Digital Economy and Data Protection Newsletter（25.16）

Click above｜Follow us

Recently, at the legislative level, data-related standardization and technical documents have been released frequently. The National Information Security Standardization Technical Committee (TC260) sought public comments on the national standard for personal information anonymization, issued AIGC identification standards, and the National Data Administration published a report on the development of trusted data spaces. At the practical level, the Ministry of Public Security's Computer Security Product Inspection Center found 38 mobile apps illegally collecting and using personal information; CSTIS issued a risk warning against the NordDragonScan malware; and the Supreme People's Court and Beijing Internet Court released typical cases on data rights protection and AI governance. At the industry governance level, CAAM stated that 49 vehicle models from 13 enterprises comply with automotive data security requirements. Overseas, the European Commission opened a consultation on the Whistleblower Protection Directive; U.S. state attorneys general conducted cross-state law enforcement actions; and the UK ICO launched a consultation to revise guidelines for the 2025 Data (Use and Access) Act.

HOTSPOT

National Network Security Standardization Technical Committee Solicits Public Comments on "Data Security Technology - Guidelines and Evaluation Methods for Anonymization of Personal Information (Draft for Comment)" etc.

The National Network Security Standardization Technical Committee (TC260) has recently solicited public comments on "Data Security Technology - Guidelines and Evaluation Methods for Anonymization of Personal Information". This document aims to address the challenges faced by enterprises in practice regarding the standards for anonymization of personal information, and provides specific technical implementation guidelines and effect evaluation criteria for the "anonymization" requirement specified in the Personal Information Protection Law. Once personal information is subject to anonymization measures that comply with the standards, it will no longer be classified as personal information, and the relevant processing activities will be exempted from the constraints of the Personal Information Protection Law. The draft for comment this time provides specific technical paths and effect measurement standards for this key legal concept, which will help enterprises protect user privacy while promoting the compliant circulation and utilization of data. In the future, after the official release of this document, enterprises will have a basis to follow when anonymizing personal information, which is conducive to enterprises promoting the circulation and utilization of data on the premise of ensuring security.

Source: TC260

MIIT and Other Authorities Seek Public Comments on the Measures for the Management and Service of Artificial Intelligence Ethics in Science and Technology (Trial)

Recently, seven authorities including the Ministry of Industry and Information Technology (MIIT) jointly released the draft for comments on the Measures for the Management and Service of Artificial Intelligence Ethics in Science and Technology (Trial). This Measures aims to establish a governance framework for ethics in science and technology within China's artificial intelligence (AI) field and promote "responsible innovation". Its core requirement is to establish enterprises' internal ethical governance systems, covering the entire life cycle of AI activities. The Measures encourages enterprises to set up science and technology ethics (review) committees, designate responsible persons, and proactively identify, assess and prevent risks.

Source: Ministry of Industry and Information Technology (MIIT)

https://wap.miit.gov.cn/jgsj/kjs/jscx/gjsfz/art/2025/art_092a447008f340d3abd55819b8c8e5cf.html

The Supreme People's Court Releases the 47th Batch of Guiding Cases, Focusing on Judicial Protection of Data Rights and Interests

On August 28, 2025, the Supreme People's Court released the 47th Batch of Guiding Cases (Guiding Cases No. 262 – 267), which marks the first time that special guiding cases have been issued with the theme of "judicial protection of data rights and interests". There are 6 cases in this batch:

(1) Guiding Case No. 262: It clarifies that an online platform has an independent operational interest in a data set formed through substantial investment, and such interest is protected by law;

(2) Guiding Case No. 263: It clarifies that if an online platform provides users with associated account services and transfers the data obtained by users on the associated online platforms after obtaining user authorization, so as to facilitate users' processing of such data within a reasonable scope and without disrupting the market competition order, such act does not constitute an unfair competition act;

(3) Guiding Case No. 264: It clarifies that if a data processor collects, processes and reasonably uses enterprise data in accordance with the law without causing damage to the rights and interests of the enterprise, such act does not constitute an infringement;

(4) Guiding Case No. 265: Where the collection of user profile information is not necessary for providing online services, failure to provide users with an option to refuse or an alternative login method constitutes an infringement of users' personal information rights and interests;

(5) Guiding Case No. 266: It clarifies that the "enjoy-first-pay-later" function takes the activation of credit services as a necessary condition, and the relevant personal information processing activities fall into the category of "being necessary for concluding or performing a contract where an individual is a party";

(6) Guiding Case No. 267: It clarifies that for the enforcement of delivering online platform accounts and passwords, the relevant real-name authentication information shall be changed in accordance with the law at the same time as the accounts and passwords are delivered.

