每周数据法律资讯 Data Law Weekly（20260928—20261011）

1.上海市网信办通报属地App个人信息收集使用问题

10月10日，上海市网信办通报属地App个人信息收集使用问题，涉及3款SDK，主要问题包括：告知收集使用个人信息的目的、方式、范围与实际情况不一致；用户明确表示不同意后仍收集个人信息；未提供个性化推送退出功能；超出必要范围收集使用个人信息；承诺的投诉、举报反馈时限超过法定上限。相关运营者须在通报发布之日起15个工作日内完成整改并报送整改情况。

【参见：

https://mp.weixin.qq.com/s/n1YVMlHBJp2EzedVnGlKlw】

Shanghai Cyberspace Administration Reports Personal Information Collection and Use Issues Involving Local Apps

On October 10, the Shanghai Cyberspace Administration reported personal information collection and use issues involving local apps and three SDKs. The identified issues included discrepancies between disclosed and actual purposes, methods, and scope of personal information processing; continued collection after users explicitly withheld consent; failure to provide an opt-out mechanism for personalised recommendations; collection and use beyond what was necessary; and complaint and report response deadlines exceeding the statutory limit. The relevant operators must complete rectification and submit reports within 15 working days from the date of publication.

[Reference:

https://mp.weixin.qq.com/s/n1YVMlHBJp2EzedVnGlKlw]
 

2.中共中央、国务院印发《关于发展新质生产力的意见》

10月9日，中共中央、国务院印发《关于发展新质生产力的意见》，围绕科技创新、产业升级和体制机制改革提出重点举措。在数据治理方面，意见提出建设全国一体化数据市场，建立高效、便利、安全的数据跨境流动机制，并探索“用数据决策、用数据管理”的监管模式，加强人工智能、生物等领域治理。意见指出全面实施“人工智能+”行动。推进人工智能对传统产业的改造，加快推进智能网联新能源汽车、人工智能手机和电脑、人形机器人等新一代智能终端场景应用。

【参见：

https://mp.weixin.qq.com/s/CF4zuWwd-4sJDSpT_fzAPw】

CPC Central Committee and State Council Issue “Opinions on Developing New Quality Productive Forces”

On October 9, the CPC Central Committee and the State Council issued “the Opinions on Developing New Quality Productive Forces”, setting out key measures on technological innovation, industrial upgrading, and institutional reform. In data governance, the Opinions call for establishing an integrated national data market, creating efficient, convenient, and secure mechanisms for cross-border data flows, exploring regulatory models that use data for decision-making and management, and strengthening governance in fields such as artificial intelligence and biotechnology. The Opinions also call for the comprehensive implementation of the ‘AI+’ initiative. Efforts will be made to advance the transformation of traditional industries through artificial intelligence, and to accelerate the application of new-generation smart devices—such as intelligent connected new energy vehicles, AI-enabled mobile phones and computers, and humanoid robots—in various practical scenarios.

[Reference:

https://mp.weixin.qq.com/s/CF4zuWwd-4sJDSpT_fzAPw]

3.中国人民银行就《金融信用信息基础数据库管理办法（征求意见稿）》公开征求意见

9月30日，中国人民银行发布《金融信用信息基础数据库管理办法（征求意见稿）》，拟将监管范围从个人征信扩展至企业征信，进一步规范信用信息采集、报送、查询和使用等活动。征求意见稿明确征信查询须取得信息主体书面同意，强化数据质量管理、个人信息保护和数据安全要求，并细化征信异议、投诉处理及接入机构管理规则。

【参见：

https://www.pbc.gov.cn/tiaofasi/144941/144979/3941920/2026093015154991467/index.html?sessionid=】
 

PBC Seeks Public Comments on Draft Measures for the Administration of the Financial Credit Information Database

On September 30, the People's Bank of China (PBC) released draft measures for public comment, proposing to extend the regulatory scope from personal to corporate credit reporting and further regulate the collection, submission, inquiry, and use of credit information. The draft requires written consent for credit information inquiries, strengthens data quality management, personal information protection, and data security requirements, and refines rules on credit disputes, complaints, and participating institutions.

