Digital Economy and Data Protection Newsletter（26.03）

Click above｜Follow us

Domestically, MIIT and other authorities released the 2026 Guidelines for Automotive Data Outbound Security, Shanghai launched a dedicated data outbound zone and CAC issued relevant Q&As; MPS solicited opinions on the Cybercrime Prevention and Control Law and cyberspace regulators penalized Kuaishou; the State Council standardized government mobile apps and local authorities reported problematic apps; SAMR published typical cases of unfair competition and illegal advertising; Hangzhou Intermediate People’s Court ruled on an AI unfair competition case and MOHRSS will issue employment promotion documents; two national standards on personal information transfer and PIP compliance audits were released, and CAC branches in Guangdong and Sichuan published PIPO and minor protection audit hotlines. Internationally, the EU, Australia and the UK shared age assurance insights and Brazil obtained the EU’s data adequacy decision, the EU launched a DMA investigation into Google; Google settled with Android users for over $100 million and New York passed/revised AI and privacy bills; the UK ICO issued a statement on the Data (Use and Access) Act and investigated Grok; Denmark, France, Germany, South Korea and other countries also introduced new data protection and AI regulatory measures.

HOTSPOT

MIIT and Seven Other Authorities Issued the Guidelines for the Security of Automotive Data Outbound Transfer (2026 Edition)

On January 30, 2026, the MIIT and seven other competent authorities jointly issued the Guidelines for the Security of Automotive Data Outbound Transfer (2026 Edition), with the core contents as follows:

1) Clarified scenario-based determination rules: Systematically sorted out five core business scenarios including R&D and design, manufacturing, driving automation, software upgrade services, and connected operation; formulated nine categories of important data determination rules integrating quantitative and qualitative indicators, improving operational feasibility.

2) Strengthened supervision over key fields: Emphasized the surveying and mapping approval procedures for the outbound transfer of surveying and mapping geographic information including spatial coordinates; added battery management-related data in multiple scenarios in response to export control requirements; focused on Over-the-Air (OTA) upgrade data related to safe driving and battery management.

3) Optimized connection with existing supervision mechanisms: On the basis of exemptions under current laws and regulations, added industry-specific exemption scenarios such as special provisions for free trade zones and security vulnerability patching; carried out scenario-based restructuring and clarification of the important data identification criteria such as "personal information of 100,000 individuals" stipulated in the original Provisions on the Administration of Automotive Data Security (for Trial Implementation).

4) Highlighted technical evidence and closed-loop supervision: In addition to proposing management requirements, the Guidelines emphasized verifiable technical measures such as protection technologies, security monitoring, log auditing and emergency response, promoting the transformation of supervision to a technical evidence-oriented model.

To learn more information, please click here.

Source: MIIT

https://wap.miit.gov.cn/zwgk/zcwj/wjfb/tz/art/2026/art_bf7894e87df640c5be83ffe3ce0a2c40.html

MPS Solicited Public Opinions on the Cybercrime Prevention and Control Law (Draft for Comment)

To effectively curb the source of cybercrime and build a systematic prevention and control framework, the MPS released the Cybercrime Prevention and Control Law (Draft for Comment) on January 31, 2026, soliciting public opinions with a feedback deadline of March 2, 2026. The draft focuses on four core aspects: First, strengthening the management of network infrastructure resources, and controlling "illegal SIM cards, fake accounts, unregulated network lines and unauthorized devices" through a strict real-name system and dynamic verification mechanism; Second, systematically regulating the cybercrime ecosystem, and setting legal red lines for key links in the underground and gray industrial chains such as traffic diversion and promotion, technical support, and payment and settlement; Third, imposing prevention and control obligations on network operators, and clarifying their hierarchical and classified responsibilities for monitoring, blocking and reporting based on service types and scales; Fourth, improving cross-border cybercrime prevention and control measures, clarifying that foreign acts that harm China's interests are subject to liability, and stipulating sanction tools such as asset freezing and entry restrictions.

