每周数据法律资讯 Data Law Weekly（20260921—20260927）

1.我国发放首批数据产权登记凭证

9月26日，记者从国家数据局了解到，我国首批数据产权登记凭证陆续发放，56家企业和机构获得相关数据的持有权、使用权和经营权。数据产权登记相当于为数据出具身份证明，便于各类生产经营活动。

【参见：

https://mp.weixin.qq.com/s/EF73K6QmXG6u6ZSk41V2bA】

China Issues First Batch of Data Property Rights Registration Certificates

On September 26, the National Data Administration announced that China has begun issuing its first batch of data property rights registration certificates. A total of 56 enterprises and institutions have obtained rights to hold, use and operate the relevant data. Data property rights registration functions as a form of identification for data, facilitating its use in various production and business activities.

[Reference:

https://mp.weixin.qq.com/s/EF73K6QmXG6u6ZSk41V2bA]
 

2.中美达成八点成果共识，同意建立中美人工智能对话

当地时间9月23日至25日，中国国家主席习近平对美国进行国事访问。其间，两国元首就中美建设性战略稳定关系及重大国际地区问题深入交换意见，达成八点成果共识，包括双方同意建立中美人工智能对话，交流人工智能相关风险和惠益。下次对话将于今年11月举行。双方同意建立人工智能事件的沟通渠道。

【参见：

https://mp.weixin.qq.com/s/7T54sKy7T2TIaHpqJpQiNQ】

China and the U.S. Reach Eight-Point Consensus and Agree to Establish an AI Dialogue

From September 23 to 25 local time, Chinese President Xi Jinping paid a state visit to the United States. During the visit, the two heads of state had in-depth exchanges on building a constructive and strategically stable China-U.S. relationship, as well as major international and regional issues, and reached an eight-point consensus. Among other things, the two sides agreed to establish a China-U.S. dialogue on artificial intelligence to exchange views on AI-related risks and benefits. The next dialogue will be held in November this year. The two sides also agreed to establish a communication channel for AI-related incidents.

[Reference:

https://mp.weixin.qq.com/s/7T54sKy7T2TIaHpqJpQiNQ]
 

3.江苏省网信办就《江苏省网络数据安全管理办法（草案）》公开征求意见

9月23日，江苏省互联网信息办公室就《江苏省网络数据安全管理办法（草案）》（征求意见稿）公开征求意见，反馈截止时间为10月23日。办法共七十条，分为网络数据安全保护义务、网络数据开发利用安全管理、网络数据跨境流动安全管理、促进和保障、监督管理、附则七个章节。主要内容包括：要求网络数据处理者落实安全主体责任，强化数据分类分级和全流程安全管理；针对人工智能训练数据、智能体及人工智能服务处理重要数据等场景提出安全管理要求；明确个人信息和重要数据出境应依法履行相关程序，并提出江苏自贸区可制定数据出境负面清单等安排。

【参见：

https://mp.weixin.qq.com/s/IqxnYgMnvXP2o94JJ1ZH_w】
 

Jiangsu Cyberspace Administration Solicits Public Comments on the “Measures for the Administration of Network Data Security in Jiangsu Province (Draft)”

On September 23, the Jiangsu Cyberspace Administration solicited public comments on the “Measures for the Administration of Network Data Security in Jiangsu Province (Draft for Comments)”, with comments due by October 23. The Measures contain 70 articles across seven chapters covering network data security protection obligations, security management of network data development and utilization, security management of cross-border flows of network data, promotion and safeguards, supervision and administration, and supplementary provisions. Key requirements include requiring network data processors to fulfill their primary security responsibilities and strengthen data classification and grading and full-process security management; setting security management requirements for scenarios involving AI training data, intelligent agents, and important data processed by AI services; clarifying that the cross-border transfer of personal information and important data shall fulfill relevant procedures in accordance with the law; and proposing that the Jiangsu Pilot Free Trade Zone may formulate a negative list for cross-border data transfers.

