每周数据法律资讯 Data Law Weekly（20260907—20260913）

1.国家网信办发布《数据出境安全管理政策法规问答（2026年9月）》

9月11日，国家互联网信息办公室发布《数据出境安全管理政策法规问答（2026年9月）》，就个人信息出境认证相关问题作出进一步说明。问答明确，非关键信息基础设施运营者自当年1月1日起累计向境外提供10万人以上、不满100万人个人信息（不含敏感个人信息）或不满1万人敏感个人信息，且不包括重要数据的，可以通过个人信息出境认证履行数据出境合规义务；已通过认证但后续出境规模达到100万人以上个人信息或1万人以上敏感个人信息的，应申报数据出境安全评估，认证结果可作为安全评估的参考。个人信息处理者申请出境认证前，仍应依法履行告知、取得个人单独同意、开展个人信息保护影响评估等义务。

【参见：

数据出境安全管理政策法规问答（2026年9月）】

CAC Issues the “Q&A on Policies and Regulations for Data Export Security Management (September 2026)”

On September 11, the CAC issued the “Q&A on Policies and Regulations for Data Export Security Management (September 2026)”, providing further clarification on issues concerning certification for cross-border transfers of personal information. The Q&A clarifies that non-critical information infrastructure operators that cumulatively provide overseas recipients with personal information of 100,000 or more but fewer than 1 million individuals (excluding sensitive personal information), or sensitive personal information of fewer than 10,000 individuals, from January 1 of the relevant year, and that do not involve important data, may fulfill data export compliance obligations through personal information export certification. Where an entity that has obtained such certification subsequently reaches the threshold of 1 million or more individuals for personal information or 10,000 or more individuals for sensitive personal information, it must apply for a data export security assessment, and the certification results may be taken into consideration during the assessment. Before applying for certification, personal information processors must still fulfill legal obligations including informing individuals, obtaining separate consent, and conducting a personal information protection impact assessment.

[Reference:

数据出境安全管理政策法规问答（2026年9月）]
 

2.上海多部门协同执法筑牢未成年人网络保护防线

9月11日，上海市委网信办发布消息，就今年7月以来“亮剑浦江·2026”专项执法行动成果进行通报。专项行动期间，累计约谈属地互联网平台12次；市区两级文化执法部门巡查网络游戏企业193家，受理处置投诉举报181件，开展送法上门29次、合规指导25次、约谈企业14家次，立案查处案件12件；公安网安部门侦破涉未成年人网络暴力等违法案件10余起；检察机关办理涉未成年人相关犯罪及民事、行政、公益诉讼案件50余件。通报的典型案例涵盖AI情感陪伴类应用生成低俗内容、未成年人模式下传播不良商品和价值观内容、AI生成绕过防沉迷系统攻略、网络平台未履行不良内容显著提示义务等问题，相关部门依法采取罚款、警告、约谈、责令整改等措施，督促平台完善未成年人身份识别、内容审核、未成年人模式及AI安全治理机制。

【参见：

亮剑浦江·2026｜上海多部门协同执法筑牢未成年人网络保护防线】

Shanghai Multiple Departments Coordinate Law Enforcement to Strengthen Online Protection of Minors

On September 11, the Shanghai Cyberspace Administration released an update on the results of the “Liangjian Pujiang·2026” special law enforcement campaign launched in July. During the campaign, relevant authorities conducted 12 rounds of interviews with local internet platforms. Municipal and district-level cultural enforcement authorities inspected 193 online game enterprises, handled 181 complaints and reports, conducted 29 on-site legal guidance sessions and 25 compliance guidance sessions, interviewed enterprises 14 times, and filed 12 cases for investigation and punishment. Public security cyber authorities solved more than 10 cases involving online violence against minors and other violations, while procuratorial authorities handled more than 50 criminal, civil, administrative and public interest litigation cases involving minors. Typical cases involved AI emotional companionship applications generating vulgar content, dissemination of inappropriate products and values in minor modes, AI-generated guides for circumventing anti-addiction systems, and platforms failing to provide prominent warnings for inappropriate content. Relevant authorities imposed fines, warnings, interviews and rectification orders, and urged platforms to improve minor identification, content review, minor modes and AI safety governance mechanisms.

[Reference:

亮剑浦江·2026｜上海多部门协同执法筑牢未成年人网络保护防线]

3.最高法发布《关于依法审理涉人工智能纠纷案件的意见》

9月7日，最高人民法院发布《关于依法审理涉人工智能纠纷案件的意见》，《意见》分为5个部分，共24条，主要内容包括：一是明确涉人工智能纠纷案件审理的指导思想和基本原则，坚持以人为本、支持创新发展、筑牢安全防线；二是依法规制利用人工智能的侵权行为，明确涉人工智能侵权责任的归责原则，并对侵害人格权、个人信息权益、消费者权益，以及生成式人工智能服务提供者、人工智能产品、自动驾驶和辅助驾驶功能汽车等相关责任作出规定；三是依法审理涉人工智能知识产权纠纷案件，明确侵权责任认定、开源软件法律责任、专利授权确权、技术合同履行以及数据使用规范等规则；四是探索完善审理程序规则、依法惩治违法犯罪行为，完善涉人工智能纠纷案件的事实查明和证据审查规则，并对利用人工智能不当取证、提供虚假材料等妨害司法秩序行为作出规制；五是健全完善涉人工智能纠纷案件审理和工作机制，围绕矛盾纠纷预防化解、调研论证、案例指导和审判监督指导、部门协作和国际司法交流合作等方面作出规定。