Source: MPS

Two National Standards on the Right to Personal Information Transfer and PIP Compliance Audit Requirements Approved and Released

Recently, the SAMR and the Standardization Administration of China issued the Announcement of National Standards of the People's Republic of China (No.38, 2025), officially releasing three national standards under the jurisdiction of the National Information Security Standardization Technical Committee. Among them, GB/T 46901-2025 Data Security Technology - Requirements for Personal Information Transfer Based on Individual Requests and GB/T 46903-2025 Data Security Technology - Requirements for Personal Information Protection Compliance Audit have been made public and will take effect on July 1, 2026.

1) GB/T 46901 specifies the scope of application, prerequisite requirements, process requirements and other requirements for specific circumstances of personal information transfer based on requests from data subjects; it is applicable to guiding personal information processors in responding to such requests, and also for the supervision and management work of regulatory authorities and third-party evaluation institutions.

2) GB/T 46903 proposes the principles of PIP compliance audit, and stipulates the general requirements, implementation processes, contents and methods of such audits; it is applicable to personal information processors and professional institutions conducting PIP compliance audit activities.

Source: TC260

German Court Ruled That Data Controllers Must Ensure Data Processors Delete Personal Data in a Timely Manner

On November 11, 2025, the Federal Court of Justice of Germany (BGH) heard a case involving the infringement of users' data rights and interests caused by a data security incident. The plaintiff is a German user of D, a French online music streaming service provider. Company O was once an external data processor of D, and its services for D terminated on December 1, 2019. After notifying D of its intention to delete relevant data on November 30, 2019, the processor only confirmed the completion of deletion via email for the first time on February 22, 2023. The trial found that the processor failed to delete the data immediately as agreed, but instead moved the user data from the production environment to the test environment. Starting from November 2022, the D platform user data held by the processor was stolen by hackers or leaked without authorization by its employees, and the plaintiff's personal information such as name, email address, language and registration date in the D platform user file was leaked.

The plaintiff claimed against D, the data controller, that it had failed to perform its protection obligations under the General Data Protection Regulation (GDPR), demanding compensation for non-pecuniary damages (due to fears of the data being used for identity theft, phishing attacks, illegal marketing, etc.) and a confirmation that the data controller is obligated to compensate for all future pecuniary damages that may arise from the illegal disclosure of the data. The German local court dismissed the plaintiff's claim, and the higher court dismissed the plaintiff's appeal; with the approval of the appeal court, the plaintiff filed a retrial with the BGH, continuing to assert the above claims.

The BGH held that D only accepted the deletion notice from Company O at the termination of the entrustment and did not require written confirmation of the complete deletion of data, which constituted at least slight negligence. In addition, D failed to prove the absence of a causal relationship between its breach of obligation and the plaintiff's damages, thus violating its obligations under the GDPR. The court ruled to remand the case for a new trial.

Source: Federal Court of Justice of Germany

https://www.bundesgerichtshof.de/SharedDocs/Entscheidungen/DE/Zivilsenate/VI_ZS/2024/VI_ZR_396-24.pdf

NEWSLETTER

（Click on the source or copy the corresponding link to view the details）

LEGISLATION

MIIT and Seven Other Departments Issue the Guidelines for the Security of Automobile Data Outbound Transfers (2026 Edition)
Source: MIIT
https://wap.miit.gov.cn/zwgk/zcwj/wjfb/tz/art/2026/art_bf7894e87df640c5be83ffe3ce0a2c40.html
Ministry of Public Security Publicly Solicits Comments on the Anti-Cybercrime Law (Draft for Comment)
Source: MPS
General Office of the State Council Issues the Measures for the Standardized Administration of Government Affairs Mobile Internet Applications
Source: CAC
https://www.cac.gov.cn/2026-01/28/c_1771330044357878.htm
CAC and 10 Other Departments Issue the Implementation Opinions on Improving the Convenience of Digital Services for Foreign Personnel Entering China
Source: CAC
National Standard Cybersecurity Technology-Software Bill of Materials (SBOM) Data Format Released
Source: TC260
Three National Standards Including Data Security Technology-Requirements for Personal Information Transfer Based on Individual Requests Released

