每周数据法律资讯 Data Law Weekly（20241230-20250105）

1月3日，国家网信办发布《个人信息出境个人信息保护认证办法（征求意见稿）》，向社会公开征求意见。境内个人信息处理者通过个人信息出境个人信息保护认证方式向境外提供个人信息的，应当同时符合下列情形：（一）非关键信息基础设施运营者；（二）自当年1月1日起累计向境外提供10万人以上、不满100万人个人信息（不含敏感个人信息）或者不满1万人敏感个人信息。符合条件的境内个人信息处理者可自愿向专业认证机构申请个人信息出境个人信息保护认证。

全文链接：

‍https://mp.weixin.qq.com/s/3nW4NWS7Voe2mBEj6HXA4A‍

1. the CAC issued “Personal Information Protection Certification Scheme for Cross-border Personal Information (Draft for Public Opnions)

On January 3, the CAC issued “Personal Information Protection Certification Scheme for Cross-border Personal Information (Draft for Public Opinions). Personal information processor in China to provide personal information to overseas receivers through the way of personal information protection certification, should meet both of the following criteria: (a) non-critical information infrastructure operators; (b) Starting from January 1st of that year, provide personal information of more than 100,000 people, less than 1 million people (excluding sensitive personal information), or less than 10,000 people with sensitive personal information to overseas parties. Eligible personal information processors can voluntarily apply for personal information protection certification from designated professional certification agencies.

[https://mp.weixin.qq.com/s/3nW4NWS7Voe2mBEj6HXA4A]

2、网信部门严厉打击整治网络水军问题

1月3日，网信部门通报严厉打击整治网络水军问题部分典型案例。2024年以来，网信部门持续加大对网络水军打击力度，严肃查处网络水军组织招募、推广引流、刷量控评等问题，协调关闭、下架网站平台400余家，督促重点平台清理违法违规信息482万条，处置账号和商家店铺239万个、群组5.2万个，整治工作取得明显成效。部分典型案例包括下架关闭网络水军网站平台、整治同质化文案引流炒作问题、打击组织招募网络水军人员行为、严管刷评刷单涨粉等推广服务、查处利用新技术新应用实施流量造假。

全文链接：

‍https://mp.weixin.qq.com/s/DFhN2xjIw0GjJP1G3E78CQ‍

2. The cyberspace administration department is cracking down on and rectifying the problem of online water armies

On January 3, the Cyberspace Administration reported some typical cases of cracking down on and rectifying the problem of online water armies. Since 2024, the cyberspace administration has continued to intensify its crackdown on the internet water army, seriously investigating and punishing issues such as recruitment, promotion and drainage, and volume control and evaluation of internet water army organizations. It has coordinated the closure and removal of more than 400 website platforms, urged key platforms to clean up 4.82 million illegal and irregular information, disposed of 2.39 million accounts and merchant stores, and 52000 groups. The rectification work has achieved significant results. Some typical cases include delisting and shutting down online water army website platforms, rectifying the problem of homogenized copywriting and hype, cracking down on the recruitment of online water army personnel by organizations, strictly managing promotion services such as brushing reviews, brushing orders, and gaining followers, and investigating the use of new technologies and applications to implement traffic fraud.

[https://mp.weixin.qq.com/s/DFhN2xjIw0GjJP1G3E78CQ]

3、国家网信办已完成数据出境安全评估项目285个，超九成通过

12月31日，国家数据局举行专题新闻发布会，会上，中央网信办网络数据管理局副局长介绍，截至2024年12月，国家网信办共完成安全评估项目285个，个人信息出境标准合同备案1071个。其中安全评估项目未通过评估的27个，占整体比例不到10%。除个别项目因重要数据出境必要性不足或存在安全风险未通过评估，其余大多数未通过的主要原因是数据处理者未按照法律规定征得个人信息主体同意。