[Reference:

https://www.pbc.gov.cn/tiaofasi/144941/144979/3941920/2026093015154991467/index.html?sessionid=]
 

4.上海一中院判决AI合成语音侵权案，明确声音可识别性及平台举证责任

9月29日，上海市第一中级人民法院审结上海首例人工智能合成语音引发的自然人声音权益保护纠纷案，判决驳回上诉、维持平台运营方赔偿5万元的原判。法院明确，未经自然人同意，使用其声音作为训练语料并生成具有可识别性的合成人声，可能构成声音侵权；权利人证明，平台具有合理获取其声音来源的渠道且合成语音与本人声音高度相似后，掌握训练数据的平台应就素材来源合法性等事实承担相应举证责任。该案强调，AI生成技术不能免除经营主体对声音素材来源合法性的审查义务，相关企业应建立训练数据来源审查和生成内容合规管理机制。

【参见：

https://mp.weixin.qq.com/s/r7hxWrAsS-NX7OKCHm7h-Q】

Shanghai First Intermediate People’s Court Rules on AI-Generated Voice Infringement, Clarifying Identifiability and Platforms’ Burden of Proof

On September 29, the Shanghai First Intermediate People’s Court concluded Shanghai’s first case concerning the protection of an individual’s voice rights in connection with AI-generated speech. The court dismissed the appeal and upheld the original judgment requiring the platform operator to pay RMB 50,000 in compensation. The court clarified that using an individual’s voice as training material and generating an identifiable synthetic voice without consent may constitute infringement of voice rights. Once the rights holder establishes that the voice was obtained through a reasonably accessible source and that the synthetic voice closely resembles their own, the platform controlling the training data bears a corresponding burden of proof regarding the legality of the source material. The case emphasises that AI-generated technology does not exempt businesses from reviewing the lawful sources of voice materials, and that relevant companies should establish compliance mechanisms for reviewing training data sources and managing generated content.

[Reference:

https://mp.weixin.qq.com/s/r7hxWrAsS-NX7OKCHm7h-Q]

5.中央网信办部署开展“清朗·整治短视频虚假人设乱象”专项行动

近日，中央网信办部署开展为期2个月的“清朗·整治短视频虚假人设乱象”专项行动，重点整治假扮弱势群体、虚构职业资质、利用AI仿冒人物、鼓吹奢靡迷信及编造冲突剧情等五类问题。专项行动将加大违规账号和平台查处力度，规范短视频发布标注，加强重点板块内容管理，严禁在榜单、推荐等位置推送虚假人设类短视频，并强化老年人、农村群体及专业领域用户等相关权益保障，依法从严处置借虚假人设误导网民、牟利及煽动群体对立等行为。

【参见：

https://mp.weixin.qq.com/s/Hj6ppX76iHPjhVeyeqVe7A?scene=1&click_id=1729410954】

CAC Launches “Qinglang” Campaign to Address Fabricated Personas in Short Videos

The CAC recently launched a two-month “Qinglang” campaign targeting fabricated personas in short videos. The campaign focuses on five types of misconduct: impersonating vulnerable groups, fabricating professional qualifications, using AI to impersonate individuals, promoting extravagance or superstition, and staging fabricated conflicts. It will strengthen enforcement against non-compliant accounts and platforms, standardise labelling requirements for short videos, and tighten content management in key sections. Short videos featuring fabricated personas are prohibited from being promoted in rankings and recommendation sections. The campaign will also strengthen protections for older people, rural communities, and users in professional fields, and take strict legal action against conduct involving misleading users, profiting from fabricated personas, or inciting group antagonism.