Source: TC260
Network Security Standard Practice Guide-Technical Requirements for Network Data Labeling and Identification Released
Source: TC260
TC260 Releases the First Batch of National Cybersecurity Standard Needs for 2026
Source: TC260
Beijing Municipal Bureau of Economy and Information Technology and Three Other Departments Issue the Several Measures of Beijing Municipality for Promoting the Development and Utilization of Commercial Satellite Remote Sensing Data Resources (2026-2030)
Source: Beijing Municipal Bureau of Economy and Information Technology
https://jxj.beijing.gov.cn/zwgk/2024zcwj/202601/t20260123_4459532.html
Weihai Issues the Implementation Rules for the Registration and Administration of Public Data Resources of Weihai City (Trial)
Source: People's Government of Weihai City
https://www.weihai.gov.cn/art/2026/1/29/art_103264_33890.html?sessionid=821694035

INDUSTRY TRENDS

CAC Releases Policy and Regulatory Q&A on Data Outbound Transfer Security Management (January 2026)
Source: CAC
Cyberspace Administration Authorities Impose Legal Penalties on Kuaishou Platform
Source: Beijing Cyberspace Administration
SAMR Announces Five Typical Cases of Unfair Competition in the Artificial Intelligence Field
Source: SAMR
SAMR Announces Eight Typical Cases of Online Unfair Competition
Source: SAMR
SAMR Announces Ten Typical Cases of Illegal Advertising
Source: SAMR
SAMR Concentratedly Releases the Fifth Batch of Typical Cases in the Live E-Commerce Field
Source: SAMR
Central Cyberspace Administration of China and National Healthcare Security Administration Jointly Conduct In-depth Rectification of False and Inaccurate Online Information Related to the Collection and Procurement of Drugs and Medical Consumables
Source: CAC
National Financial Regulatory Administration, Central Cyberspace Administration of China, Ministry of Public Security, People's Bank of China, and China Securities Regulatory Commission Issue a Risk Warning on Guarding Against Traps in Illegal "Agent Rights Protection" Short Videos and Live Broadcasts
Source: CAC
Central Cyberspace Administration of China Holds a Promotion and Deployment Meeting on the Negative List for Algorithms of Lifestyle Service Platforms (Trial)
Source: CAC
Ministry of State Security Releases Multiple Cases

Focus on Cross-border Security of Biological Data
Source: Ministry of State Security
Focus on Browser Plug-in Security
Source: Ministry of State Security
Focus on NFC Security
Source: Ministry of State Security
Focus on Internet Group Security
Source: Ministry of State Security

