每周数据法律资讯 Data Law Weekly（20260810—20260816）

1.国家计算机病毒应急处理中心检测发现75款违法违规收集使用个人信息的移动应用

8月14日，国家网络安全通报中心发布通报称，国家计算机病毒应急处理中心检测发现75款移动应用存在违法违规收集使用个人信息问题。主要问题包括隐私政策未完整说明个人信息收集使用情况、向第三方提供个人信息未依法告知并取得单独同意、未经同意收集个人信息或开启权限、未提供便捷的个人信息更正、删除及撤回同意机制、自动化决策未提供非个性化选项或便捷拒绝方式、未依法保护未成年人个人信息、跨境提供个人信息未依法履行告知及单独同意义务，以及未采取加密、去标识化等安全技术措施等。此外，上期通报的72款违法违规移动应用经复测仍有24款存在问题，相关应用分发平台已予以下架。

【参见：

https://mp.weixin.qq.com/s/zxQxAyWVlfwriHGT6XzS9g】

National Computer Virus Emergency Response Center Detects 75 Mobile Apps Illegally Collecting and Using Personal Information

On August 14, the National Cybersecurity Incident Response Center reported that the National Computer Virus Emergency Response Center had detected 75 mobile apps with violations involving the collection and use of personal information. Key issues included incomplete disclosure of personal information collection and use in privacy policies, failure to provide notice and obtain separate consent before providing personal information to third parties, collecting personal information or enabling permissions without consent, failure to provide convenient mechanisms for correction, deletion and withdrawal of consent, failure to provide non-personalized options or convenient opt-out mechanisms for automated decision-making, inadequate protection of minors’ personal information, failure to fulfill notification and separate consent requirements for cross-border provision of personal information, and failure to implement security measures such as encryption and de-identification. In addition, 24 of the 72 apps identified in the previous notice were still found to have issues upon re-testing and have been removed from the relevant app distribution platforms.

[Reference:

https://mp.weixin.qq.com/s/zxQxAyWVlfwriHGT6XzS9g]

2.上海网信办集中约谈6家重点平台要求履行未成年人网络保护责任

8月13日，上海市网信办根据中央网信办部署要求，组织对属地网络音视频、网络文学、网络游戏、网络社交、电商及AI平台等开展巡查抽检，并依法集中约谈6家问题较为突出的平台。此次巡查发现的主要问题包括平台显著位置推送低俗内容、重要环节呈现违法和不良内容，以及未成年人模式落实不到位等。下一步，上海市网信办将依据《未成年人网络保护条例》，加大对网络平台的常态化巡查、抽检和执法力度，对屡改屡犯、问题突出的平台依法从严处置。

【参见：

https://mp.weixin.qq.com/s/fQVHDBKGOud1-mfHUvRTCg】
 

Shanghai Cyberspace Administration Holds Meetings with Six Major Platforms and Requires Them to Fulfill Their Responsibilities for Protecting Minors Online

On August 13, the Shanghai Cyberspace Administration, in accordance with the requirements of the Cyberspace Administration of China, conducted inspections and spot checks of local online audio and video, online literature, online gaming, social networking, e-commerce and AI platforms, and held meetings with six platforms with relatively prominent issues in accordance with the law. The inspection identified issues including the prominent placement of vulgar content, the display of illegal and harmful content in key areas, and inadequate implementation of minors modes. The Shanghai Cyberspace Administration will further strengthen regular inspections, spot checks and enforcement against online platforms in accordance with the Regulation on the Protection of Minors Online, and take stricter action against platforms with recurring or serious violations.

[Reference:

https://mp.weixin.qq.com/s/fQVHDBKGOud1-mfHUvRTCg]
 

3.国家网信办发布个人信息保护政策法规问答（2026年8月）

8月12日，国家网信办发布《个人信息保护政策法规问答（2026年8月）》，围绕个人信息保护实践中的代表性问题进行解答。其中明确，处理个人自行公开或其他已合法公开的个人信息，应当在合理范围内进行，个人明确拒绝的除外；对个人权益有重大影响的，应当依法取得个人同意。同时，针对个人信息泄露问题，指出常见原因包括个人信息明文存储和传输、未采取适当的加密和去标识化措施，存储个人信息的信息系统、数据库存在弱口令或缺少登录验证，通过互联网访问的数据接口未采取有效身份验证措施，以及网站页面泄露关联信息系统、数据库的登录账号和口令等。同步重申《个人信息保护法》中分类管理、加密、去标识化、应急处置等安全义务。

【参见：

https://mp.weixin.qq.com/s/nutO-ubnXLoNjOSjQLJrAw】
 

CAC Releases August 2026 Policy and Regulatory Q&A on Personal Information Protection

On August 12, the CAC released the Policy and Regulatory Q&A on Personal Information Protection (August 2026), addressing representative issues arising in personal information protection practices. It clarifies that the processing of personal information voluntarily disclosed by individuals or otherwise lawfully made public shall be conducted within a reasonable scope, except where the individual has expressly refused, and that consent shall be obtained where the processing has a significant impact on the individual’s rights and interests. The Q&A also identifies common causes of personal information breaches, including storing and transmitting personal information in plaintext, failure to implement appropriate encryption and de-identification measures, weak passwords or inadequate login verification in information systems and databases, failure to implement effective identity verification for data interfaces accessible through the internet, and disclosure of login credentials for related information systems and databases through website pages. It also reiterates security obligations under the “Personal Information Protection Law”, including classified management, encryption, de-identification and emergency response.

