线协同共治的网络安全治理理念；体现分级分类管理，在对银行业保险业金融机构提出网络安全整体管理要求的基础上，针对关键信息基础设施管理提出更高要求。

【参见：https://www.nfra.gov.cn/cn/view/pages/ItemDetail.htmldocId=1264207&itemId=951&generaltype=2】 

NFRA Seeks Public Comments on “the Cybersecurity Management Measures for the Banking and Insurance Industries (Draft for Comments)”

On July 10, the NFRA issued a public consultation notice on “the Cybersecurity Management Measures for the Banking and Insurance Industries (Draft for Comments)”, with comments due by August 10, 2026. The draft consists of eight chapters and 72 articles, setting out requirements in key areas including cybersecurity governance, cybersecurity construction and operation management, cybersecurity risk monitoring, cybersecurity incident response and handling, critical information infrastructure management, and supervision. Taking into account the business characteristics of banking and insurance institutions, the draft promotes the implementation of cybersecurity protection responsibilities, reflects a comprehensive cybersecurity governance concept, and emphasizes unified group-level management, coordination between technology and business functions, and collaborative governance among the three lines of defense. The draft also adopts a differentiated and classified management approach, imposing higher requirements for critical information infrastructure management while establishing overall cybersecurity management requirements for banking and insurance institutions.

[Reference:

https://www.nfra.gov.cn/cn/view/pages/ItemDetail.html?docId=1264207&itemId=951&generaltype=2] 

2.上海市通信管理局启动2026年人工智能安全赋能专项行动

近日，上海市通信管理局正式启动2026年人工智能安全赋能专项行动。本次行动覆盖上海市电信和互联网行业中提供人工智能服务的各类主体，涵盖自主研发人工智能技术企业、利用人工智能技术对外提供产品或解决方案的企业，以及本市基础电信企业等。专项行动明确十三项主要任务：加强网络和数据安全管理组织建设；健全人工智能安全管理制度体系；厘清人工智能技术与应用服务安全责任主体；强化人工智能网络安全管理；深化人工智能数据安全管理；加大人工智能用户个人信息安全保护力度；严格人工智能业务与内容安全管理；夯实人工智能供应链安全管理；推进智能体安全管理；加强具身智能安全管理；提升人工智能安全应急处置能力；完善安全风险监测与威胁信息共享机制；增强行业整体安全防护能力。

【参见：

https://mp.weixin.qq.com/s/Pd2Tn9E2tr3Ju2FIuj0VHQ】 

Shanghai Communications Administration Launches 2026 Artificial Intelligence Security Empowerment Initiative

Recently, the Shanghai Communications Administration officially launched the 2026 Artificial Intelligence Security Empowerment Initiative. The initiative covers various entities providing artificial intelligence services in Shanghai’s telecommunications and internet industries, including enterprises independently developing artificial intelligence technologies, enterprises providing products or solutions based on artificial intelligence technologies, and basic telecommunications enterprises in Shanghai. The initiative sets out 13 key tasks, including strengthening cybersecurity and data security management structures; improving artificial intelligence security management systems; clarifying security responsibilities among artificial intelligence technology and application service providers; strengthening artificial intelligence cybersecurity management; enhancing artificial intelligence data security management; improving protection of users’ personal information in artificial intelligence applications; strengthening artificial intelligence business and content security management; reinforcing artificial intelligence supply chain security management; advancing AI agent security management; strengthening embodied intelligence security management; improving artificial intelligence security incident response capabilities; improving security risk monitoring and threat information sharing mechanisms; and enhancing overall industry security protection capabilities.

[Reference:

https://mp.weixin.qq.com/s/Pd2Tn9E2tr3Ju2FIuj0VHQ] 

3.国家计算机病毒应急处理中心通报72款违法违规收集使用个人信息移动应用

7月9日，国家计算机病毒应急处理中心通报72款违法违规收集使用个人信息移动应用，共有13大类典型违规情形，包括隐私政策提示不清晰、未在征得用户同意后才开始收集个人信息或打开可收集个人信息的权限，未提供有效的更正、删除个人信息及注销用户账号功能，投诉、举报未在承诺时限内受理并处理，未采取相应的加密、去标识化等安全技术措施，强制人脸识别、违规处理未成年人信息，隐私政策未逐一列出App收集使用个人信息的目的、方式、范围等。此外，上期通报的71款违法违规移动应用，经复测仍有28款存在问题，相关移动应用分发平台已予以下架。