[Reference:

https://mp.weixin.qq.com/s/IqxnYgMnvXP2o94JJ1ZH_w]
 

4.国家网信办发布3款提供手机端侧生成式人工智能服务的备案信息

9月22日，国家互联网信息办公室发布《关于发布3款提供手机端侧生成式人工智能服务已备案信息的公告》。网信部门会同有关部门按照《生成式人工智能服务管理暂行办法》要求，有序开展生成式人工智能服务备案工作。本次新增3款提供手机端侧生成式人工智能服务的模型完成备案，分别为“YOYO Claw”、“Xiaomi miclaw”和“阶跃终端AI”，适用场景分别为荣耀手机、小米手机和阶跃手机。

【参见：

https://www.cac.gov.cn/2026-09/23/c_1791913977404975.htm】
 

CAC Releases Filing Information for Three Generative AI Services Provided on Mobile Devices

On September 23, the CAC released the “Announcement on the Release of Filing Information for Three Generative AI Services Provided on Mobile Devices”. In accordance with the requirements of the “Interim Measures for the Administration of Generative Artificial Intelligence Services”, cyberspace authorities, together with relevant departments, are carrying out the filing of generative AI services in an orderly manner. Three additional models providing generative AI services on mobile devices have completed filing: “YOYO Claw”, “Xiaomi miclaw”, and “StepFun Terminal AI”, applicable to Honor phones, Xiaomi phones, and StepFun phones, respectively.

[Reference:

https://www.cac.gov.cn/2026-09/23/c_1791913977404975.htm]
 

5.国家计算机病毒应急处理中心检测发现82款违法违规收集使用个人信息的移动应用

9月22日，国家计算机病毒应急处理中心通报，经检测发现82款移动应用存在一项或者多项违法违规收集使用个人信息情况，涉及12类问题。主要问题包括：App首次运行时未通过弹窗等明显方式提示用户阅读隐私政策等收集使用规则；隐私政策未逐一列出收集使用个人信息的目的、方式、范围；向其他个人信息处理者提供个人信息时未向个人告知相关信息并取得单独同意；未在征得用户同意后收集个人信息或打开相关权限；未提供有效的个人信息更正、删除及注销用户账号功能，或未提供撤回同意的途径、方式等。此外，上期通报的75款移动应用经复测仍有28款存在问题，相关应用分发平台已予以下架。

【参见：

https://mp.weixin.qq.com/s/RsUApHLQu2TkslWpqd_tbA】
 

National Computer Virus Emergency Response Center Detects 82 Mobile Applications Illegally and Improperly Collecting and Using Personal Information

On September 22, the National Computer Virus Emergency Response Center reported that testing had identified 82 mobile applications with one or more instances of illegal or improper collection and use of personal information, involving 12 types of issues. Major issues included failure to clearly prompt users through pop-ups or other prominent means to read privacy policies and other rules governing the collection and use of personal information when an app is first launched; failure to list individually the purposes, methods, and scope of personal information collection and use in privacy policies; failure to inform individuals of relevant information and obtain separate consent when providing personal information to other personal information processors; collecting personal information or enabling relevant permissions without first obtaining user consent; and failure to provide effective functions for correcting or deleting personal information and cancelling user accounts, or failure to provide means and methods for withdrawing consent. In addition, 28 of the 75 mobile applications identified in the previous notification were still found to have problems upon retesting, and the relevant application distribution platforms had removed them.

[Reference:

https://mp.weixin.qq.com/s/RsUApHLQu2TkslWpqd_tbA]

6.上海金融监管局发布《推动上海银行业保险业人工智能应用的若干措施》

近期，国家金融监督管理总局上海监管局印发《推动上海银行业保险业人工智能应用的若干措施》。文件共十六条，分为加强数智赋能、夯实基础支撑、健全保障机制三个板块。其中，核心内容为第十至十三条集中设置义务性条款，要求金融机构将相关要求落实到人工智能应用流程中；第四条和第十三条重点围绕数据治理、知识库管理及训练数据安全作出安排；第十四条则提出探索人工智能金融应用试点机制、分类分级的弹性监管框架和人工智能应用容错机制。

