每周数据法律资讯 Data Law Weekly（20260817—20260823）

1.全国网安标委发布《网络安全标准实践指南-座舱数据处理安全要求（征求意见稿）》

8月20日，全国网络安全标准化技术委员会发布《网络安全标准实践指南-座舱数据处理安全要求（征求意见稿）》，面向社会公开征求意见。该实践指南从座舱数据处理基本要求出发，针对典型功能场景下的座舱数据处理活动提出细化安全要求，重点涉及数据默认不出车、默认不收集和最小必要、用户同意与知情权，以及语音交互、车内图像与视频、远程查看、数据保存与删除等场景，为座舱数据处理者规范开展相关活动、保护个人信息主体权益提供参考。

【参见：

https://mp.weixin.qq.com/s/EMV92mMCdPUv0omp9ZuWzQ】

National Technical Committee 260 on Cybersecurity of SAC Releases “Cybersecurity Standard Practice Guide-Security Requirements for Cabin Data Processing (Draft for Public Comment)”

On August 20, the National Technical Committee 260 on Cybersecurity of SAC released the “Cybersecurity Standard Practice Guide-Security Requirements for Cabin Data Processing (Draft for Public Comment)” for public comment. The Practice Guide sets out basic requirements for cabin data processing and specifies detailed security requirements for data processing activities in typical functional scenarios, focusing on requirements including keeping data within the vehicle by default, default non-collection and data minimization, user consent and the right to be informed, as well as voice interaction, in-vehicle images and video, remote viewing, and data retention and deletion. It provides a reference for cabin data processors to conduct relevant activities in a compliant manner and protect the rights and interests of personal information subjects.

[Reference:

https://mp.weixin.qq.com/s/EMV92mMCdPUv0omp9ZuWzQ]
 

2.上海市通信管理局通报下架9款侵害用户权益行为APP（SDK）

8月20日，上海市通信管理局发布通报，依据相关法律法规及专项行动要求，已对APP（SDK）违法违规收集使用个人信息等问题开展治理；经对2026年7月公示的相关APP（SDK）进行整改复检，9款APP未按照要求落实整改，监管部门现对上述APP（SDK）采取下架处理，并将视情况进一步采取停止接入、行政处罚、纳入电信业务经营不良名单等措施。

【参见：

https://mp.weixin.qq.com/s/AHRt0FmWRzNJ45dPL8cPvA】

Shanghai Communications Administration Issues Notice on the Removal of 9 Apps (SDKs) Violating Users’ Rights and Interests

On August 20, the Shanghai Communications Administration issued a notice stating that, in accordance with relevant laws and regulations and the requirements of the special campaign, it had carried out governance efforts targeting violations involving the illegal collection and use of personal information by apps (SDKs). Following a review of the rectification of relevant apps (SDKs) publicly identified in July 2026, nine apps (SDKs) were found to have failed to complete the required rectification and have therefore been removed. The Shanghai Communications Administration will continue to monitor the rectification and may take further measures, including suspension of network access, administrative penalties, and inclusion on the list of telecommunications business operators with poor records, as appropriate.

[Reference:

https://mp.weixin.qq.com/s/AHRt0FmWRzNJ45dPL8cPvA]

3.国家网信办就《网络数据安全风险评估办法》实施有关事项答记者问

8月20日，《网络数据安全风险评估办法》正式施行，国家互联网信息办公室有关负责人就办法实施有关事项回答记者提问，明确评估机构可向已备案《数据安全风险评估服务认证规则》的认证机构申请服务认证；重要数据处理者应在年度风险评估完成后的20个工作日内，按照有关主管部门要求报送风险评估报告，主管部门不明确的，可向省级网信部门或者国家网信部门报送，国家和省级网信部门已公布相关联系电话供重要数据处理者咨询。

【参见：

https://mp.weixin.qq.com/s/egA1aT69x014H_Y3rrzmUw】

CAC Issues Q&A on the Implementation of the “Measures for Cyber Data Security Risk Assessment”

On August 20, the “Measures for Cyber Data Security Risk Assessment” officially took effect. The CAC issued a Q&A on its implementation, clarifying that assessment institutions may apply for service certification from certification bodies that have filed the “Certification Rules for Data Security Risk Assessment Services”. Data processors processing important data are required to submit risk assessment reports within 20 working days after completing their annual risk assessment, in accordance with the requirements of the relevant competent authorities. Where the competent authority is unclear, the report may be submitted to the provincial or national cyberspace administration authority. Contact information for national and provincial cyberspace administration authorities has also been provided for consultation.