[Reference:

https://mp.weixin.qq.com/s/nutO-ubnXLoNjOSjQLJrAw]
 

4.公安部网安局公布打击侵犯公民个人信息犯罪10起典型案例

8月11日，公安部网安局发布打击侵犯公民个人信息犯罪10起典型案例，涉及以高薪兼职注册营业执照为名骗取个人身份信息、收购实名网络账号、电商订单解密、非法获取房产中介经纪人及学生信息、买卖装修及住客信息、非法获取开房记录和出行轨迹，以及以“私家侦探”为名实施非法调查等犯罪行为。相关案件非法获取公民个人信息数量从数千条至600万余条不等，涉案金额最高达1100余万元。网安局提示，《刑法》及相关司法解释进一步明确了侵犯公民个人信息犯罪的量刑标准，以及不同类型个人信息认定“情节严重”的数量及金额标准，广大群众应妥善保管、储存和使用个人信息，发现个人信息泄露线索应及时向公安机关和有关部门投诉举报。

【参见：

https://mp.weixin.qq.com/s/rbW_V3nuQ9x5axcLHw6pwg】

MPS Cybersecurity Bureau Releases 10 Typical Cases of Crimes Involving Infringement of Citizens’ Personal Information

On August 11, the Cybersecurity Bureau of the Ministry of Public Security released 10 typical cases involving crimes against citizens’ personal information. The cases involved obtaining personal identity information under the guise of high-paying part-time jobs for business license registration, purchasing verified online accounts, decrypting e-commerce orders, illegally obtaining information on real estate agents and students, trading renovation and guest information, illegally obtaining hotel stay records and travel trajectories, and conducting illegal investigations under the guise of being a “private investigator.” The amount of personal information illegally obtained in these cases ranged from several thousand records to more than 6 million records, with the highest amount involved exceeding RMB 11 million. The Cybersecurity Bureau noted that the Criminal Law and relevant judicial interpretations further clarify sentencing standards for crimes involving infringement of citizens’ personal information, as well as the quantitative and monetary thresholds for determining “serious circumstances” for different types of personal information.

[Reference:

https://mp.weixin.qq.com/s/LMxTR_nJ5Ai1hwvqbSIx3g]

5.安徽省通信管理局发布关于侵害用户权益APP的通报（2026年第5批）

8月11日，安徽省通信管理局发布关于侵害用户权益APP的通报（2026年第5批）》。此前，安徽省通信管理局发现21款APP存在违法违规收集使用个人信息问题，并于6月23日向相关开发者下达责令改正通知书。截至目前，仍有6款APP未完成整改，主要涉及违规收集、超范围收集个人信息，以及欺骗误导强迫用户、强制、频繁、过度索取权限等问题。相关开发者应于8月17日前完成整改，逾期不整改的，将依法依规开展相关处置工作。

【参见：

https://mp.weixin.qq.com/s/e153mUPlcX_XqoVLHN4Zig】

Anhui Communications Administration Issues Notice on Apps Violating Users’ Rights and Interests (2026 Fifth Batch)

On August 11, the Anhui Communications Administration issued the Notice on Apps Violating Users’ Rights and Interests (2026 Fifth Batch). Previously, the Anhui Communications Administration identified 21 apps with violations involving the collection and use of personal information and issued rectification orders to the relevant developers on June 23. As of now, six apps have still failed to complete rectification, with issues mainly involving unlawful or excessive collection of personal information, as well as misleading or coercive practices and mandatory, frequent or excessive requests for permissions. The relevant developers are required to complete rectification by August 17, failing which further action will be taken in accordance with applicable laws and regulations.

[Reference:

https://mp.weixin.qq.com/s/e153mUPlcX_XqoVLHN4Zig]
 

1.波兰UODO发布AI系统GDPR合规初步检查清单

近日，波兰数据保护局（UODO）发布四套AI系统合规初步问题清单，帮助组织在开发或使用AI系统前识别与GDPR相关的数据保护问题。清单分别适用于中小企业、公共部门及其他组织，并提供涵盖《人工智能法案》（AI Act）风险分类和基本权利影响评估等事项的扩展版本。UODO强调，该清单不具有约束力，不能替代风险评估、数据保护影响评估（DPIA）或基本权利影响评估。

【参见：

UODO – Zanim wdrożysz narzędzie AI, sprawdź czy jest ono zgodne z zasadami RODO】

Poland UODO Publishes Preliminary GDPR Compliance Checklists for AI Systems

Recently, the Polish Data Protection Office (UODO) published four preliminary checklists to help organizations identify GDPR-related data protection issues before developing or using AI systems. The checklists cover SMEs, public-sector entities and other organizations, with an extended version also addressing AI Act risk classification and fundamental rights impact assessments. UODO emphasized that the checklists are non-binding and do not replace risk assessments, data protection impact assessments (DPIAs), or fundamental rights impact assessments..

[Reference:

UODO – Zanim wdrożysz narzędzie AI, sprawdź czy jest ono zgodne z zasadami RODO]