【参见：

https://mp.weixin.qq.com/s/fdz9sgSDi_UA2ppQ2IeZMw】 

CVERC Reports 72 Mobile Applications for Illegal Collection and Use of Personal Information

On July 9, the CVERC reported 72 mobile applications involving illegal and non-compliant collection and use of personal information. The reported applications involved 13 categories of typical violations, including unclear privacy policy notices; collecting personal information or enabling permissions that allow personal information collection before obtaining user consent; failure to provide effective functions for correcting or deleting personal information and cancelling user accounts; failure to handle complaints and reports within the promised time limit; failure to implement necessary security measures such as encryption and de-identification; mandatory facial recognition; improper processing of minors’ personal information; and failure to specify in privacy policies the purposes, methods, and scope of personal information collection and use by applications. In addition, among the 71 mobile applications reported in the previous inspection, 28 applications were still found to have issues after re-testing, and relevant mobile application distribution platforms have removed them from their platforms.

[Reference:

https://mp.weixin.qq.com/s/fdz9sgSDi_UA2ppQ2IeZMw] 

4.上海市通信管理局开展2026年电信和互联网行业网络和数据安全全面检查

7月7日，上海市通信管理局下发开展2026年电信和互联网行业网络和数据安全检查的通知，检查对象涵盖提供公共互联网网络信息服务的基础电信企业、增值电信企业、互联网企业、域名注册服务机构等。重点核查关键信息基础设施、通信网络基础设施、公共云服务平台、域名服务系统、工业互联网平台、工业互联网标识解析系统、车联网平台及应用等。检查内容分为十大板块：网络和数据安全保障体系建设落实情况、通信网络安全防护工作落实情况、网络数据安全保护落实情况、车联网网络和数据安全防护情况、工业互联网企业网络安全防护情况、网络运行企业互联网暴露面情况、网络安全威胁监测情况、网络和数据安全事件应急处置情况、互联网基础资源管理情况、个人信息和用户权益保护工作情况。各单位须于8月15日前报送本单位上报文件和《网络安全检查总结报告》。

【参见：

https://mp.weixin.qq.com/s/5L6pgGrQrr32yUjlItz-lw】 

Shanghai Communications Administration Conducts Comprehensive Cybersecurity and Data Security Inspection for the Telecommunications and Internet Industries in 2026

On July 7, the Shanghai Communications Administration issued a notice on conducting cybersecurity and data security inspections for the telecommunications and internet industries in 2026. The inspection covers basic telecommunications enterprises providing public internet information services, value-added telecommunications enterprises, internet enterprises, domain name registration service providers, and other entities. The inspection focuses on key areas including critical information infrastructure, communication network infrastructure, public cloud service platforms, domain name service systems, industrial internet platforms, industrial internet identification and resolution systems, and connected vehicle platforms and applications. The inspection consists of ten major areas: implementation of cybersecurity and data security protection systems; implementation of communication network security protection requirements; implementation of network data security protection measures; cybersecurity and data security protection for connected vehicles; cybersecurity protection for industrial internet enterprises; internet exposure management of network operation enterprises; cybersecurity threat monitoring; emergency response to cybersecurity and data security incidents; management of basic internet resources; and protection of personal information and user rights. All relevant entities are required to submit relevant documents and the Cybersecurity Inspection Summary Report before August 15.

[Reference:

https://mp.weixin.qq.com/s/5L6pgGrQrr32yUjlItz-lw] 

5.中央网信办推进“清朗·整治AI应用乱象”专项行动第一阶段工作

7月6日，中央网信办通报“清朗·整治AI应用乱象”专项行动阶段性成效。该专项行动自4月启动，首阶段重点针对大模型未备案、AI审核能力不足、AI数据投毒、生成内容未标识等突出问题开展治理，累计处置违规网站、应用程序、智能体等AI产品1.4万余款，清理违法违规信息600余万条，处置账号2.6万余个，下架违规AI商品1300余个及违规开源数据集9个。下一步，中央网信办将聚焦利用AI技术制作发布虚假信息、散播暴力低俗等不良信息、假冒仿冒他人、侵害未成年人权益、从事网络水军活动等突出问题，启动专项行动第二阶段工作。

【参见：

https://mp.weixin.qq.com/s/swtDTDSKHwARU-ZpJLm7ZA】 

CAC Advances the First Phase of the “Qinglang Campaign: Rectification of AI Application Irregularities”