[Reference:

https://mp.weixin.qq.com/s/egA1aT69x014H_Y3rrzmUw]

4.中央网信办、工业和信息化部、公安部通报2026年个人信息保护系列专项行动取得阶段性成效

8月19日，中央网信办、工业和信息化部、公安部发布消息称，2026年个人信息保护系列专项行动开展以来，累计对2万余款App、SDK开展个人信息收集使用情况核查检测，督促4000余款完成合规整改，公开通报1100余款存在违法违规问题的App、SDK，对400余款采取下架等处置处罚措施；同时，针对个人信息处理规则、广告和用户画像等问题，对1000余家企业和机构相关产品开展核查检测，并在教育、交通、卫生健康、金融等领域累计摸排9万余家企业和机构，发现并督促整改各类隐患问题1.2万余个。下一步，三部门将深入推进专项行动，加强典型违法违规问题治理，持续夯实个人信息保护工作基础。

【参见：

https://mp.weixin.qq.com/s/78kJBtp3-QdDYHglE-zFJA?scene=1&click_id=529319139】

CAC, MIIT and MPS Report on the Initial Results of the 2026 Special Campaign on Personal Information Protection

On August 19, the CAC, MIIT and MPS reported that, since the launch of the 2026 Special Campaign on Personal Information Protection, more than 20,000 apps and SDKs have been inspected for the collection and use of personal information, with more than 4,000 completing compliance rectification. More than 1,100 apps and SDKs with violations have been publicly notified, and more than 400 have been subject to measures including removal. In addition, more than 1,000 companies and institutions have undergone inspections of relevant products concerning personal information processing rules, advertising and user profiling, while more than 90,000 companies and institutions in sectors including education, transportation, healthcare and finance have been screened, identifying and requiring rectification of more than 12,000 security risks. The three authorities will continue to advance the special campaign and strengthen the governance of typical violations.

[Reference:

https://mp.weixin.qq.com/s/78kJBtp3-QdDYHglE-zFJA?scene=1&click_id=529319139]

1.美国司法部与TikTok和字节跳动达成4亿美元和解协议，以解决儿童隐私诉讼

8月21日，美国司法部宣布与TikTok、字节跳动及其关联实体（以下简称“TikTok”）达成4亿美元的和解协议，以解决有关其违反《儿童在线隐私保护法》（COPPA）及其执行条例的诉讼。根据和解协议，TikTok将立即支付3亿美元，并在法院颁布撤销此前针对TikTok前身Musical.ly的同意令的命令后，再支付1亿美元。该和解协议是COPPA案件中迄今为止金额最高的赔偿之一。

【参见：

https://www.justice.gov/opa/pr/justice-department-secures-400m-settlement-tiktok-and-bytedance-resolve-childrens-privacy】

U.S. Justice Department Secures $400M Settlement with TikTok and ByteDance to Resolve Children’s Privacy Litigation

On August 21, the U.S. the Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated entities (TikTok) resolving litigation concerning compliance with the Children’s Online Privacy Protection Act and its implementing regulations (COPPA). Under the settlement, TikTok will pay $300 million immediately and an additional $100 million upon entry of an order vacating a prior consent decree entered against TikTok’s predecessor, Musical.ly. The settlement represents one of the largest recoveries ever obtained in a COPPA case.

[Reference:

https://www.justice.gov/opa/pr/justice-department-secures-400m-settlement-tiktok-and-bytedance-resolve-childrens-privacy]

2..韩国国会通过《个人信息保护法》修正案，新设人工智能开发个人信息利用特例

8月20日，韩国个人信息保护委员会（PIPC）发布消息称，《个人信息保护法》部分修正法律案通过国会全体会议。修正案在现行个人信息处理依据之外另设人工智能技术开发个人信息利用特例，并配以事前审查与事后管理机制。特例适用须同时满足三项要件：仅凭匿名或假名处理难以完成人工智能技术开发；已采取与人工智能学习环境相适应的强化安全保障措施；有助于增进公益与社会利益，且对信息主体和第三方的利益侵害显著较低。相关特例原则上自法律公布之日起满6个月后施行。

【参见：

https://www.korea.kr/briefing/pressReleaseView.do?newsId=156774994&sessionid=#pressRelease】

Korean National Assembly Passes Amendments to the “Personal Information Protection Act”, Establishing a Special Provision for the Use of Personal Information in AI Development

On August 20, the PIPC of Korea announced that amendments to the “Personal Information Protection Act” had passed the plenary session of the National Assembly. The amendments establish a special provision for the use of personal information in AI technology development in addition to the existing legal bases for processing personal information, together with prior review and post-use management mechanisms. The special provision requires three conditions to be met: AI technology development cannot be completed solely using anonymized or pseudonymized information; enhanced security measures appropriate to the AI learning environment have been established; and the use contributes to the public interest and social benefits while causing significantly limited harm to the interests of data subjects and third parties. The special provision is generally scheduled to take effect six months after promulgation of the law.

[Reference:

https://www.korea.kr/briefing/pressReleaseView.do?newsId=156774994&sessionid=#pressRelease]