【参见：

最高法发布《关于依法审理涉人工智能纠纷案件的意见》】

Supreme People’s Court Issues the “Opinions on the Adjudication of Disputes Involving Artificial Intelligence in Accordance with the Law”

On September 7, the Supreme People’s Court issued the “Opinions on the Adjudication of Disputes Involving Artificial Intelligence in Accordance with the Law”. The Opinions consist of five parts and 24 articles. Key provisions include: clarifying the guiding principles for adjudicating disputes involving artificial intelligence, including putting people first, supporting innovation and development, and strengthening security safeguards; regulating infringements involving the use of artificial intelligence, including clarifying the principles for determining liability and addressing infringements of personality rights, personal information rights and interests, and consumer rights and interests, as well as liability involving providers of generative artificial intelligence services, artificial intelligence products, and autonomous and assisted-driving vehicles; establishing rules for adjudicating intellectual property disputes involving artificial intelligence, including rules on infringement liability, open-source software, patent granting and invalidation, performance of technology contracts, and data use; improving rules on fact-finding and evidence review and regulating the use of artificial intelligence for improper evidence collection or the submission of false materials; and improving mechanisms for the adjudication of disputes involving artificial intelligence, including dispute prevention and resolution, case guidance, judicial supervision, inter-departmental cooperation, and international judicial exchanges and cooperation.

[Reference:

最高法发布《关于依法审理涉人工智能纠纷案件的意见》]

1.加州州长签署AB 1709法案，禁止向16岁以下用户提供部分成瘾性平台功能

9月10日，加州州长Gavin Newsom签署Assembly Bill 1709。法案规定，受规制平台不得向16岁以下用户提供“成瘾性功能”，包括成瘾性信息流、自动播放以及未来由法规定义的其他功能，并须采取合理措施防止向未成年人提供上述功能。法案同时授权州总检察长制定实施和执法法规，对不合规平台设置民事责任，并在加州司法部设立e-Safety Advisory Commission。法案旨在保护未成年人免受算法推荐、无限滚动和自动播放等设计诱导的强迫性使用。

【参见：

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1709】
 

The Governor of California Signs AB 1709 to Prohibit Certain Addictive Platform Features for Users Under 16

On September 10, California Governor Gavin Newsom signed Assembly Bill 1709. The bill prohibits covered platforms from providing users under 16 with “addictive features”, including addictive feeds, autoplay, and other features that may be defined by future regulations, and requires covered platforms to take reasonable measures to prevent minors from being provided with such features. The bill also authorizes the Attorney General to adopt regulations for implementation and enforcement, establishes civil liability for non-compliant platforms, and establishes an e-Safety Advisory Commission within the California Department of Justice. The bill aims to protect minors from compulsive use induced by designs such as algorithmic recommendations, infinite scrolling and autoplay.

[Reference:

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1709]
 

2.欧盟：互联产品“设计即访问”要求开始适用

爱尔兰竞争与消费者保护委员会（CCPC）提示，欧盟《数据法》的“设计即访问”要求适用于2026年9月12日后投放欧盟市场的互联产品及相关服务，包括智能手表、智能家居设备、联网医疗设备、工业机械和联网车辆等。制造商和服务提供商应在技术可行的情况下，通过内置接口、应用程序或其他技术工具，使用户能够默认、直接且免费地访问和导出产品及服务生成的相关数据，无需另行提出访问请求。

【参见：

https://www.ccpc.ie/enforcement-and-regulation/data-regulation/eu-data-act】
 

EU: “Access by Design” Requirements Begin to Apply to Connected Products

Ireland’s Competition and Consumer Protection Commission (CCPC) has highlighted that the EU Data Act’s “access by design” requirements apply to connected products and related services placed on the EU market after September 12, 2026. These include smartwatches, smart-home devices, connected medical devices, industrial machinery and connected vehicles. Where technically feasible, manufacturers and service providers must enable users to access and export relevant product and service data directly, by default and free of charge, through a built-in interface, app or other technical tool, without having to submit a separate access request.

[Reference:

https://www.ccpc.ie/enforcement-and-regulation/data-regulation/eu-data-act]

3.韩国《个人信息保护法》及其实施令修正案正式生效

9月11日，韩国《个人信息保护法》（PIPA）及其实施令修正案正式生效。修正案对反复发生或因故意、重大过失造成的大规模个人信息泄露，引入最高为企业总营业额10%的惩罚性罚款，并对主动开展数据保护投资的企业给予罚款减免。修正案同时强化首席隐私官（CPO）的独立性、预算及报告职责，要求特定个人信息处理者任命、变更或解任CPO须经董事会审议并向监管机构报告；此外，还扩大了潜在数据泄露的通知情形和通知内容。主要公共及私营部门个人信息处理者的ISMS-P强制认证要求将于2027年7月1日起实施。

【参见：

https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C010010000&nttId=12459】

Amendments to the South Korea’s PIPA and Its Enforcement Decree Take Effect

On September 11, amendments to South Korea’s Personal Information Protection Act (PIPA) and its Enforcement Decree took effect. The amendments introduce punitive administrative fines of up to 10% of total annual turnover for repeated or large-scale data breaches involving intent or gross negligence, while providing fine reductions for proactive privacy investments. They also strengthen the independence, budgetary authority and reporting duties of Chief Privacy Officers (CPOs), require designated organizations to obtain board approval and report certain CPO appointments, changes or removals, and expand notification requirements for actual or potential data breaches. Mandatory ISMS-P certification for major public- and private-sector data processors will take effect on July 1, 2027.

[Reference:

https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C010010000&nttId=12459]