全文链接：

https://mp.weixin.qq.com/s/y-NkdOTkAxaglFFqZk72sg

3. The CAC has completed 285 data export security assessment projects, with pass rate exceeding 90% 

On December 31, the National Data Administration held a special press conference, during which the Deputy Director of the Network Data Management Bureau of the CAC introduced that as of December 2024, the CAC has completed a total of 285 security assessment projects and filed 1071 personal information export standard contracts. Among them, 27 security assessment projects did not pass the evaluation, accounting for less than 10% of the overall proportion. Except for a few projects that did not pass the assessment due to insufficient necessity for important data to be exported or security risks, the main reason for the majority of failures is that the data processor did not obtain the consent of the personal information subject in accordance with legal requirements.

[https://mp.weixin.qq.com/s/y-NkdOTkAxaglFFqZk72sg]

4、《河南省重要信息系统识别指南（第一版）》发布

12月31日，河南网信办发布《河南省重要信息系统识别指南（第一版）》。该指南适用于河南省行政区域内非涉密网络中重要信息系统的识别和认定。重要信息系统是指公共通信和信息服务、能源、交通、水利、金融、教育、医疗卫生、社会保障、市政、广播电视、应急管理、电子政务、国防科技工业、互联网等重要行业和领域中，未列入关键信息基础设施，所承载的业务与国家安全、社会秩序、经济建设和公共利益密切相关，或者网络安全等级保护级别第三级以上的信息系统。

全文链接：

https://www.hnwx.gov.cn/m/2024/12-31/60839.html

4. Henan Province Important Information System Identification Guidelines (First Edition) Released

5、国家发展改革委等部门发布《关于促进数据产业高质量发展的指导意见》

12月30日，国家发改委、国家数据局、教育部、财政部、金融监管总局和中国证监会联合发布《关于促进数据产业高质量发展的指导意见》，指出发展数据产业是深化数据要素市场化配置改革、构建以数据为关键要素的数字经济的重要举措，是推进国家大数据战略、加快建设数字中国的重要支撑。提出要加强数据产业规划布局、培育多元数据产业经营主体、加快数据技术创新、提高数据资源开发利用水平、发展数据流通交易等意见。

全文链接：

‍https://mp.weixin.qq.com/s/5VXddrLKMxzmMEc6qCdhIg‍

5. The National Development and Reform Commission and other departments have issued the Guidelines on Promoting High Quality Development of the Data Industry

On December 30, the National Development and Reform Commission, the National Data Administration, the Ministry of Education, the Ministry of Finance, the National Financial Regulatory Administration, and the China Securities Regulatory Commission jointly issued the "Guidelines on Promoting High Quality Development of the Data Industry", pointing out that developing data industry is an important measure to deepen the market-oriented allocation reform of data elements and build a digital economy with data as the key element. It is also an important support for promoting the national big data strategy and accelerating the construction of a digital China. Suggestions were put forward to strengthen the planning and layout of the data industry, cultivate diverse data industry operators, accelerate data technology innovation, improve the level of data resource development and utilization, and develop data circulation and trading.

[https://mp.weixin.qq.com/s/5VXddrLKMxzmMEc6qCdhIg]

6、国家数据局发布《数据领域常用名词解释（第一批）》

12月30日，国家数据局发布《数据领域常用名词解释（第一批）》，对数据、原始数据、数据资源、数据要素、数据资产等的概念的界定作出解释。

全文链接：

‍https://mp.weixin.qq.com/s/x4YmgY0vP8MlevaL_ep4hg‍

6. The National Data Administration has released “Interpretation of Common Terms in the Data Field (First Batch)” 

On December 30, the National Data Administration released the "Interpretation of Common Terms in the Data Field (First Batch)", which explains the definitions of concepts such as data, raw data, data resources, data elements, and data assets.

