Digital Economy and Data Protection Newsletter（26.08）

Click above｜Follow us

Recently, in the AI sector, three ministries have jointly issued the Implementation Opinions on the Regulated Application and Innovative Development of Agents; the MIIT has launched a pilot program for AI ethics review; multiple departments have rectified illegal acts involving generative synthesis labeling; and the NDRC has prohibited foreign capital from acquiring the Manus Project. In terms of cross-border data flow, Beijing has released a facilitation program for cross-border data flow. For internet information service governance, the CAC has notified a number of illegal and non-compliant mobile applications, investigated and punished self-media accounts that failed to mark information sources in a standardized manner. Overseas, the Council of the European Union and the European Parliament have reached a provisional agreement on streamlining the AI Act; the U.S. Senate has passed the GUARD Act to protect children from harms caused by AI chatbots; the Ireland DPC has launched a GDPR compliance investigation into Shein Ireland.

HOTSPOT

The CAC, the NDRC, and the MIIT jointly issued the Implementation Opinions on the Standardized Application and Innovative Development of AI Agents

On May 8, 2026, the CAC, the NDRC, and the MIIT jointly issued the Implementation Opinions on the Regulated Application and Innovative Development of Agents (hereinafter referred to as the "Opinions"). The Opinions state that an agent is an intelligent system capable of autonomous perception, memory, decision-making, interaction and execution, representing an important form of artificial intelligence products and services. The application and development of agents shall adhere to the basic principles of security and controllability, standardized and orderly development, innovation-driven growth and application orientation. The Opinions define the overall framework for the regulated application and innovative development of agents from five aspects: development foundation, security bottom line, application traction, innovation ecosystem and supporting measures. Among them, the Opinions put forward a number of important governance planning measures, including formulating a standard framework for agents, supporting the development of mandatory standards in medical treatment, transportation, media, public security and other fields, improving policies, regulations and ethical norms and ensuring alignment with systems such as artificial intelligence ethical review, conducting tiered and classified governance of agents in a prudent and steady manner, and determining the applicable scenarios for sensitive fields and key industries by the cyberspace administration jointly with the competent industry authorities.

Source: Cyberspace Administration of China

https://www.cac.gov.cn/2026-05/08/c_1779979789523320.htm

Notice of the Beijing Municipal Cyberspace Administration and two other authorities on issuing the Implementation Plan for Further Deepening the Comprehensive Supporting Reform to Facilitate Cross-Border Data Flows

On May 8, 2026, the CAC Beijing Municipal Office, Beijing Municipal Bureau of Commerce, and Beijing Municipal Bureau of Government Services and Data Management publicly issued the Implementation Plan for Further Deepening the Comprehensive Supporting Reforms for the Facilitation of Cross-Border Data Flows (hereinafter referred to as the "Plan"). The Plan states that the negative list management model for outbound data transfers, which was originally only applicable in the China (Beijing) Pilot Free Trade Zone, will be extended to the entire administrative area of Beijing, and the wide application of the negative list will be accelerated in nine industrial sectors, namely automobiles, pharmaceuticals, retail, civil aviation, artificial intelligence, autonomous driving, medical devices, trade and logistics, and banking. Systematic arrangements will also be made in terms of declaration procedures, identification of important data, certification for outbound transfer of personal information, and compliance pathways for key industries. With regard to the identification of important data, the Plan clearly specifies that an industry-specific identification and assessment mechanism for important data shall be established in accordance with the principle of "the department in charge of business operations shall be responsible for the corresponding business data and data security", relevant authorities shall formulate a responsibility list for the identification of important data, and enterprises may directly consult and confirm with the corresponding competent authorities. The Plan also proposes to promote a certification system of "one certification, multiple uses ", which is applicable to scenarios such as marketing, customer service, and supply chain collaboration within multinational enterprises, and the Cross-Border Data Service Center will be equipped with dedicated certification counselors to provide full-process services. For key industries such as healthcare, intelligent connected vehicles, trade and logistics, and tech finance, the Plan further sets up special compliance channels respectively. For example, innovative drugs going global will adopt the pathway of "negative list management + controllable technical environment", and the "Medicine Data Station Express" will be set up in the Economic and Technological Development Zone to provide one-stop services.