【参见：

https://www.nfra.gov.cn/branch/shanghai/view/pages/common/ItemDetail.html?docId=1273268&itemId=998】
 

National Financial Regulatory Administration Shanghai Office Issues the “Measures on Promoting the Application of Artificial Intelligence in Shanghai’s Banking and Insurance Sectors”

Recently, the National Financial Regulatory Administration Shanghai Office issued the “Measures on Promoting the Application of Artificial Intelligence in Shanghai’s Banking and Insurance Sectors”. The Measures contain 16 articles and are divided into three sections: strengthening digital and intelligent empowerment, consolidating foundational support, and improving safeguards. Articles 10 to 13 centrally set out mandatory requirements, requiring financial institutions to implement relevant requirements throughout AI application processes. Articles 4 and 13 focus on data governance, knowledge base management, and training data security. Article 14 proposes exploring pilot mechanisms for financial applications of AI, a flexible regulatory framework based on classification and grading, and a fault-tolerance mechanism for AI applications.

[Reference:

https://www.nfra.gov.cn/branch/shanghai/view/pages/common/ItemDetail.html?docId=1273268&itemId=998]

1.TikTok撤回两项儿童隐私上诉并接受1270万英镑罚款，“艺术目的”抗辩未获支持

9月24日，英国信息专员办公室（ICO）宣布，TikTok撤回两项涉及儿童隐私的上诉，并同意支付此前于2023年被处以的1270万英镑罚款，该处罚由此定案。TikTok此前主张，其为用户创作、传播和欣赏艺术内容而进行的个人信息处理属于英国《2018年数据保护法》规定的“特殊目的”处理，因此ICO在采取执法措施前应满足额外的程序要求。英国上级审裁处未支持该抗辩，认为TikTok的推荐系统主要根据用户与内容互动的可能性进行内容推荐，而非根据内容的艺术属性进行推荐，因此相关数据处理并非以艺术为目的。与此同时，TikTok撤回了针对ICO向其发出的“信息通知”的上诉，使ICO此前受阻的针对13至17岁用户推荐系统中个人信息使用情况的调查得以继续。

【参见：

https://cy.ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/tiktok-withdraws-two-appeals-in-children-s-privacy-action-and-accepts-127m-fine/】

TikTok Withdraws Two Appeals in Children’s Privacy Action and Accepts £12.7 Million Fine; “Artistic Purposes” Argument Not Supported

On September 24, the UK Information Commissioner’s Office (ICO) announced that TikTok had withdrawn two appeals concerning children’s privacy and agreed to pay the £12.7 million fine imposed in 2023, making the fine final. TikTok had argued that its processing of personal information for users to create, share, and enjoy artistic content constituted processing for “special purposes” under the UK Data Protection Act 2018, and that the ICO was therefore required to meet additional procedural requirements before taking enforcement action. The Upper Tribunal did not support this argument, finding that TikTok’s recommender system primarily recommended content based on the likelihood of users interacting with content, rather than on the artistic attributes of the content, and therefore the relevant processing was not for an artistic purpose. At the same time, TikTok withdrew its appeal against an information notice issued by the ICO, allowing the ICO’s previously obstructed investigation into the use of personal information in recommender systems for users aged 13 to 17 to continue.

[Reference:

https://cy.ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/tiktok-withdraws-two-appeals-in-children-s-privacy-action-and-accepts-127m-fine/]

2.爱尔兰数据保护委员会因位置数据违规对谷歌处以4.03亿欧元罚款

9月21日，爱尔兰数据保护委员会对谷歌处以4.03亿欧元罚款，原因是谷歌在2018年5月25日至2020年2月4日期间处理用户位置数据时，未能遵守欧盟《通用数据保护条例》（GDPR）的合法、公平和透明原则。调查涉及“网络与应用活动”“位置记录”和“位置精确度”三项功能。DPC指出，位置数据可能反映用户的高度私密信息，谷歌当时未充分告知用户其位置数据可能被用于个性化广告及推断个人兴趣，且部分位置数据的保存期限超过必要期限。除罚款外，DPC还要求谷歌在6个月内调整相关数据处理方式，以符合GDPR要求。谷歌回应称，该案件涉及历史政策，公司自2019年以来已调整相关做法，并推出自动删除位置数据、关闭个性化广告等功能。

