每周数据法律资讯 Data Law Weekly（20260720—20260726）

1.国家网信办发布2026年7月数据出境安全管理政策法规问答

7月24日，国家网信办发布数据出境安全管理官方政策问答，围绕个人信息出境告知同意、数据出境安全评估结果延期、招聘场景下境内求职者简历出境的必要性判断等实践问题进行解答，进一步明确数据出境合规要求。问答明确，在招聘场景中，应按照最小必要原则判断境内求职者简历出境的必要性；如境外总部或关联机构直接参与录用决策，应依法履行数据出境相关合规义务。

【参见：

https://mp.weixin.qq.com/s/hGnHBJmM_UUF4kJHkKa02A】
 

CAC Releases July 2026 Policy Q&A on Data Export Security Management

On July 24, the CAC released official policy Q&A on data export security management, addressing practical issues including notification and consent requirements for cross-border transfers of personal information, extension of validity periods for security assessment results for cross-border data transfers, and necessity assessments for exporting resumes of domestic job applicants in recruitment scenarios, further clarifying compliance requirements for cross-border data transfers. The Q&A clarifies that in recruitment scenarios, the necessity of exporting domestic job applicants’ resumes shall be assessed in accordance with the principle of data minimization. Where overseas headquarters or affiliated entities directly participate in recruitment decisions, relevant compliance obligations for cross-border data transfers shall be fulfilled.

[Reference:

https://mp.weixin.qq.com/s/hGnHBJmM_UUF4kJHkKa02A]

2.国家网信办、公安部公布《小型个人信息处理者个人信息保护简化措施规定》

7月24日，国家网信办、公安部联合发布《小型个人信息处理者个人信息保护简化措施规定》，自2026年9月1日起施行。规定共二十二条，适用于处理不满10万人个人信息的小型个人信息处理者，支持采取与其规模、能力相适应的简化措施履行个人信息保护义务。规定明确个人信息处理规则、告知义务、个人行使权利、个人信息出境、合规审计、个人信息保护影响评估、管理制度和应急预案等方面的简化要求。规定同时明确了监督检查以及依法不予处罚、从轻或者减轻处罚等规则，进一步降低小型个人信息处理者合规成本。

【参见：

https://mp.weixin.qq.com/s/OCI48kkh1kVK39hOHXeZ7A】

CAC and MPS Issue “Provisions on Simplified Personal Information Protection Measures for Small Personal Information Processors”

On July 24, the CAC and MPS jointly issued “the Provisions on Simplified Personal Information Protection Measures for Small Personal Information Processors”, which will take effect on September 1, 2026. Consisting of 22 articles, the Provisions apply to small Personal Information Processors processing personal information of fewer than 100,000 individuals, and support them in fulfilling personal information protection obligations through simplified measures appropriate to their scale and capabilities. The Provisions specify simplified requirements regarding personal information processing rules, notification obligations, individuals’ exercise of rights, cross-border transfers of personal information, compliance audits, personal information protection impact assessments, management systems, and emergency plans. The Provisions also clarify rules on supervision and inspection, as well as circumstances where penalties may be waived, reduced, or mitigated, further reducing compliance costs for small Personal Information Processors.

[Reference:

https://mp.weixin.qq.com/s/OCI48kkh1kVK39hOHXeZ7A]

3.上海市通信管理局发布关于下架64款侵害用户权益行为APP（SDK）的通报

7月22日，上海市通信管理局发布关于下架64款侵害用户权益行为APP（SDK）的通报，在前期合规专项整治中，监管部门已向存在违规行为的应用运营企业下发整改通知并组织复检核查，经复核仍有64款APP（SDK）未按要求完成整改，监管部门依法对上述APP（SDK）采取下架处理。上海市通信管理局表示，将持续跟踪整改情况，并视情况进一步采取停止接入、行政处罚、纳入电信业务经营不良名单等处理措施。

【参见：

https://mp.weixin.qq.com/s/vlf9MWi5FpZ7nnX-kQkYSw】
 

Shanghai Communications Administration Issues Notice on Removing 64 APPs (SDKs) Involving Violations of Users’ Rights and Interests

On July 22, the Shanghai Communications Administration issued a notice on removing 64 APPs (SDKs) involving violations of users’ rights and interests. During the previous compliance rectification campaign, regulatory authorities had issued rectification notices to application operators with violations and conducted follow-up inspections. After review, 64 APPs (SDKs) were found to have failed to complete rectification as required, and regulatory authorities removed the relevant APPs (SDKs) in accordance with the law. The Shanghai Communications Administration stated that it will continue to track rectification progress and may further take measures including suspension of access, administrative penalties, and inclusion in the list of entities with poor records in telecommunications business operations, depending on the circumstances.

