每周数据法律资讯 Data Law Weekly（20260824—20260830）

1.《道路交通安全法（修订草案）征求意见》，新增自动驾驶汽车专章规定

8月29日，《中华人民共和国道路交通安全法（修订草案）》正式公布，公开征求意见。草案新增第六章“自动驾驶汽车的特别规定”，明确自动驾驶汽车在自动驾驶功能激活状态下发生道路交通安全违法行为的，由自动驾驶汽车生产企业、进口企业接受处理。草案强调自动驾驶汽车生产企业采集、存储、传输车辆数据信息应当遵守有关法律、行政法规规定，确保自动驾驶汽车道路行驶安全、网络安全、数据安全和个人信息安全。

【参见：http://www.npc.gov.cn/flcaw/userIndex.html?lid=ff8081819ff54ab801a03d624f823cc3】

“Draft Amendment to the Road Traffic Safety Law” Seeks Public Comments; New Chapter on Autonomous Vehicles Added

On August 29, the “Draft Amendment to the Road Traffic Safety Law of the People’s Republic of China” was officially released for public comment. The draft adds a new Chapter 6 titled “Special Provisions on Autonomous Vehicles,” which stipulates that if a traffic violation occurs while an autonomous vehicle’s self-driving function is activated, the manufacturer or importer of the vehicle shall be held responsible for handling the matter. The draft emphasizes that manufacturers of autonomous vehicles must comply with relevant laws and administrative regulations when collecting, storing, and transmitting vehicle data, to ensure the safety of autonomous vehicles on the road, as well as cybersecurity, data security, and the security of personal information.

[Reference:

http://www.npc.gov.cn/flcaw/userIndex.html?lid=ff8081819ff54ab801a03d624f823cc3]

2.上海市通信管理局通报2026年第六批侵害用户权益行为APP（SDK）

8月26日，上海市通信管理局通报2026年第六批侵害用户权益行为APP（SDK），经抽查，共发现16款APP（SDK）存在侵害用户权益行为。上述APP（SDK）应立即进行整改，并对个人信息和用户权益保护工作开展全面自评估，自通报之日起5个工作日内提交整改报告和自评估报告；对未能在限期内完成整改并提交报告的，将依法依规予以处理。主要问题包括：未明示个人信息处理规则、未妥善处理用户投诉、账号注销难、违规收集个人信息。

【参见：

https://mp.weixin.qq.com/s/Dy15nWn7eu-Hbsw0aj8q8A】

Shanghai Communications Administration Issues Notice on the Sixth Batch of Apps (SDKs) Violating Users’ Rights and Interests in 2026

On August 26, the Shanghai Communications Administration issued a notice on the sixth batch of Apps (SDKs) violating users’ rights and interests in 2026. A total of 16 Apps (SDKs) were identified as violating users’ rights and interests through inspection. The relevant Apps (SDKs) are required to immediately rectify the identified issues and conduct a comprehensive self-assessment of personal information and user rights protection, and submit rectification reports and self-assessment reports within five working days from the date of the notice. Failure to complete rectification and submit the required reports within the prescribed period will result in regulatory action in accordance with the law and relevant regulations. The main issues include failure to clearly disclose personal information processing rules, improper handling of user complaints, difficulties in account cancellation, and unlawful collection of personal information.

[Reference:

https://mp.weixin.qq.com/s/Dy15nWn7eu-Hbsw0aj8q8A]

3.工业和信息化部通报26款侵害用户权益的APP及SDK

8月25日，工业和信息化部通报26款侵害用户权益的APP及SDK，要求相关企业按照有关规定进行整改；整改落实不到位的，将依法依规组织开展相关处置工作。检测出的主要问题包括：违规收集个人信息、违规使用个人信息、超范围收集个人信息、强制用户使用定向推送功能、APP强制、频繁、过度索取权限、信息窗口无法关闭、信息窗口点击乱跳转、APP频繁自启动和关联启动、违规提供自动续费服务、欺骗误导用户下载APP，以及SDK信息公示不到位等。

【参见：

https://mp.weixin.qq.com/s/L113aJxJjfRVqcRCuWvLKw】

MIIT Issues Notice on 26 Apps and SDKs Violating Users’ Rights and Interests

On August 25, the MIIT issued a notice on 26 Apps and SDKs violating users’ rights and interests, requiring the relevant companies to carry out rectification in accordance with relevant regulations; for those failing to implement rectification properly, relevant regulatory measures will be taken in accordance with the law and regulations. The main issues identified include unlawful collection of personal information, unlawful use of personal information, collection of personal information beyond the necessary scope, forcing users to use targeted recommendation functions, forcing users to grant permissions or requesting permissions excessively or frequently, pop-up information windows that cannot be closed, misleading redirection when clicking information windows, frequent self-starting and associated launching of Apps, unlawful provision of automatic renewal services, misleading users into downloading Apps, and inadequate disclosure of SDK information.