Cybersecurity Threat and Vulnerability Information Sharing Platform Issues an Early Warning on Preventing Security Risks of OpenClaw Open-Source AI Agents
Source: Cybersecurity Threat and Vulnerability Information Sharing Platform
Hangzhou Intermediate People's Court: AI Generation Services "Free-riding" on Market Achievements of Specific Platforms Constitutes Unfair Competition
Source：Zhichanbao
National Cyber Security and Information Security Notification Center Notifies 72 Mobile Applications Illegally Collecting and Using Personal Information
Source: National Cyber Security and Information Security Notification Center
Shangrao Supervision Branch of the National Financial Regulatory Administration Announces Administrative Penalty Information; Shangrao Bank Fined for Insufficient Information Security Management
Source: National Financial Regulatory Administration
https://www.nfra.gov.cn/branch/jiangxi/view/pages/common/ItemDetail.html?docId=1242115&itemId=1515
Beijing Communications Administration Issues Announcement on Problematic Mobile Internet Applications (Second Issue of 2026)
Source: Beijing Communications Administration
Guangdong Communications Administration Issues an Announcement on Removing 9 Apps
Source: Guangdong Communications Administration
Guangdong Communications Administration Publicly Announces 31 Apps That Failed to Complete Rectification as Required
Source: Guangdong Communications Administration
Announcement on the List of Apps Infringing on Users' Rights and Interests in Sichuan and Chongqing (First Issue of 2026)
Source: Chongqing Communications Administration
Hunan Provincial Party Committee Cyberspace Administration of China and Hunan Communications Administration Issue an Announcement on Removing 11 Mobile Applications Infringing on Users' Rights and Interests
Source: Hunan Cyberspace Administration
Hunan Provincial Party Committee Cyberspace Administration of China and Hunan Communications Administration Publicly Announce 9 Mobile Applications That Failed to Complete Rectification on Schedule
Source: Hunan Cyberspace Administration
Zhejiang Communications Administration Issues an Announcement on Apps (Mini Programs) That Infringe on Users' Rights and Interests (12th Batch of 2025)
Source: Zhejiang Communications Administration
Guangdong Cyberspace Administration of China Issues an Announcement on Publishing Consultation Telephone Numbers for the Submission of Information on Personal Information Protection Officers and Compliance Audit Reports on the Protection of Minors' Personal Information in Guangdong Province
Source: Guangdong Cyberspace Administration
Chongqing Cyberspace Administration of China Issues an Announcement on Network Law Enforcement in 2025
Source: Chongqing Cyberspace Administration
Data Outbound Transfer Section of the "China Shanghai" Portal Officially Launched
Source: Shanghai Cyberspace Administration
Ministry of Human Resources and Social Security Reveals It Will Issue Documents to Address the Impact of Artificial Intelligence and Promote Employment
Source: Privacy Guard
Shenzhen Intermediate People's Court Clarifies the Ownership of Platform-derived Data Rights and Interests and the Illegal Boundary of AI Data Crawling
Source: Zhichanbao

OVERSEAS

International:

European Commission, Australia's eSafety Commissioner, and UK's Ofcom Share Insights on Age Assurance Measures
Source: European Commission
https://digital-strategy.ec.europa.eu/en/news/commission-australias-esafety-commissioner-and-uks-ofcom-share-insights-age-assurance-measures
Brazil Obtains EU Data Adequacy Decision for Cross-border Data Transfers
Source: ANPD
https://www.gov.br/anpd/pt-br/assuntos/noticias/brasil-e-uniao-europeia-reconhecem-adequacao-mutua-em-protecao-de-dados-pessoais

EU：

European Commission Determines That Apple Ads and Apple Maps Should Not Be Designated Under the DMA
Source: European Commission
https://digital-markets-act.ec.europa.eu/commission-finds-apple-ads-and-apple-maps-should-not-be-designated-under-digital-markets-act-2026-02-05_en
EU Launches DMA Investigation into Google's AI and Search Data
Source: European Commission
https://digital-markets-act.ec.europa.eu/commission-opens-proceedings-assist-google-complying-interoperability-and-online-search-data-sharing-2026-01-27_en
European Commission Launches Public Consultation on Draft Guidelines for the Data Act (on Compensation Calculation)
Source: European Commission
https://digital-strategy.ec.europa.eu/en/consultations/data-act-commission-seeks-feedback-draft-guidelines-reasonable-compensation
EU EIOPA Releases Report on the Application of Generative AI in the European Insurance Industry
Source: EIOPA
https://www.eiopa.europa.eu/eiopa-survey-generative-ai-shows-swift-cautious-adoption-among-europes-insurers-2026-02-02_en
EU Establishes Signatory Taskforce for the GPAI Code of Practice
Source: European Commission
https://digital-strategy.ec.europa.eu/en/pages/signatory-taskforce-gpai-code-practice
EU Adopts Proposal on Transparency and Fair Remuneration for Protected Works Used in Generative AI
Source: European Commission
https://www.europarl.europa.eu/news/en/press-room/20260126IPR32636/protect-copyrighted-work-used-by-generative-ai-say-legal-affairs-meps
EDPB Releases Report on International Data Protection Law Enforcement Cooperation
Source: EDPB
https://www.edpb.europa.eu/our-work-tools/our-documents/support-pool-experts-projects/report-international-data-protection_en