【参见：

https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location】

Irish Data Protection Commission Fines Google €403 Million over Location Data Violations

On September 21, the Irish Data Protection Commission (DPC) fined Google €403 million for failing to comply with the principles of lawfulness, fairness, and transparency under the EU General Data Protection Regulation (GDPR) when processing users’ location data between May 25, 2018 and February 4, 2020. The inquiry concerned three features: “Web & App Activity”, “Location History”, and “Location Accuracy”. The DPC noted that location data can reveal highly private information and found that Google had not sufficiently informed users at the time that their location data could be used for personalized advertising and to infer personal interests. Some location data was also retained for longer than necessary. In addition to the fine, the DPC required Google to bring its relevant data processing into compliance with GDPR within six months. Google responded that the case concerned historical policies and that it had significantly changed its practices since 2019, including introducing automatic deletion of location data and allowing users to turn off personalized advertising.

[Reference:

https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location-data]
 

3.加利福尼亚州：州长发布行政命令，加快AI独立监督并推进前沿模型“紧急关闭”机制

近日，加州州长 Gavin Newsom 发布行政命令，要求加快实施该州关于人工智能独立监督和审计的新规，并召集专家在两个月内就进一步强化AI安全监管提出建议。拟议措施包括：要求独立验证机构进驻前沿AI企业开展定期审计和评估；对企业提交的安全框架、透明度报告和风险评估进行独立验证；推动建立前沿模型“紧急关闭开关”（kill switch）并持续验证其有效性；以及将模型失控等情形纳入重大安全事件范围。

【参见：

https://www.gov.ca.gov/2026/09/18/governor-newsom-issues-executive-order-to-accelerate-independent-oversight-and-advance-the-creation-of-an-ai-kill-switch/?utm】

California: Governor Issues Executive Order to Accelerate Independent AI Oversight and Advance a “Kill Switch” for Frontier Models

Recently, California Governor Gavin Newsom issued an executive order to accelerate the implementation of the state’s new independent AI oversight and audit framework and convene experts to recommend further AI safety measures within two months. Proposals under consideration include embedding independent verification organizations in frontier AI companies to conduct regular audits and evaluations, independently verifying safety frameworks, transparency reports and risk assessments, advancing an emergency “kill switch” for frontier models with ongoing verification of its effectiveness, and expanding the definition of critical safety incidents to cover loss-of-control events.

[Reference:

https://www.gov.ca.gov/2026/09/18/governor-newsom-issues-executive-order-to-accelerate-independent-oversight-and-advance-the-creation-of-an-ai-kill-switch/?utm]

4.EDPB通过关于DSA与GDPR相互作用的最终指导方针

近日，欧洲数据保护委员会（EDPB）通过《DSA与GDPR相互作用指南3/2025》最终版。指南明确了《数字服务法》（DSA）涉及个人数据处理时与GDPR的衔接规则，重点覆盖违法内容通知机制、推荐系统、在线广告透明度、欺骗性设计模式、未成年人隐私与安全保护，以及禁止基于敏感个人数据或针对未成年人的画像广告等场景，并强调DSA监管机构与数据保护机构之间的协调执法。

【参见：

https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en】

EDPB Adopts Final Guidelines on the Interplay Between the DSA and the GDPR

Recently, the European Data Protection Board (EDPB) adopted the final version of Guidelines 3/2025 on the interplay between the Digital Services Act (DSA) and the GDPR. The Guidelines clarify how GDPR requirements apply where DSA obligations involve personal data processing, covering areas including notice-and-action mechanisms, recommender systems, advertising transparency, deceptive design patterns, protection of minors, and restrictions on profiling-based advertising using sensitive data or targeting minors. They also stress coordinated enforcement between DSA authorities and data protection authorities.

[Reference:

https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en]