[Reference:

https://mp.weixin.qq.com/s/Hj6ppX76iHPjhVeyeqVe7A?scene=1&click_id=1729410954]

1.英国ICO推动十家大型基础模型开发商进行数据保护整改，AI Agent监管将至

10月8日，英国信息专员办公室（ICO）宣布，包括OpenAI、Anthropic、Google、Meta、微软、苹果和DeepSeek在内的十家大型基础模型开发商已完成或承诺实施一系列数据保护改进措施，涉及模型训练的合法性基础、个人信息处理透明度、个人权利保障及隐私保护措施有效性评估。同日，ICO启动AI Agent数据保护意见征集，并就Agent测试及部署中涉及的安全保护、通信渠道和外部系统访问等问题向相关企业及英国AI安全研究所开展问询。意见征集聚焦数据安全、透明度、责任分配、自动化决策、公平性与目的限制及个人信息处理合法性六个方面。

【参见：

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/】

UK ICO Secures Data Protection Improvements from Ten Major Foundation Model Developers and Turns Scrutiny to AI Agents

On October 8, the UK Information Commissioner’s Office (ICO) announced that ten major foundation model developers, including OpenAI, Anthropic, Google, Meta, Microsoft, Apple, and DeepSeek, had completed or committed to implementing a series of data protection improvements. These cover the lawful basis for model training, transparency in personal data processing, protection of individual rights, and assessments of the effectiveness of privacy safeguards. On the same day, the ICO launched a call for views on data protection and AI agents, and sought input from relevant companies and the UK AI Security Institute on safeguards, communication channels, and external system access during agent testing and deployment. The consultation focuses on six areas: data security, transparency, allocation of responsibilities, automated decision-making, fairness and purpose limitation, and the lawfulness of personal data processing.

[Reference:

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/]

2.意大利数据保护局对IQVIA处以700万欧元罚款，认定患者数据未实现匿名化

10月2日，意大利个人数据保护局（Garante）对IQVIA Solutions Italy处以700万欧元罚款。IQVIA的纵向患者数据（LPD）数据库收集约800名全科医生的约100万名患者健康信息，用于统计、流行病学及市场研究。监管机构认定，尽管IQVIA采用了患者编码等措施，但稳定编号与详细医疗记录相结合仍可能导致患者被识别或重新识别。此外，IQVIA被认定为相关数据处理的控制者，且存在健康数据处理缺乏适当法律依据、告知义务及数据安全等方面的违规问题。

【参见：

https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10302141】

Italian Data Protection Authority Fines IQVIA €7 Million Over Inadequate Anonymisation of Patient Data

On October 2, the Italian Data Protection Authority (Garante) fined IQVIA Solutions Italy €7 million. IQVIA’s Longitudinal Patient Data (LPD) database collects health information concerning approximately one million patients from around 800 general practitioners for statistical, epidemiological, and market research purposes. The regulator found that, despite measures such as patient coding, the combination of stable identifiers and detailed medical records could allow patients to be identified or re-identified. IQVIA was also found to be a controller of the relevant data processing, with violations involving the lack of an appropriate legal basis for processing health data, information obligations, and data security.

[Reference:

https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10302141]

3.白宫与科技企业签署超级智能安全承诺，提出四层控制与审计机制

9月29日，特朗普签署行政令，要求美国联邦行政部门在官方信函、网站、报告及政策文件等非法定文件中，原则上以“超级智能（SI）”取代“人工智能（AI）”这一称呼。同日，白宫与Google、Anthropic、Meta、OpenAI、xAI、英伟达等科技企业代表签署《白宫超级智能协议：前沿责任联合承诺》，提出通过内部控制、内部监督、独立外部评估及董事会监督四层机制加强前沿模型安全治理，要求企业持续监测模型能力与对齐情况，重点关注网络安全、生物安全和化学威胁，并确保控制措施有效运行、发现的问题得到整改。文件还提出，参与企业将共同制定安全标准和最佳实践，未来可考虑将相关措施纳入法律或法规。

【参见：

https://www.presidency.ucsb.edu/documents/white-house-accord-super-intelligence】

White House and Tech Companies Sign Superintelligence Safety Accord, Proposing Four Layers of Controls and Oversight