[Reference:

https://mp.weixin.qq.com/s/vlf9MWi5FpZ7nnX-kQkYSw]

4.中央网信办启动为期4个月“清朗·未成年人网络保护”专项行动

近日，中央网信办在全国范围内部署开展为期4个月的“清朗·未成年人网络保护”专项行动，进一步加强未成年人网络保护，营造健康安全的网络环境。本次专项行动分两个阶段开展。第一阶段为暑期网络环境治理，聚焦信息内容生产传播全流程、全链条，重点整治发布、互动、营销三个环节突出问题，包括利用AI技术恶搞经典动画形象、制作传播低俗有害内容，诱导未成年人泄露隐私、参与不良互动，以及诱导未成年人消费、诈骗等问题。第二阶段聚焦侵扰未成年人身心健康的网络信息治理，重点规范平台推荐行为、学习教育板块和未成年人模式建设，排查不良信息传播、诱导沉迷消费、未成年人隐私侵害等风险，督促网站平台落实主体责任，完善算法推荐、内容审核及未成年人保护机制。

【参见：

https://mp.weixin.qq.com/s/8_vZginvZjIHLf9RERTy1A】
 

CAC Launches Four-Month “Qinglang·Online Protection of Minors” Special Action

Recently, the CAC deployed a four-month “Qinglang·Online Protection of Minors” Special Action nationwide to further strengthen online protection for minors and create a healthy and secure online environment. The Special Action will be carried out in two phases. The first phase focuses on summer online environment governance, targeting prominent issues across the entire process and chain of online information production and dissemination, with key efforts addressing problems in content publishing, interaction, and marketing, including the use of AI technology to distort classic animation characters, create and disseminate vulgar or harmful content, induce minors to disclose private information or participate in inappropriate interactions, and encourage minors to make purchases or fall victim to online fraud. The second phase focuses on regulating online information that harms minors’ physical and mental well-being, including platform recommendation practices, educational content sections, and the development of minors’ modes, while investigating risks such as dissemination of harmful information, inducement of excessive consumption, and infringement of minors’ privacy. The CAC will urge online platforms to fulfill their primary responsibilities and improve algorithm recommendation, content review, and minors’ protection mechanisms.

[Reference:

https://mp.weixin.qq.com/s/8_vZginvZjIHLf9RERTy1A]

1.韩国PIPC对TikTok、苹果关联企业合计罚款105.58亿韩元

7月23日，韩国个人信息保护委员会（PIPC）发布重大行政处罚决定，对TikTok韩国运营主体及苹果旗下两家韩国关联公司个人信息违规行为作出处罚，合计罚款105.58亿韩元。其中，TikTok因违规通过TikTok Pixel等第三方行为追踪工具收集用户行为信息，并将其与用户账户关联用于定向广告推送；同时，在个性化广告授权及跨境个人信息传输过程中存在未单独获取同意、未充分履行告知义务等问题，被处以103.06亿韩元罚款。苹果旗下两家韩国关联公司因语音数据处理及跨境传输合规问题被处以2.52亿韩元罚款。PIPC本次处罚进一步明确了用户单独授权、跨境个人信息传输合规要求，对互联网企业开展韩国业务具有重要参考意义。

【参见：

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12330】

Korea PIPC Imposes KRW 10.558 Billion Fine on TikTok and Apple Affiliates

On July 23, the Personal Information Protection Commission (PIPC) of Korea issued major administrative sanctions against TikTok’s Korean operating entity and two Korean affiliates of Apple for violations involving the processing of personal information, imposing a total fine of KRW 10.558 billion. TikTok was fined KRW 10.306 billion for collecting users’ behavioral information through third-party tracking tools such as TikTok Pixel without proper compliance procedures and linking such information with user accounts for targeted advertising. TikTok was also found to have failed to obtain separate consent and provide sufficient notification requirements in relation to personalized advertising authorization and cross-border transfers of personal information. Two Korean affiliates of Apple were fined KRW 252 million for compliance issues involving voice data processing and cross-border transfers. The PIPC’s decision further clarifies compliance requirements regarding separate user consent and cross-border transfers of personal information, providing important guidance for internet companies conducting business in Korea.