[Reference:

https://mp.weixin.qq.com/s/L113aJxJjfRVqcRCuWvLKw]

4.湖南常德市武陵区一公司因超范围收集个人敏感信息被行政处罚

8月25日，湖南省互联网信息办公室发布消息，常德市武陵区网信办接群众举报，对沈阳某达网络科技有限公司常德分公司开展专项核查，发现该公司在骑手求职招聘过程中，要求骑手拍摄含人脸及手持合同的视频，并由员工通过微信上传至总公司留存，存在超范围、过度收集个人敏感信息，未采取必要措施保障个人信息安全等问题。对此，依法对该公司作出责令改正、警告的行政处罚。该公司负责人承诺严格落实监管要求，清理存量人脸视频数据，规范个人信息全流程管理，严守数据安全合规底线。

【参见：

https://mp.weixin.qq.com/s/SMolTSieReAZk7K-uNuwnQ】

A Company in Wuling District, Changde, Hunan Province Penalized for Excessive Collection of Sensitive Personal Information

On August 25, the Cyberspace Administration of Hunan Province announced that, following a public complaint, the Cyberspace Administration of Wuling District, Changde, together with relevant authorities, conducted a special inspection of the Changde branch of Shenyang Da Network Technology Co., Ltd. The inspection found that, as part of the rider recruitment process, the company required riders to record videos showing their faces while holding their contracts, and employees subsequently uploaded the videos to the headquarters via WeChat for retention. The company was found to have collected sensitive personal information beyond the necessary scope and excessively, and failed to take necessary measures to ensure the security of personal information. Accordingly, the company was ordered to rectify the violations and was issued a warning. The company’s representative undertook to strictly implement regulatory requirements, delete retained facial video data, standardize the full lifecycle management of personal information, and ensure compliance with data security requirements.

[Reference:

https://mp.weixin.qq.com/s/SMolTSieReAZk7K-uNuwnQ]

5.《网络安全标准实践指南-个人用户使用人工智能服务安全指南》发布

8月24日，全国网络安全标准化技术委员会秘书处发布《网络安全标准实践指南-个人用户使用人工智能服务安全指南》，旨在指导个人用户更加安全地使用人工智能服务，防范化解相关安全风险。指南围绕“意识-使用-行为”三个层面，为个人用户通过互联网使用人工智能服务提供安全指引，具体包括安全意识提升、安全使用指引、使用行为准则等内容。同时，也可为人工智能服务的技术提供者、服务开发者、服务运营者保障个人用户的安全使用提供参考。

【参见：

https://mp.weixin.qq.com/s/df_SqnpCvxZgc3go0K3mmQ】

1.TikTok因儿童隐私保护缺陷在巴西被罚1.537亿雷亚尔（约2亿元人民币）

8月25日，巴西国家数据保护局（ANPD）认定TikTok控制方ByteDance Brasil在处理儿童和青少年个人数据过程中存在违规行为，并据此处以约1.537亿雷亚尔（约2亿元人民币）罚款。除罚款外，ANPD还要求TikTok删除违法收集的个人数据，并实施合规计划，加强对儿童和青少年个人数据的保护。ANPD认定的违法行为主要包括：在未注册信息流中处理儿童和青少年个人数据但缺乏有效法律依据、未采取措施防止13岁以下儿童在未注册信息流中被处理个人数据、在注册信息流中处理儿童和青少年个人数据但缺乏有效法律依据、未采取有效措施防止13岁以下儿童注册TikTok，以及未能证明已采取有效措施并遵守数据保护相关规定。

【参见：

https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-multa-tiktok-em-r-153-7-milhoes-por-falhas-na-protecao-de-dados-de-criancas-e-adolescentes】

TikTok Fined BRL 153.7 Million (Approximately RMB 200 Million) in Brazil for Deficiencies in Children’s Privacy Protection

On August 25, the Brazilian Data Protection Authority (ANPD) determined that ByteDance Brasil, the entity controlling TikTok, had violated applicable requirements in its processing of children’s and adolescents’ personal data and imposed a fine of approximately BRL 153.7 million (approximately RMB 200 million).In addition to the fine, ANPD required the company to delete unlawfully collected personal data and implement a compliance plan to strengthen the protection of children’s and adolescents’ personal data. The violations identified by ANPD mainly included processing children’s and adolescents’ personal data in the unregistered feed without a valid legal basis, failing to take measures to prevent the processing of personal data of children under 13 in the unregistered feed, processing children’s and adolescents’ personal data in the registered feed without a valid legal basis, failing to take effective measures to prevent children under 13 from registering for TikTok, failing to demonstrate that effective measures had been taken and that data protection requirements had been complied with.