On July 6, the CAC announced the phased results of the “Qinglang Campaign: Rectification of AI Application Irregularities.” Launched in April, the first phase of the campaign focused on addressing prominent issues including failure to complete filing requirements for large language models, insufficient AI content review capabilities, AI data poisoning, and failure to implement labeling requirements for AI-generated content. During the first phase, more than 14,000 non-compliant AI products, including websites, applications, and AI agents, were handled; more than 6 million pieces of illegal and non-compliant information were removed; approximately 26,000 accounts were handled; more than 1,300 non-compliant AI products and nine non-compliant open-source datasets were removed. Going forward, CAC will focus on issues including using AI technologies to create and disseminate false information, spread violent or vulgar content, impersonate others, infringe upon minors’ rights and interests, and conduct online influence manipulation activities, and will launch the second phase of the campaign.

[Reference:

https://mp.weixin.qq.com/s/swtDTDSKHwARU-ZpJLm7ZA] 

1.欧盟就《生成式人工智能语境下网页爬虫指南》征求意见

7月8日，欧洲数据保护委员会发布《生成式人工智能语境下网页爬虫指南》草案，并公开征求意见。指南聚焦私营主体在开发生成式AI过程中开展的网页爬虫活动，涵盖机构自行或委托第三方开展网页爬虫，以及获取并复用第三方已爬取数据集两类典型场景，不涉及仅作为数据供应方且自身不训练AI模型的数据经纪商。指南进一步从抓取类型、网页内容和运行维护三个角度说明网页爬虫的技术形态，并明确网页爬虫涉及个人数据收集、存储、组织、检索等处理活动，应遵守《通用数据保护条例》（GDPR）要求，重点阐释处理个人数据的合法性基础（尤其是第6条第1款(f)项规定的正当利益）、特殊类别个人数据处理条件、透明度义务等合规要求。

【参见：

https://www.edpb.europa.eu/public-consultations/guidelines-032026-on-web-scraping-in-the-context-of-generative-ai_en#no-back】

EDPB Seeks Public Comments on “Guidelines 03/2026 on Web Scraping in the Context of Generative AI”

On July 8, the EDPB published the draft “Guidelines 03/2026 on web scraping in the context of generative AI” and launched a public consultation. The Guidelines focus on web scraping activities conducted by private entities in the development of generative AI, covering two typical scenarios: entities conducting web scraping independently or through third parties, and entities obtaining and reusing datasets previously scraped by third parties. The Guidelines do not apply to data brokers that only act as data suppliers and do not train AI models themselves. The Guidelines further explain the technical characteristics of web scraping from three perspectives: scraping types, web content, and operation and maintenance. They clarify that web scraping activities involving the collection, storage, organization, and retrieval of personal data constitute processing activities subject to the requirements of the General Data Protection Regulation (GDPR). The Guidelines primarily address compliance requirements concerning the legal basis for processing personal data, particularly legitimate interest under Article 6(1)(f) of the GDPR, conditions for processing special categories of personal data, and transparency obligations.

[Reference:

Guidelines 03/2026 on web scraping in the context of generative AI | European Data Protection Board]

2.EDPB发布《匿名化指南02/2026》征求意见稿

7月8日，欧洲数据保护委员会（EDPB）发布《匿名化指南02/2026》征求意见稿。指南更新2014年相关意见，明确匿名性应从各相关实体视角，结合其合理可能使用的识别手段判断，并提出情境化与简化两种评估路径。评估围绕“记录不可隔离、不可关联、不可推断”三项标准展开；三项均满足时，数据可视为匿名，任一未满足则需进一步分析再识别风险。匿名化过程本身仍须遵守GDPR，并应留存记录、定期复核。意见征集截至2026年10月30日。

【参见：

https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en#no-back】
 

EDPB Issues Guidelines 02/2026 on Anonymisation

On July 8, the European Data Protection Board (EDPB) published Guidelines 02/2026 on Anonymisation for public consultation. Updating its 2014 guidance, the Guidelines require anonymity to be assessed from each relevant entity’s perspective, considering the means reasonably likely to be used for identification. They introduce contextual and simplified assessment approaches based on three criteria: No Record Isolation, No Linkage and No Inference. Data meeting all three criteria may be considered anonymous; otherwise, further re-identification analysis is required. The anonymisation process itself remains subject to the GDPR and should be documented and periodically reassessed. Feedback is open until 30 October 2026.

[Reference:

https://www.edpb.europa.eu/public-consultations/guidelines-022026-on-anonymisation_en#no-back]