Source: Supreme People's Court

Shanghai Issues the "Shanghai Guidelines for the Security Management of Surveying, Mapping and Geographic Information for Intelligent Connected Vehicles (Trial)"

On August 23, 2025, the Shanghai Municipal Bureau of Planning and Natural Resources issued the "Shanghai Guidelines for the Security Management of Surveying, Mapping and Geographic Information for Intelligent Connected Vehicles (Trial)" (hereinafter referred to as the "Guidelines"), aiming to standardize the security management of intelligent connected vehicles in such links as the collection, transmission, storage and application of surveying, mapping and geographic information. The Guidelines apply to high-precision maps in Shanghai and pilot projects of "vehicle-road-cloud integration" application.They clarify that surveying and mapping qualification entities (map service providers) are the main bodies responsible for surveying and mapping security. Vehicle manufacturers, service providers and other parties must collaboratively establish a full-process geographic information data security system. The Guidelines emphasize principles including the minimum necessity of data collection, de-identification and desensitization, and classification and grading. In addition, they propose that the municipal planning and natural resources department, in conjunction with multiple departments, build a supervision system featuring "prior notification, in-process prevention and control, and post-event inspection" to ensure the healthy development of the intelligent connected vehicle industry under the premise of security and compliance.

Source: Shanghai Municipal Bureau of Planning and Natural Resources

https://ghzyj.sh.gov.cn/zcwj/chgl/20250825/7fb303a0931747f9a4f24b34dc4bfe60.html

NEWSLETTER

（Click on the source or copy the corresponding link to view the details）

LEGISLATION

The Standing Committee of the National People's Congress plans to deliberate an amendment to the Cybersecurity Law
Source: Supreme People's Court
The National Development and Reform Commission, the State Administration for Market Regulation, and the Cyberspace Administration of China publicly solicit comments on the “Rules on the Pricing Practices of Internet Platforms (Draft for Comment)”
Source: Cyberspace Administration of China
https://www.cac.gov.cn/2025-08/22/c_1757583110578862.htm
The Ministry of Industry and Information Technology and other departments publicly solicit comments on the “Measures for the Management and Services of AI Technology Ethics (Trial)”
Source: Ministry of Industry and Information Technology
https://wap.miit.gov.cn/jgsj/kjs/jscx/gjsfz/art/2025/art_092a447008f340d3abd55819b8c8e5cf.html
The National Trademark Office releases an interpretation of the “Measures for the Fast-Track Examination of Trademark Registration Applications”
Source: National Trademark Office
https://sbj.cnipa.gov.cn/sbj/ssbj_gzdt/202508/t20250822_36144.html
The National Information Security Standardization Technical Committee (TC260) publicly solicits comments on the “Data Security Technology—Guidelines and Evaluation Methods for the Anonymization of Personal Information (Draft for Comment)” and other documents
Source: TC260
The National Information Security Standardization Technical Committee (TC260) releases six cybersecurity standard practice guidelines, including “Identification Method for AI-Generated Synthetic Content—Implicit Identification of Document Metadata—Text Documents”
Source: TC260
https://www.tc260.org.cn/front/postDetail.html?id=20250828165129
The National Information Security Standardization Technical Committee (TC260) announces the initiation of 28 national cybersecurity standard projects
Source: TC260
https://www.tc260.org.cn/front/postDetail.html?id=20250825101804
The China Electronics Standardization Institute solicits comments on 18 AI-related industry standards, including “AI—Processing Flow and Evaluation Model for Large Model Training Data”
Source: China Electronics Standardization Institute
Shanghai issues the “Guidelines for the Security Management of Surveying and Mapping Geographic Information for Intelligent Connected Vehicles in Shanghai (Trial)”
Source: Shanghai Municipal Bureau of Planning and Natural Resources
https://ghzyj.sh.gov.cn/zcwj/chgl/20250825/7fb303a0931747f9a4f24b34dc4bfe60.html
Zhejiang publicly solicits comments on the “Guidelines for the Application of Data Intellectual Property Registration in the AI Field in Zhejiang Province (2025 Edition) (Draft for Comment)”
Source: Zhejiang Provincial Intellectual Property Office