[Reference:

https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-multa-tiktok-em-r-153-7-milhoes-por-falhas-na-protecao-de-dados-de-criancas-e-adolescentes]
 

2.英国ICO发布《匿名化、假名化与研究指南》征求意见稿

8月24日，英国信息专员办公室（ICO）就《匿名化、假名化与研究指南》征求意见，指南聚焦研究、归档和统计目的下个人数据的匿名化、假名化及安全使用。ICO强调，应首先判断能否使用匿名信息；如无法满足研究目的，可考虑假名化，并结合可信研究环境（TRE）、隐私增强技术、访问控制及输出审核等措施降低重新识别风险。指南同时指出，假名化数据仍属于数据保护法适用范围，匿名化是否有效需结合数据本身、接收者及可合理获得的其他信息进行判断，并特别关注文本、语音、图像、视频及传感器数据等可能产生的间接识别风险。

【参见：

https://ico.org.uk/media2/goaamspg/draft-guidance-on-the-use-of-anonymisation-and-pseudonymisation-for-research-purposes.pdf】
 

UK ICO Publishes the “Guidance on Anonymisation, Pseudonymisation and Research” (Draft for Public Consultation)

On August 24, the UK Information Commissioner’s Office (ICO) published the “Guidance on Anonymisation, Pseudonymisation and Research” (Draft for Public Consultation) for public consultation. The guidance focuses on the anonymisation, pseudonymisation, and secure use of personal data for research, archiving, and statistical purposes. The ICO emphasizes that organisations should first consider whether anonymised information can be used; where this cannot meet the research purpose, pseudonymisation may be considered, together with measures such as Trusted Research Environments (TREs), privacy-enhancing technologies, access controls, and output review to reduce re-identification risks. The guidance also notes that pseudonymised data remains subject to data protection law, and that whether anonymisation is effective should be assessed based on the data itself, the recipient, and other information that can reasonably be obtained, with particular attention to potential indirect identification risks involving text, voice, images,video, and sensor data.

[Reference:

https://ico.org.uk/media2/goaamspg/draft-guidance-on-the-use-of-anonymisation-and-pseudonymisation-for-research-purposes.pdf]
 

3.越南发布网络安全与个人数据保护行政处罚规定

8月19日，越南政府发布第330/2026/ND-CP号法令，并于同日生效。该法令针对违反个人数据处理原则、同意要求、数据主体权利、个人数据保护影响评估、跨境传输及数据保护人员指定等行为规定行政处罚。例如，未经有效同意处理个人数据可被处以3000万至5000万越南盾罚款；将沉默视为同意，或在数据主体要求停止、限制处理后仍继续处理的，可被处以5000万至7000万越南盾罚款。上述罚款标准原则上适用于个人，组织实施同类违法行为的罚款通常为个人的两倍。法令还规定删除违法处理的数据、返还违法所得、公开道歉等补救措施。

【参见：

https://baochinhphu.vn/muc-xu-phat-vi-pham-hanh-chinh-doi-voi-hanh-vi-vi-pham-ve-bao-ve-du-lieu-ca-nhan-102260822154959691.htm】

Vietnam Issues New Administrative Penalties for Cybersecurity and Personal Data Protection Violations

On August 19, the Vietnamese Government issued Decree No. 330/2026/ND-CP, which took effect on the same day. The Decree establishes administrative penalties for violations involving data processing principles, consent, data subject rights, personal data protection impact assessments, cross-border data transfers and the appointment of data protection personnel. Processing personal data without valid consent may attract fines of VND 30–50 million, while treating silence as consent or continuing processing after a request to stop or restrict processing may result in fines of VND 50–70 million. These amounts generally apply to individuals, while organizations are typically subject to twice the corresponding fines. Corrective measures may include irreversible deletion of unlawfully processed data, disgorgement of unlawful gains and public apologies.

[Reference:

https://baochinhphu.vn/muc-xu-phat-vi-pham-hanh-chinh-doi-voi-hanh-vi-vi-pham-ve-bao-ve-du-lieu-ca-nhan-102260822154959691.htm]