On September 29, President Donald Trump signed an executive order directing US federal executive departments, in principle, to use “Superintelligence (SI)” instead of “Artificial Intelligence (AI)” in non-statutory documents, including official correspondence, websites, reports, and policy documents. On the same day, the White House and representatives of technology companies including Google, Anthropic, Meta, OpenAI, xAI, and Nvidia signed the White House Superintelligence Accord: Joint Commitment to Frontier Responsibility. The accord proposes four layers of safeguards for frontier model governance: internal controls, internal oversight, independent external assessments, and board oversight. It calls on companies to continuously monitor model capabilities and alignment, with particular attention to cybersecurity, biological safety, and chemical threats, and to ensure that safeguards operate effectively and identified issues are addressed. Participating companies also propose jointly developing safety standards and best practices, with the possibility of incorporating relevant measures into laws or regulations in the future.

[Reference:

https://www.presidency.ucsb.edu/documents/white-house-accord-super-intelligence]

4.巴西将13款AI伴侣产品提交监管评估，关注未成年人保护与数据处理风险

9月22日，巴西司法与公共安全部国家数字权利秘书处（Sedigi）发布针对13款AI伴侣产品的技术报告，涉及Character.AI、Replika、Nomi等。报告已提交巴西国家数据保护局（ANPD）和国家消费者秘书处（Senacon），供其从数据保护、未成年人保护及消费者权益等角度进一步评估。报告重点指出，相关产品存在年龄验证机制薄弱、未成年人接触不适宜内容、过度情感依赖、强迫性使用及亲密个人数据收集和情绪画像等风险。巴西主管部门表示，该报告属于初步风险评估，相关产品是否违规仍有待正式调查认定。

【参见：

https://www.gov.br/mj/pt-br/assuntos/noticias-1/sedigi-identifica-riscos-de-201ccompanheiros-de-ia-para-criancas-e-adolescentes】

Brazil Refers 13 AI Companion Products for Regulatory Assessment, Focusing on Child Protection and Data Processing Risks

On September 22, the Secretariat for Digital Rights (Sedigi) of Brazil’s Ministry of Justice and Public Security issued a technical report assessing 13 AI companion products, including Character.AI, Replika, and Nomi. The report was submitted to the National Data Protection Authority (ANPD) and the National Consumer Secretariat (Senacon) for further assessment from the perspectives of data protection, child protection, and consumer rights. Key risks identified include weak age-verification mechanisms, minors’ exposure to inappropriate content, excessive emotional dependence, compulsive use, and the collection of intimate personal data and the creation of emotional profiles. Brazilian authorities stated that the report constitutes a preliminary risk assessment and that any determination of regulatory violations remains subject to formal investigation.

[Reference:

https://www.gov.br/mj/pt-br/assuntos/noticias-1/sedigi-identifica-riscos-de-201ccompanheiros-de-ia-para-criancas-e-adolescentes]

5.加州通过SB 923法案，扩大消费者个人信息删除权

近日，加州州长签署SB 923法案，修订《加州消费者隐私法》（CCPA）有关删除权的规定，明确消费者可要求企业删除直接从其本人收集或收集的关于其本人的个人信息，新法将于2027年1月1日生效。法案允许企业保留最低限度的必要信息，以确保已删除的个人信息不会被重新纳入记录；同时，完全在线运营并与消费者存在直接关系的企业须提供网页表单或在线门户等方式，供消费者提交个人信息请求。

【参见：

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB923】

California Passes SB 923 to Expand Consumers’ Personal Information Deletion Rights

Recently, the governor of California signed SB 923, amending the deletion-right provisions of “the California Consumer Privacy Act (CCPA)”. The law clarifies that consumers may request businesses to delete personal information collected directly from them or information collected about them, and will take effect on January 1, 2027. Businesses may retain the minimum information necessary to ensure that deleted personal information is not reintroduced into their records. In addition, businesses operating exclusively online and having a direct relationship with consumers must provide methods such as a web form or online portal through which consumers can submit personal information requests.

[Reference:

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB923]