US:

Google Pays Over $100 Million to Settle with Android Users; Maximum Payout Per User is $100
Source: Privacy Guard
NSA Releases Zero Trust Implementation Guide
Source: NSA
http://media.defense.gov/2026/Jan/30/2003868308/-1/-1/0/CTR_ZIG_PHASE_ONE.PDF
New York: Bill Amending the RAISE Act Passes Senate, Imposing Transparency and Security Requirements on AI Providers
Source: New York State Senate
https://www.nysenate.gov/legislation/bills/2025/S8828
New York: Bill on Fingerprinting and Mandatory Employee Iris and Retinal Scans Passes Senate
Source: New York State Senate
https://www.nysenate.gov/legislation/bills/2025/S681
New York: Patient Privacy Act Passes Senate
Source: New York State Senate
https://www.nysenate.gov/legislation/bills/2025/S555
New York: New York Electronic Communications Privacy Act Amended in Assembly
Source: New York State Senate
https://www.nysenate.gov/legislation/bills/2025/A2565/amendment/A

UK:

ICO Issues Statement on the Commencement of the Data Use and Access Act (DUAA)
Source: ICO
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/statement-on-the-commencement-of-the-data-use-and-access-act-duaa/
ICO Releases New Data Protection Complaint Handling Framework
Source: ICO
https://ico.org.uk/make-a-complaint/data-protection-framework/
ICO Announces Investigation into Grok
Source: ICO
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/

Denmark: Datatilsynet Responds to Consultation on Clauses of Data Processing Agreements for Personal Data Transfers to Third Countries
Source: Datatilsynet
https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/jan/vilkaar-i-databehandleraftalen-om-overfoersler-af-personoplysninger-til-tredjelande
France:

CNIL Releases 2026-2028 Work Program
Source: CNIL
https://www.cnil.fr/fr/economie-de-la-donnee-la-cnil-publie-son-programme-de-travail-pour-2026-2028
CNIL Releases Guidelines on Data Processing for Scientific Research Purposes
Source: CNIL
https://www.cnil.fr/fr/traitements-de-donnees-des-fins-de-recherche-scientifique-hors-sante-quand-saisir-la-cnil

Germany:

BaFin Releases ICT Risk Guidelines for Financial Entities Using Artificial Intelligence
Source: BaFin
https://www.bafin.de/SharedDocs/Veroeffentlichungen/EN/Meldung/2025/neu/meldung_2025_12_18_orientierungshilfe_ikt_risiken_en.html
German Court Rules Meta Illegally Processes Instagram User Data
Source: German Court
https://www.medienservice.sachsen.de/medien/news/1094746
German Court Rules That Controllers Must Ensure Contracted Processors Delete Personal Data in a Timely Manner
Source: German Court
https://www.bundesgerichtshof.de/SharedDocs/Entscheidungen/DE/Zivilsenate/VI_ZS/2024/VI_ZR_396-24.pdf

South Korea:

AI Basic Act Takes Effect
Source: National Law Information Center of South Korea
https://www.law.go.kr/%EB%B2%95%EB%A0%B9/%EC%9D%B8%EA%B3%B5%EC%A7%80%EB%8A%A5%20%EB%B0%9C%EC%A0%84%EA%B3%BC%20%EC%8B%A0%EB%A2%B0%20%EA%B8%B0%EB%B0%98%20%EC%A1%B0%EC%84%B1%20%EB%93%B1%EC%97%90%20%EA%B4%80%ED%95%9C%20%EA%B8%B0%EB%B3%B8%EB%B2%95/(20676,20250121)
PIPC Engages with Autonomous Driving and Robotics Industries
Source: PIPC
https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=11792
KMCC Announces Review Plan for Personal Location Information Service Providers
Source: KMCC
https://www.kmcc.go.kr/user.do?mode=view&page=A05030000&dc=K05030000&boardId=1113&cp=1&nop=10&boardSeq=68021

