每周数据法律资讯 DataLaw Weekly（20250303-20250309）

1、2025《政府工作报告》提出持续推进“人工智能+”行动，完善数据基础制度

3月5日，十四届全国人大三次会议开幕，国务院总理作《政府工作报告》，《报告》指出要激发数字经济创新活力，持续推进“人工智能+”行动，支持大模型广泛应用，大力发展智能网联新能源汽车、人工智能手机和电脑、智能机器人等新一代智能终端以及智能制造装备。加快完善数据基础制度，深化数据资源开发利用，促进和规范数据跨境流动。

【点击查阅完整《政府工作报告》：

https://www.gov.cn/yaowen/liebiao/202503/content_7010168.htm】     

1. The 2025 Government Work Report proposes to continue to promote the ‘AI+’ initiative and improve the data infrastructure system

On March 5, the third session of the 14th National People's Congress opened, and Premier delivered the Government Work Report. The Report pointed out the need to stimulate the innovative vitality of the digital economy, continue to promote the ‘AI+’ initiative, support the widespread application of large models, and vigorously develop a new generation of intelligent terminals such as intelligent connected new energy vehicles, AI-powered mobile phones and computers, intelligent robots, and intelligent manufacturing equipment. It will accelerate the improvement of the data infrastructure system, deepen the development and utilisation of data resources, and promote and regulate cross-border data flows.

[Click to view the full text of the Government Work Report:

https://www.gov.cn/yaowen/liebiao/202503/content_7010168.htm]

2、全国网安标委发布《网络安全标准实践指南——个人信息保护合规审计 专业机构服务能力要求（征求意见稿）》

3月4日，全国网安标委发布《网络安全标准实践指南——个人信息保护合规审计 专业机构服务能力要求（征求意见稿）》，面向社会公开征求意见。该文件规定了专业机构开展个人信息保护合规审计服务的能力要求，包括基本条件、管理体系、技术能力、人员能力、场所与设备资源能力。根据《个人信息保护合规审计管理办法》的相关规定，个人信息处理者自行开展个人信息保护合规审计的，可以由内部机构或者委托专业机构定期进行审计。    

【点击查阅全文：

https://mp.weixin.qq.com/s/iZ37O4Dh8a_N0YwL77YHIA】

2. TC260 released the ‘Cybersecurity Standard Practice Guide – Personal Information Protection Compliance Audit Professional Service Capability Requirements (Draft for Comment)’ (《网络安全标准实践指南——个人信息保护合规审计 专业机构服务能力要求（征求意见稿）》)

On March 4, TC260 released the ‘Cybersecurity Standard Practice Guide – Personal Information Protection Compliance Audit Professional Service Capability Requirements (Draft for Comment)’ (《网络安全标准实践指南——个人信息保护合规审计 专业机构服务能力要求（征求意见稿）》) for public comment. The document stipulates the capability requirements for professional institutions to carry out personal information protection compliance audit services, including basic conditions, management systems, technical capabilities, personnel capabilities, and the capabilities of premises and equipment resources. According to the relevant provisions of the ‘Administrative Measures for Personal Information Protection Compliance Audits’ (《个人信息保护合规审计管理办法》), personal information processors that conduct personal information protection compliance audits on their own may have internal agencies or entrust professional agencies to conduct regular audits.

[Click to view the full text:

https://mp.weixin.qq.com/s/iZ37O4Dh8a_N0YwL77YHIA]        

3、上海开展网络平台算法典型问题专项检查

近期，上海市网信办会同有关单位，对属地短视频类、生活服务类、论坛社交类等12家网站平台开展算法典型问题专项检查，指导整改工作。检查中发现的企业共性问题包括在整治“信息茧房”方面，标签管理机制不健全，导致算法推送内容类型多样性效果不明显；在规范热搜榜单方面，部分平台未有效对热搜榜单算法原理进行公示说明；在算法向上向善方面，AI生成信息的识别和审核能力不足，部分平台AI生成的文本、语音内容存在诱导性信息；在算法安全主体责任方面，算法“应备尽备”落实不到位，部分平台算法尚未备案，或备案进度较为缓慢等。

【点击查阅完整问题清单：

https://mp.weixin.qq.com/s/Ew7oUxMgbR55719BvMEiaA】      

3. Shanghai conducted special inspection on typical problems of network platform algorithms

Recently, the Shanghai Cyberspace Administration, together with relevant units, conducted a special inspection of typical algorithm problems on 12 local websites platforms, including short videos, life services, forums, and social media platforms, and provided guidance for rectification work. Common issues found among the companies inspected include: in terms of rectifying the ‘information cocoon’, the labeling management mechanism is not sound, resulting in the lack of significant effect of the diversity of content types pushed by the algorithm; in terms of regulating the hot search list, some platforms have not effectively publicised and explained the algorithm principles for the hot search list; in terms of the algorithm being used for good, there is insufficient ability to identify and review AI-generated information, and some platforms have AI-generated text and voice content that contains misleading information; in terms of the responsibility for algorithm security, some platforms have not yet filed their algorithms, or the progress of filing is slow.