INDUSTRY TRENDS

The State Council issues opinions on further implementing the “AI+” initiative
Source: China Government Network
https://www.gov.cn/zhengce/content/202508/content_7037861.htm
The Supreme People's Court releases the 47th batch of guiding cases, focusing on the judicial protection of data rights and interests
Source: Supreme People's Court
The National Data Administration releases the “Report on the Innovative Development of Trusted Data Spaces (2025)”
Source: National Data Administration
https://www.nda.gov.cn/sjj/swdt/xwfb/0829/20250829085131590048920_pc.html
The Quality Supervision and Inspection Center for Computer Information System Security Products of the Ministry of Public Security detects 38 mobile applications that illegally collect and use personal information
Source: National Cybersecurity Bulletin Center
The China Science and Technology Information Security Center (CSTIS) issues a risk alert on preventing the NordDragonScan malware
Source: CSTIS
The China Association of Automobile Manufacturers (CAAM): 49 models from 13 enterprises meet the five compliance requirements for automotive data security
Source: CAAM
http://www.caam.org.cn/chn/1/cate_3/con_5236838.html?sessionid=-1060867696
The Cyberspace Administration of Beijing Municipality promotes the main local network platforms to publicize the principles of algorithmic rules
Source: Cyberspace Administration of Beijing Municipality
The Cyberspace Administration of Beijing Municipality conducts training on the management policies and filing work for generative AI large models
Source: Cyberspace Administration of Beijing Municipality
The Shanghai Communications Administration issues a notice on taking down 58 applications with acts of infringing on user rights and interests
Source: Shanghai Communications Administration
The Cyberspace Administration of Shanghai Municipality holds a work promotion meeting on the identification of AI-generated synthetic content
Source: Cyberspace Administration of Shanghai Municipality
The Notice on the Registration Information of Generative AI Services in Shanghai (August 19)
Source: Cyberspace Administration of Shanghai Municipality
Three enterprises in the third batch in Hunan Province complete the filing for the application of facial recognition technology
Source: Cyberspace Administration of Hunan Province
The Ningbo Communications Administration standardizes short message service behaviors to prevent nuisance from unwanted information
Source: Ningbo Communications Administration
The Cyberspace Administration of Hainan Province publicly exposes a number of typical cases in the special campaign of “Cleaning up the Free Trade Port: Governance of the Online Environment for Minors”
Source: Cyberspace Administration of Hainan Province
Case from the Beijing Internet Court: Using AI software to maliciously spoof and defame others' portraits constitutes an infringement of personality rights
Source: Beijing Internet Court
Case from the Beijing Internet Court: AI “deepfake” of a celebrity's voice for live commerce is found to be infringing, and the commissioned promotion merchant is ordered to bear liability
Source: Beijing Internet Court
The Guangzhou Internet Court releases ten typical cases involving digital sports disputes
Source: Guangzhou Internet Court
The Xiamen Municipal Bureau of Justice and the Xiamen Municipal Data Administration release the country's first special compliance guidelines for data asset registration
Source: Xiamen Judicial Administration Network
https://sf.xm.gov.cn/zwgk/xxyw/202508/t20250821_2951612.htm
Representatives from multiple local governments and enterprises jointly launch the “Initiative for Building a Data Factor Ecosystem”
Source: People's Daily Online
https://finance.people.com.cn/n1/2025/0826/c1004-40550575.html
The National Information Security Standardization Technical Committee (TC260) publicly releases a recommended list of selected application practice cases for AI security standards
Source: TC260
https://www.tc260.org.cn/front/postDetail.html?id=20250826152601

OVERSEAS

International: ISO releases the ISO/IEC 27018:2025 standard on the protection of personal information in public cloud services
Source: ISO
https://www.iso.org/standard/27018?browse=ics#:~:text=ISO%2FIEC%2027018%20provides%20guidance%20for%20protecting%20personally%20identifiable,cloud%20service%20provider%20acts%20as%20a%20PII%20processor
European Union:

The European Commission announces a public consultation on the evaluation of the Whistleblower Protection Directive
Source: European Commission
https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14468-Whistleblower-Protection-Directive-evaluation_en
The European Media Freedom Act comes into full effect

Source: European Commission
https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/new-push-european-democracy/protecting-democracy/european-media-freedom-act_en

United States:

FTC Chair warns tech companies against weakening data privacy for US users in order to comply with EU and UK laws
Source: FTC
https://www.ftc.gov/news-events/news/press-releases/2025/08/ftc-chairman-ferguson-warns-companies-against-censoring-or-weakening-data-security-americans-behest?utm_source=govdelivery
The FTC bans SpyFone and its CEO from engaging in surveillance business and orders the company to delete all illegally obtained data through surreptitious means
Source: FTC
https://www.ftc.gov/news-events/news/press-releases/2025/07/ftc-seeks-comment-petition-vacate-2021-order-related-provider-stalkerware-apps
NIST revises the SP 800-53 Security and Privacy Controls
Source: NIST
https://csrc.nist.gov/News/2025/nist-releases-revision-to-sp-800-53-controls#:~:text=NIST%20has%20issued%20Special%20Publication%20%28SP%29%20800-53%20Release,Executive%20Order%2014306%20on%20strengthening%20the%20Nation%E2%80%99s%20cybersecurity
44 state attorneys general send a letter to AI companies regarding inappropriate sexual interactions between minors and accessible chatbots
Source: California Department of Justice
https://oag.ca.gov/news/press-releases/attorney-general-bonta-warns-ai-companies-if-you-harm-children-you-will-be-held#:~:text=OAKLAND%20%E2%80%94%20California%20Attorney%20General%20Rob%20Bonta%20today%2C,sexually%20inappropriate%20interactions%20between%20AI%20chatbots%20and%20children
47 state attorneys general send letters to multiple technology and payment platforms on the compliance issues of deepfake technology
Source: National Association of Attorneys General
https://www.naag.org/press-releases/state-and-territory-attorneys-general-urge-tech-and-payment-platforms-to-address-deepfake-exploitation/
In the series of copyright cases related to AI training, Anthropic reaches a settlement with book authors
Source: Northern District of California Court
https://chatgptiseatingtheworld.com/2025/08/26/anthropic-bartz-book-authors-reach-a-class-settlement-wow-the-dominoes-are-falling/
Anthropic updates its privacy policy, requiring users to decide by September 28, 2025 whether to consent to the use of their data for model training
Source: Anthropic
https://www.anthropic.com/news/updates-to-our-consumer-terms?sessionid=
The Arizona AG calls on Instagram to strengthen the privacy protection of its location-sharing feature
Source: Arizona AG
https://www.azag.gov/ag-mayes-calls-on-instagram-location-privacy
The Minnesota AG sues TikTok over its addictive algorithms and exploitative features
Source: Minnesota AG
https://www.ag.state.mn.us/Office/Communications/2025/docs/TikTok_Complaint.pdf
The Texas AG launches an investigation into Meta and Character.AI for their AI chatbots' alleged misleading of children
Source: Texas AG
https://texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-investigates-meta-and-characterai-misleading-children-deceptive-ai
xAI sues OpenAI and Apple over monopoly issues
Source: Fox Business
https://www.foxbusiness.com/technology/elon-musks-xai-sues-apple-openai-over-ai-competition-app-store-rankings
ChatGPT is sued by a California couple for allegedly inducing a teenager to commit suicide
Source: CNN
https://edition.cnn.com/2025/08/26/tech/openai-chatgpt-teen-suicide-lawsuit

United Kingdom:

The ICO launches a consultation on amending the guidance for the Data (Use and Access) Act 2025
Source: ICO
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/08/ico-launches-consultations-for-data-use-and-access-act-2025-amendments/
Apple ends the transatlantic privacy dispute, and the UK abandons the data “backdoor” requirement
Source: AP News
https://apnews.com/article/apple-iphone-data-privacy-uk-us-gabbard-bd1114c2f8ef5bcbfa7b870c32505e4f

Germany: The Federal Office for Information Security (BfDI) updates the GDPR handbook
Source: BfDI
https://www.bfdi.bund.de/SharedDocs/Kurzmeldungen/DE/2025/14-aktualisierte-Broschuere.html
Italy: The National Cybersecurity Agency (ACN) releases practical guidelines for SMEs on cyber risks
Source: ACN
https://www.acn.gov.it/portale/w/cybersicurezza-acn-diffonde-guide-pratiche-per-supportare-le-pmi-nella-protezione-dai-rischi-informatici
Brazil:

The “Law on the Protection of Children and Adolescents in the Digital Environment” is submitted to the Chamber of Deputies for deliberation
Source: Brazilian Senate
https://www25.senado.leg.br/web/atividade/materias/-/materia/170017
The Office of the Attorney General of Brazil issues a non-judicial notice to Meta AI regarding chatbots that simulate children's characteristics and provide inappropriate conversations
Source: Brazilian Government Website
https://www.gov.br/agu/pt-br/comunicacao/noticias/agu-aciona-meta-contra-robos-que-promovem-erotizacao-infantil

Australia: Australia's Department of Industry, Science and Resources (DISR) releases an AI maturity self-assessment tool
Source: DISR
https://www.industry.gov.au/news/benchmark-your-responsible-ai-maturity-level-new-self-assessment-tool#:~:text=The%20self-assessment%20tool%20assesses%20your%20AI%20practices%20across,maturity%20levels%20-%20emerging%2C%20developing%2C%20implementing%20and%20leading
Israel: Issues Q&A on the 13th Amendment to the Privacy Protection Law
Source: Government of Israel
https://www.gov.il/he/pages/sguide_tikon13_professional_new
Nepal: The government approves the National Artificial Intelligence Policy
Source: Government of Nepal
https://np.ictframe.com/nepal-ai-policy-2082/
Malaysia: The Malaysian Communications and Multimedia Commission (MCMC) launches a public consultation on the proposed framework for unsolicited commercial electronic messages (UCEM)
Source: MCMC
https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/Public-Consultation-Paper-on-UCEM.pdf

Note

本文由Gen AI翻译，仅供参考。

Translated by Gen AI service. For reference only.

本期编辑：吴佳蔚陈煜烺林婉琪陈曦宇张丽