Singapore: IMDA Releases Model Governance Framework for Agentic AI
Source: IMDA
https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2026/new-model-ai-governance-framework-for-agentic-ai
Ireland: Government Releases General Scheme for Implementing the EU AI Act
Source: Irish Government
https://enterprise.gov.ie/en/legislation/general-scheme-of-the-regulation-of-artificial-intelligence-bill-2026.html
Sweden: IMY Releases 2026 Regulatory Priorities
Source: IMY
https://www.imy.se/nyheter/imys-prioriteringar-2026--ai-barn-och-brottsbekampning/
Poland: UODO Releases Strategic Report on AI Applications and Personal Data Protection
Source: UODO
https://uodo.gov.pl/pl/612/4064
Latvia: DVI Releases Guidelines on Cookie Policy Requirements
Source: DVI
https://www.dvi.gov.lv/lv/jaunums/dviskaidro-kas-ir-sikdatnu-politika
Japan: PPC Updates Operational Guidelines for the Personal Information Protection Commission
Source: PPC
https://www.ppc.go.jp/news/publicinfo/
Austria: Supreme Court Rules That Loot Boxes in FIFA Games Do Not Constitute Gambling, Stating That Loot Boxes Should Be Evaluated in the Context of the Game
Source: Jdsupra
https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=888874ff-7ee8-458a-9be2-a24b42a864f1&Abfrage=Gesamtabfrage&SearchInAsylGH=&SearchInAvn=&SearchInAvsv=&SearchInBegut=&SearchInBgblAlt=&SearchInBgblAuth=&SearchInBgblPdf=&SearchInBks=&SearchInBundesnormen=&SearchInBvb=&SearchInBvwg=&SearchInDok=&SearchInDsk=&SearchInErlaesse=&SearchInGbk=&SearchInGemeinderecht=&SearchInGemeinderechtAuth=&SearchInJustiz=&SearchInKmGer=&SearchInLandesnormen=&SearchInLvwg=&SearchInLgbl=&SearchInLgblNO=&SearchInLgblAuth=&SearchInMrp=&SearchInNormenliste=&SearchInPruefGewO=&SearchInPvak=&SearchInRegV=&SearchInSpg=&SearchInUbas=&SearchInUmse=&SearchInUpts=&SearchInUvs=&SearchInVbl=&SearchInVerg=&SearchInVfgh=&SearchInVwgh=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=&ResultPageSize=100&Suchworte=E146470&Dokumentnummer=JJT_20251218_OGH0002_0060OB00228_24H0000_000 https://www.ris.bka.gv.at/Dokumente/Justiz/JJT_20251218_OGH0002_0060OB00228_24H0000_000/JJT_20251218_OGH0002_0060OB00228_24H0000_000.pdf
Netherlands: Acquisition of Dutch Cloud Service Provider Solvinity by US Cloud Service Company Kyndryl Triggers Security Review; Dutch Data Protection Authority Recommends Alignment with EU "Sovereign Cloud" Standards
Source: Euractiv
https://www.euractiv.com/news/dutch-data-protectors-sound-huge-alarm-over-tech-sovereignty/?utm_source=eac&utm_medium=twitter&utm_campaign=euractiv
Italy: Garante Fines a Company for Data Privacy Issues Related to Employee Vehicle Monitoring
Source: Garante
https://www.fiscoetasse.com/files/21237/garanteprivacy-755-2025.pdf
Egypt Releases Implementation Guidelines for the Personal Data Protection Law
Source: PDPC

https://pdpc.gov.eg/laws

Note

本文由Gen AI翻译，仅供参考。

Translated by Gen AI service. For reference only.

本期编辑：吴佳蔚陈煜烺林婉琪陈瑞庭张丽