[Reference:

https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12330]

2.新加坡PDPC发布《生成式AI个人数据使用咨询指南》

7月20日，新加坡个人数据保护委员会发布《生成式AI个人数据使用咨询指南》，明确生成式AI场景下《个人数据保护法》的适用要求。指南围绕生成式AI生命周期提出合规要求：一是明确企业通过网络抓取（web scraping）获取包含个人数据的数据集用于AI训练时，可在符合条件情况下考虑适用“公开可得例外”，但仍需评估数据来源及相关法律义务；二是指出用于大规模生成式AI训练时，一般性隐私通知通常不足，企业应提供针对AI用途的专项告知；三是将相关主体划分为模型提供商、系统提供商和系统部署者，明确不同主体的数据保护责任；四是强调企业即使面临模型数据难以删除等技术挑战，仍需履行个人访问、更正等权利义务，并采取数据治理和技术措施降低风险。

【参见：

https://files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532e-4cca-9a77-bcc0415ca294.pdf】

Singapore PDPC Issues “Advisory Guidelines on Use of Personal Data in Generative AI”

On July 20, the Personal Data Protection Commission (PDPC) of Singapore issued the Advisory Guidelines on Use of Personal Data in Generative AI, clarifying the application of the Personal Data Protection Act (PDPA) in generative AI scenarios. The Guidelines establish compliance requirements throughout the generative AI lifecycle: first, they clarify that when organizations obtain datasets containing personal data through web scraping for AI training, they may consider relying on the “Publicly Available Exception” where applicable, while still assessing data sources and other legal obligations; second, they state that general privacy notices are generally insufficient for large-scale generative AI training, and organizations should provide AI-specific notifications; third, they classify relevant participants into Model Providers, System Providers, and System Deployers, clarifying the data protection responsibilities of different parties; fourth, they emphasize that organizations must continue to fulfill individuals’ rights, including access and correction rights, even when facing technical challenges such as difficulties in deleting data from models, and should adopt data governance and technical measures to mitigate risks.

[Reference:

https://files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532e-4cca-9a77-bcc0415ca294.pdf]

3.欧盟委员会依据《数字服务法》对AliExpress处以5.5亿欧元罚款

7月20日，欧盟委员会依据《数字服务法》作出行政处罚决定，对跨境电商平台AliExpress处以5.5亿欧元罚款，并要求其采取整改措施。欧盟委员会调查认定，AliExpress未充分履行DSA项下系统性风险评估义务，未有效识别和评估平台传播非法、不安全及假冒商品所带来的风险，包括未合理评估商品审核资源与实际需求之间的不匹配问题，未充分评估推荐系统和广告机制对违规商品传播的影响，且风险评估缺乏有效量化指标。同时，AliExpress未采取充分措施降低已识别的系统性风险，平台商品审核机制未能有效阻止假冒商品、不安全玩具及危险化妆品等违规商品持续传播，违规商家处罚机制执行不到位，商品分类审核和品牌授权机制存在漏洞，导致部分违规商品持续流通。根据DSA要求，AliExpress须于2026年10月20日前向欧盟委员会提交整改行动计划，说明其针对风险评估、商品审核及违规处置机制采取的改进措施。如未落实相关整改要求，欧盟委员会可进一步采取周期性罚款等措施。

【参见：

https://digital-strategy.ec.europa.eu/en/news/commission-fines-aliexpress-eu550-million-breaching-digital-services-act】

European Commission Fines AliExpress €550 Million for Violating “the Digital Services Act”

On July 20, the European Commission imposed an administrative fine of €550 million on cross-border e-commerce platform AliExpress under the Digital Services Act (DSA) and required it to take rectification measures. The European Commission found that AliExpress failed to adequately fulfill its obligations regarding systemic risk assessment under the DSA and did not effectively identify and assess risks arising from the dissemination of illegal, unsafe, and counterfeit products on its platform. The Commission found that AliExpress failed to properly assess the mismatch between product moderation resources and actual needs, inadequately evaluated the impact of recommender systems and advertising mechanisms on the dissemination of illegal products, and lacked effective quantitative indicators in its risk assessments. In addition, AliExpress failed to take sufficient measures to mitigate identified systemic risks. Its product moderation mechanisms failed to effectively prevent the continued circulation of counterfeit products, unsafe toys, and dangerous cosmetics; its penalty mechanisms for non-compliant traders were insufficiently enforced; and vulnerabilities in product categorization review and brand authorization mechanisms allowed certain non-compliant products to remain available. Under the DSA, AliExpress must submit an action plan to the European Commission by October 20, 2026, setting out measures to improve risk assessment, product moderation, and violation handling mechanisms. Failure to implement the required rectification measures may result in further actions, including periodic penalty payments.

[Reference:

https://digital-strategy.ec.europa.eu/en/news/commission-fines-aliexpress-eu550-million-breaching-digital-services-act]