[Click to view the complete list of questions:

https://mp.weixin.qq.com/s/Ew7oUxMgbR55719BvMEiaA]

4、全国首例AI文生视频案二审宣判

2024年12月30日，长沙中院对全国首例AI文生视频侵权案二审作出宣判。本案中，腾讯公司指控百度公司未经授权，擅自通过“度加”软件的AI功能，在“素材库”中向用户提供涉案作品素材视频的行为构成侵权。百度公司辩称，“度加”软件是根据用户的指令，在百家号等信息存储空间搜寻相匹配的视频片段，以“素材”形式提供给用户使用，“度加”并不对素材进行存储，仅是临时呈现。涉案视频是根据用户输入的文本，即时生成的视频。法院审理后认为，“度加”软件素材库的涉案视频是长期保存在其服务器，可供不特定用户随时随地获取，因此，百度公司侵犯了涉案作品的信息网络传播权。

【点击查阅完整判决书：

https://mp.weixin.qq.com/s/YEv7DXVJgRfuGeV1CGwUow】           

4. The second instance verdict in the first AI-assisted video case was announced

On December 30, 2024, the Changsha Intermediate People's Court announced the verdict in the second instance of the first AI-assisted video infringement case. In this case, Tencent accused Baidu of infringing copyright by using the AI function of the ‘Du Jia’ software to provide users with the video material of the work involved in the ‘material library’ without authorisation. Baidu argued that the ‘Du Jia’ software searches for matching video clips in information storage spaces such as Baijiahao according to user instructions, and provides them to users in the form of ‘materials’. ‘Du Jia’ does not store the materials, but only temporarily displays them. The video in question was instantly generated based on the text entered by the user. After hearing the case, the court ruled that the video in question in the ‘Du Jia’ software material library is permanently stored on its server and can be accessed by unspecified users anytime, anywhere. Therefore, Baidu infringed the right to disseminate the work in question via information networks.    

[Click to view the full verdict:

https://mp.weixin.qq.com/s/YEv7DXVJgRfuGeV1CGwUow]

1、EDPB针对删除权启动协调执法行动

3月5日，欧洲数据保护委员会（EDPB）宣布，根据《通用数据保护条例》（GDPR）第17条，就删除权（“被遗忘权）启动了2025年协调执法框架（CEF）行动。EDPB指出，32个DPA将参与该行动，并将很快与欧洲不同行业的多个控制者联系，启动新的正式调查或开展事实调查。EDPB特别强调，DPA将检查控制者如何处理和响应删除请求，以及行使该权利的条件和例外情况。

【点击查阅官方新闻稿：

https://www.edpb.europa.eu/news/news/2025/cef-2025-launch-coordinated-enforcement-right-erasure_en】           

1. EDPB launched coordinated enforcement on the right to erasure

On March 5, the European Data Protection Board (EDPB) announced that it launched a Coordinated Enforcement Framework (CEF) action for 2025 on the right to erasure or the 'right to be forgotten' under Article 17 of the General Data Protection Regulation (GDPR).The EDPB outlined that 32 DPAs will take part in the initiative and will soon contact several controllers from different sectors across Europe by opening new formal investigations or conducting fact-finding exercises. In particular, the EDPB highlighted that the DPAs will check how controllers handle and respond to the requests for erasure; and apply the conditions and exceptions for the exercise of this right.

[Click to view the official press release:

https://www.edpb.europa.eu/news/news/2025/cef-2025-launch-coordinated-enforcement-right-erasure_en]      

2、英国ICO调查TikTok使用儿童个人信息情况 

3月3日，英国信息专员办公室（ICO）宣布已启动三项调查，调查TikTok、Reddit和Imgur如何保护英国儿童用户的隐私。ICO解释说，其对TikTok的调查正在考虑该平台如何使用英国13-17岁青少年的个人信息来向他们提供推荐内容，并将推荐的内容推送到他们的信息流中。ICO指出，如果调查确定任何公司违反了数据保护法，ICO将在得出最终结论之前通知这些公司并获取其陈述。

【点击查阅官方新闻稿：

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/02/investigations-announced-into-how-social-media-and-video-sharing-platforms-use-uk-children-s-personal-information/】           

2. ICO launched investigation into use of children's personal information by TikTok

On March 3, the UK’s Information Commissioner's Office (ICO) announced that it had launched three investigations looking into how TikTok, Reddit, and Imgur protect the privacy of their child users in the UK.The ICO explained that its investigation into TikTok is considering how the platform uses personal information of 13–17-year-olds in the UK to make recommendations to them and deliver suggested content to their feeds. The ICO noted that if its investigations determine that any of the companies have broken data protection law, the ICO would inform the companies and obtain their representations before reaching a final conclusion.

[Click to view the official press release:

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/02/investigations-announced-into-how-social-media-and-video-sharing-platforms-use-uk-children-s-personal-information/]