[https://mp.weixin.qq.com/s/x4YmgY0vP8MlevaL_ep4hg]

7、上海发布最新一批生成式人工智能服务登记信息

截至12月30日，上海市新增9款已完成登记的生成式人工智能服务，累计已完成63款生成式人工智能服务登记。上海市网信办对通过API或其他方式直接调用已备案模型能力，且面向境内公众提供具有舆论属性或者社会动员能力的生成式人工智能服务开展登记工作。已上线的生成式人工智能应用或功能，应在显著位置或产品详情页面标明所取得的上线编号。

全文链接：

https://mp.weixin.qq.com/s/MS7PgFbmFByh70O7TyxWNQ

7. Shanghai released the latest batch of registration information for generative artificial intelligence services

As of December 30, Shanghai has added 9 newly registered generative artificial intelligence services, and a total of 63 generative artificial intelligence service registrations have been completed. The Shanghai Cyberspace Administration will carry out registration work for generative artificial intelligence services that directly invoke filed models through APIs or other means and provide public opinion attributes or social mobilization capabilities to the domestic public. The generated artificial intelligence applications or functions that have been launched should indicate the launch number obtained in a prominent position or on the product details page.

[https://mp.weixin.qq.com/s/MS7PgFbmFByh70O7TyxWNQ]

1、印度发布数字个人数据保护规则

印度电子和信息技术部（MeitY）发布了《2025数字个人数据保护规则》草案，该草案定义了同意管理、同意管理者和数据受托人的义务，并对重要的数据受托人提出了具体要求，包括定期审计和数据保护影响评估。该规则草案2023年《数字个人数据保护法》为基础，规定了明确的同意通知、健全的安全措施、违规通知、数据处理后删除以及儿童数据保护，此外还要求公布数据保护官的联系信息和数据主体请求程序。

点击查阅草案全文：

https://egazette.gov.in/(S(3v1t5mgpuu5fe5pfna4ege51))/SearchMinistry.aspx?id=284651

1. India published the draft Digital Personal Data Protection Rules

On January 3, the Ministry of Electronics and Information Technology (MeitY) of India published the draft Digital Personal Data Protection Rules 2025, which define consent management, obligations of consent managers and data fiduciaries, and introduce specific requirements for significant data fiduciaries including regular audits and Data Protection Impact Assessments. The draft Rules, based on the Digital Personal Data Protection Act, 2023, mandate clear consent notices, robust security measures, breach notifications, data deletion post-processing, and child data protection. They also require the publication of Data Protection Officer contact information and data subject request procedures.

[https://egazette.gov.in/(S(3v1t5mgpuu5fe5pfna4ege51))/SearchMinistry.aspx?id=284651]

2、土耳其发布《个人数据跨境传输指南》

1月2日，土耳其数据保护机构（KVKK）正式发布《个人数据跨境传输指南》。该指南旨在为6698号《个人数据保护法》第九条关于“个人数据跨境传输”的相关规定提供实践指引。根据土耳其《个人数据保护法》，个人数据的跨境传输主要包括三条路径，一是基于充分性决定，二是基于适当保障措施（如订立标准合同条款等），三是基于某些例外情况（如数据主体的明确同意等）。

点击查阅指南全文：

https://kvkk.gov.tr/Icerik/8143/Kisisel-Verilerin-Yurt-Disina-Aktarilmasi-Rehberi

2. Turkey Released Guidelines for Cross-Border Transfers of Personal Data

On January 2, the Turkish Data Protection Agency (KVKK) officially released the Guidelines for Cross-Border Transfers of Personal Data. The purpose of the Guidelines is to provide practical guidance on the provisions of Article 9 of the Personal Data Protection Law No. 6698 on “Cross-Border Transfers of Personal Data”. According to the Turkish Personal Data Protection Law, there are three main routes for cross-border transfers of personal data: first, based on a decision of adequacy, second, based on appropriate safeguards (e.g., entering into standard contractual clauses, etc.), and third, based on certain exceptions (e.g., explicit consent of the data subject, etc.).

[https://kvkk.gov.tr/Icerik/8143/Kisisel-Verilerin-Yurt-Disina-Aktarilmasi-Rehberi]