Source: Beijing Municipal Cyberspace Administration

NEWSLETTER

（Click on the source or copy the corresponding link to view the details）

LEGISLATION

The Cyberspace Administration of China, the National Development and Reform Commission, and the Ministry of Industry and Information Technology jointly issued the Implementation Opinions on the Standardized Application and Innovative Development of AI Agents
Source: Cyberspace Administration of China
https://www.cac.gov.cn/2026-05/08/c_1779979789523320.htm
The Ministry of Industry and Information Technology issued the Notice on Implementing the Pilot Program for Artificial Intelligence Science and Technology Ethics Review and Services
Source: Ministry of Industry and Information Technology
The Cyberspace Administration of China issued a notice soliciting public comments on the Implementation Rules for Cybersecurity Labeling of Consumer Connected Cameras (Draft for Comments) and related standards
Source: Cyberspace Administration of China
The State Administration for Market Regulation (Standardization Administration of China) approved 16 national standardization guiding technical documents, including Artificial Intelligence - Terminal Intelligence Grading - Part 1: Reference Framework
Source: Standardization Administration of China
https://std.sacinfo.org.cn/gnoc/queryInfo?id=31934533D5445F5FCED1BF79F6AE776C
The National Energy Administration, together with the National Development and Reform Commission, the Ministry of Industry and Information Technology, and the National Data Administration, issued the Action Plan for Promoting Two-Way Empowerment Between Artificial Intelligence and Energy
Source: National Energy Administration
Notice of the Beijing Municipal Cyberspace Administration and two other authorities on issuing the Implementation Plan for Further Deepening the Comprehensive Supporting Reform to Facilitate Cross-Border Data Flows
Source: Beijing Municipal Cyberspace Administration

INDUSTRY TRENDS

Supreme People's Court: World Intellectual Property Organization Collection of Leading IP Cases - China Volume (2019-2023) released to the public
Source: Supreme People's Court
China National Intellectual Property Administration released typical trademark opposition review cases for 2025
Source: China National Intellectual Property Administration
China National Intellectual Property Administration released typical patent reexamination and invalidation cases for 2025
Source: China National Intellectual Property Administration
China National Intellectual Property Administration released typical administrative protection cases for intellectual property in 2025
Source: China National Intellectual Property Administration
National Data Administration: China has built more than 116,000 high-quality datasets
Source: National Data Administration
Digital China Development Report (2025) officially released
Source: National Data Administration
National Dataset Management Service Platform officially released and launched for trial operation at the Digital China Summit
Source: National Dataset Management Service Platform
https://www.ndsms.cn/
The Cyberspace Administration of China released the section on deepening cyber legislation in the China Cyber Rule of Law Development Report (2025)
Source: Cyberspace Administration of China
The Cyberspace Administration of China issued a notice on personal information collection and use issues involving 33 apps
Source: Cyberspace Administration of China
Cyberspace authorities investigated and penalized, in accordance with law, websites and platforms including the Jianying App for violations relating to the labeling of AI-generated and synthetic content
Source: Cyberspace Administration of China
Cyberspace Administration of China released Q&As on personal information protection policies and regulations (April 2026)
Source: Cyberspace Administration of China
Cyberspace Administration of China: cyberspace authorities will strictly regulate self-media accounts that fail to properly indicate information sources
Source: Cyberspace Administration of China
Announcement of the Cyberspace Administration of China on releasing the 17th batch of filing information for deep synthesis service algorithms
Source: Cyberspace Administration of China
Cyberspace Administration of China: multiple authorities jointly addressed online rumors involving fabricated policies, hype around trending topics, and misleading public opinion
Source: Cyberspace Administration of China
The Office of the Foreign Investment Security Review Working Mechanism of the National Development and Reform Commission issued a decision prohibiting foreign investment in the acquisition of the Manus project and required the parties to revoke the acquisition transaction decision
Source: National Development and Reform Commission
https://zfxxgk.ndrc.gov.cn/web/iteminfo.jsp?id=20623
The National Computer Virus Emergency Response Center detected 67 mobile applications that illegally or improperly collected and used personal information
Source: National Cybersecurity Notification Center
Beijing Municipal Administration for Market Regulation published a batch of typical enforcement cases in the field of intellectual property
Source: Beijing Municipal Administration for Market Regulation

OVERSEAS

European Union:

The Council and the Parliament reached a provisional agreement to simplify certain parts of the EU AI Act
Source: Council of the European Union
https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/
The European Commission urged EU Member States to accelerate the rollout of the EU age verification app, with the aim of making it available to citizens by the end of 2026
Source: European Commission
https://commission.europa.eu/news-and-media/news/commission-urges-fast-rollout-age-verification-app-2026-04-29_en
The European Commission preliminarily found that Meta violated the Digital Services Act (DSA) by failing to prevent minors under the age of 13 from using Instagram and Facebook
Source: European Commission
https://ec.europa.eu/commission/presscorner/detail/en/ip_26_920
The European Commission launched a public consultation on the draft guidelines on transparency obligations under Article 50 of the AI Act
Source: European Commission
https://digital-strategy.ec.europa.eu/en/library/draft-guidelines-implementation-transparency-obligations-certain-ai-systems-under-article-50-ai-act
Europol released a report on the latest trends in the cybercrime landscape
Source: European Commission
https://home-affairs.ec.europa.eu/news/europol-published-report-latest-trends-cybercrime-landscape-2026-04-29_en
The EDPB released multiple opinions on Binding Corporate Rules (BCRs)
Source: EDPB
https://www.edpb.europa.eu/our-work-tools/our-documents/publication-type/opinion-board-art-64_en
LinkedIn accused of violating Article 15 of the GDPR
Source: NOYB
https://noyb.eu/en/linkedin-locks-your-gdpr-rights-behind-paywall

United States:

The Senate Judiciary Committee unanimously passed the GUARD Act to protect children from harms caused by AI chatbots
Source: U.S. Congress
https://www.congress.gov/bill/119th-congress/senate-bill/3062/text
The FTC banned Kochava from selling sensitive location information without consumers' express consent
Source: FTC
https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data
CAISI under NIST signed pre-deployment evaluation agreements for frontier AI models with Google DeepMind, Microsoft, and xAI
Source: CNBC
https://www.cnbc.com/2026/05/05/ai-oversight-trump-google-microsoft-xai.html
Senators introduced the CHATBOT Act to establish parental controls for children's use of AI chatbots
Source: United States Senate
https://www.commerce.senate.gov/press/rep/release/cruz-schatz-curtis-schiff-introduce-new-bill-giving-parents-control-over-kids-ai-chatbot-use/

United Kingdom:

The ICO published its final guidance on Storage and Access Technologies
Source: ICO
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/
Following Data (Use and Access) Act 2025, the ICO published final updated guidance on “Charities given new flexibility to contact supporters under data law change”
Source: ICO
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/charities-given-new-flexibility-to-contact-supporters-under-data-law-change/

Germany:

The BfDI released its 34th Activity Report for 2025
Source: BfDI
https://www.bfdi.bund.de/SharedDocs/Downloads/DE/Taetigkeitsberichte/34.TB/34TB_25.html
NOYB filed a lawsuit against the Hamburg data protection authority (HmbBfDI) over inaction against PimEyes
Source: NOYB
https://noyb.eu/en/no-action-taken-against-pimeyes-noyb-lawsuit-against-hamburg-dpa

France:

The CNIL recommended that DPOs prepare activity reports
Source: CNIL
https://cnil.fr/fr/rapport-activite-dpo
The CNIL approved a GDPR Code of Conduct for the retail sector, the first national code approved by the CNIL
Source: CNIL
https://www.cnil.fr/fr/la-cnil-approuve-le-code-de-conduite-porte-par-lalliance-du-commerce

Spain:

The AEPD published the first issue of its scientific journal on privacy, innovation, and technology
Source: AEPD
https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/agencia-publica-primer-numer-de-la-revista-cientifica-privacidad-innovacion-y-tecnologia
The AEPD reported a significant increase in complaints in 2025, up 64% year on year and exceeding 30,000 complaints
Source: AEPD
https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-agencia-recibio-mas-de-30.000-reclamaciones-en-2025-un-64-mas

Italy: The AGCM closed three investigations into DeepSeek, Mistral, and NOVA AI after the three companies committed to improving transparency around AI hallucination risks
Source: AGCM
https://www.agcm.it/media/comunicati-stampa/2026/4/PS12942-PS12968-PS12973
Ireland: The DPC launched a formal inquiry into Shein Ireland to examine the GDPR compliance of its transfers of EU/EEA users' personal data to China
Source: RTE
https://www.rte.ie/news/business/2026/0505/1571828-shein/
Croatia: The data protection authority (AZOP) issued AI guidelines providing a methodology for fundamental rights impact assessment (FRIA)
Source: AZOP
https://azop.hr/metodologija-za-provedbu-procjene-ucinka-na-ljudska-prava-fria/
Canada:

The OPC released the findings of its joint investigation with provincial authorities into OpenAI ChatGPT
Source: OPC
https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_260506/
The Information and Privacy Commissioner of Ontario (IPC) and the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) issued a joint statement on privacy and security during the FIFA World Cup
Source: Newswire
https://www.newswire.ca/news-releases/ready-to-host-the-world-joint-statement-by-the-information-and-privacy-commissioner-of-ontario-and-the-information-and-privacy-commissioner-of-british-columbia-on-ensuring-both-privacy-and-security-during-the-fifa-world-cup-808427155.html
Ontario IPC published a case involving a patient privacy breach caused by unauthorized AI meeting transcription
Source: IPC
https://www.ipc.on.ca/en/cases-of-note/artificial-intelligence-gone-wrong-why-custodians-need-strong-ai-frameworks-and-policies

South Korea: MSIT established a public-private R&D working group to address AI-manipulated videos (deepfakes)
Source: MSIT
https://www.msit.go.kr/bbs/view.do
Singapore: GovTech released the Governing AI Responsibly guide to help enterprises build trusted digital systems
Source: GovTech
https://www.tech.gov.sg/technews/governing-ai-responsibly/
Malaysia: JPDP officially released three guidelines on DPIA, Privacy by Design, and Automated Decision-Making and Profiling
Source: JPDP
https://www.pdp.gov.my/ppdpv1/en/akta/data-protection-impact-assessment-guideline-dpia/
Brazil: A Senate committee approved PL 2616/2025 to restrict persistent telemarketing
Source: Federal Senate of Brazil
https://www25.senado.leg.br/web/atividade/materias/-/materia/168844
Uganda: PDPO issued a notice to health institutions requiring compliance with data protection requirements, including registration of data controllers and appointment of DPOs
Source: PDPO
https://x.com/pdpoUG/status/2049040853860045203

Note

本文由Gen AI翻译，仅供参考。

Translated by Gen AI service. For reference only.

本期编辑：吴佳蔚陈煜烺林婉琪陈瑞庭张膑月张丽