Digital Economy and Data Protection Newsletter（26.17）

Click above｜Follow us

Recently, in the area of AI governance, the National Cybersecurity Standardization Technical Committee (TC260) released the AI Safety Governance Framework 3.0, the Guidelines for the Security of AI Applications — General Provisions, and a number of other cybersecurity standards, while the Cyberspace Administration of China (CAC) completed filing for three on-device generative AI services for mobile phones. In legislation and policy, the Supreme People's Court issued a draft judicial interpretation on trademark-related matters for public comment, the Ministry of Industry and Information Technology (MIIT) released the pharmaceutical industry plan for the 15th Five-Year Plan period, and the Beijing Municipal Regulation on Surveying, Mapping and Geographic Information was adopted. In regulatory enforcement, the National Computer Virus Emergency Response Center issued a notice on apps illegally collecting and using personal information, and the National Internet Emergency Center (CNCERT) released the results of its 2026 public security testing of large AI models. Overseas, the European Commission proposed the KIDS Act, the EDPB opened its guidelines on GDPR administrative fines for public consultation, the EDPB finalized its guidelines on the relationship between the DSA and the GDPR, and California signed into law bills on children's online safety and artificial intelligence, among other developments.

HOTSPOT

The Cyberspace Administration of China publicly solicits comments on the Provisions of the State Council on Safeguarding the Healthy and Safe Use of the Internet by Minors (Draft for Comments)

On September 18, 2026, the Cyberspace Administration of China (CAC) released the Provisions of the State Council on Safeguarding the Healthy and Safe Use of the Internet by Minors (hereinafter referred to as the "Provisions") for public consultation, with feedback due by October 17, 2026.

The Provisions comprise twenty-five articles and, at the level of administrative regulation, establish the minor online protection obligations of network service providers, smart terminal device manufacturers, and app distribution platform service providers. Adhering to the principle of the best interests of minors, the Provisions establish a full-chain protection system covering network services, smart terminals, and app distribution platforms. The regulated entities under the Provisions include network service providers, smart terminal device manufacturers, and app distribution platform service providers. The Provisions set out requirements for the provision of network services to minors from the perspective of these three categories of regulated entities, to which relevant enterprises should pay close attention.

Source: Cyberspace Administration of China

https://www.cac.gov.cn/2026-09/18/c_1791482017777471.htm

The National Technical Committee 260 on Cybersecurity of Standardization Administration of China releases the Artificial Intelligence Security Governance Framework 3.0

On September 14, 2026, the National Technical Committee 260 on Cybersecurity of the Standardization Administration of China ("TC260") released the AI Safety Governance Framework 3.0 (the "Framework 3.0"). Building upon the 1.0 version (2024) and 2.0 version (2025), the Framework 3.0 continues the core logic of "risk classification, technical responses, and comprehensive governance." In light of the evolving trend of artificial intelligence transitioning from "answering questions" to "performing tasks," it further updates risk classification and governance measures. This release places particular emphasis on emerging risks associated with agentic AI, embodied AI, autonomous cyberattacks, and open-source and supply chain security, and introduces a dedicated Agentic AI Risk Management Framework, setting out full-lifecycle safety measures covering identity and access management, tool invocation, memory management, human approval, and operational monitoring.

Source: Cyberspace Administration of China

https://www.cac.gov.cn/2026-09/14/c_1791137092283345.htm

NEWSLETTER

（Click on the source or copy the corresponding link to view the details）

LEGISLATION

The Supreme People's Court releases the Provisions of the Supreme People's Court on Several Issues Concerning the Temporal Effect of the Application of the Trademark Law of the People's Republic of China (Draft for Comments) and the Provisions of the Supreme People's Court on Several Issues Concerning the Trial of Administrative Cases Involving Trademark Authorization and Confirmation (Draft for Comments)
Source: Supreme People's Court
The Cyberspace Administration of China publicly solicits comments on the Provisions of the State Council on Safeguarding the Healthy and Safe Use of the Internet by Minors (Draft for Comments)
Source: Cyberspace Administration of China
https://www.cac.gov.cn/2026-09/18/c_1791482017777471.htm
The National Technical Committee 260 on Cybersecurity of Standardization Administration of China releases the Artificial Intelligence Security Governance Framework 3.0
Source: Cyberspace Administration of China
https://www.cac.gov.cn/2026-09/14/c_1791137092283345.htm
TC260 releases the Cybersecurity Standards Practice Guide—Security Requirements for Cockpit Data Processing
Source: National Technical Committee 260 on Cybersecurity of Standardization Administration of China (TC260)
TC260 releases four Cybersecurity Standards Practice Guides, including the Artificial Intelligence Application Security Guidelines—General Principles
Source: National Technical Committee 260 on Cybersecurity of Standardization Administration of China (TC260)
The National Technical Committee 260 on Cybersecurity of Standardization Administration of China releases three Cybersecurity Standards Practice Guides supporting the mandatory national standard Technical Requirements for Information Erasure of Electronic Products: Guidelines for Block Erasure of Semiconductor Storage Media, Guidelines for Information Erasure Management in Electronic Product Recycling, and Guidelines for Information Erasure of Mobile Intelligent Terminals
Source: National Technical Committee 260 on Cybersecurity of Standardization Administration of China (TC260)
https://www.tc260.org.cn/front/bzzqyjList.html?start=0&length=10
The National Technical Committee 260 on Cybersecurity of Standardization Administration of China publicly solicits comments on the Cybersecurity Standards Practice Guide—Security Guidelines for Agentic System Development (Draft for Comments)
Source: National Technical Committee 260 on Cybersecurity of Standardization Administration of China (TC260)
https://www.tc260.org.cn/front/bzzqyjList.html?start=0&length=10
The State Administration for Market Regulation approves and releases the national standard Specification for Automotive Software Quality and Defect Management (GB/T 48140—2026)
Source: State Administration for Market Regulation
https://www.samr.gov.cn/xw/sj/art/2026/art_a9aa58a7f3e74296b74fdfb490739307.html
The Beijing Municipal Regulations on Surveying, Mapping and Geographic Information are adopted and will take effect on January 1, 2027
Source: Standing Committee of the Beijing Municipal People's Congress
The Standing Committee of the Tianjin Municipal People’s Congress releases the Tianjin Data Regulations (Draft)
Source: Standing Committee of the Tianjin Municipal People's Congress
https://www.tjrd.gov.cn/flfg/system/2026/09/18/030037860.shtml
The Shandong Provincial Data Regulations are adopted and will take effect on December 1
Source: Standing Committee of the Shandong Provincial People's Congress
http://www.sdrd.gov.cn/articles/ch00639/202609/9de85115-a0bc-43c6-b45d-83afdf83cf43.shtml

INDUSTRY TRENDS

The Supreme People's Court releases typical cases on cyber rule of law adjudication by people's courts
Source: Supreme People's Court
The Ministry of Agriculture and Rural Affairs, the State Administration for Market Regulation, and the China National Intellectual Property Administration jointly issue the Implementation Plan for the Special Action on Agricultural Brand Protection (2026—2027), calling for strict enforcement against agricultural trademark infringement, geographical indication infringement, patent counterfeiting and other unlawful conduct
Source: Ministry of Commerce
https://dzswgf.mofcom.gov.cn/news/phone/43/2026/9/m-1789699553566.html
The Cyberspace Administration of China releases the Q&A on Policies and Regulations for Security Management of Cross-Border Data Transfers (September 2026), clarifying the relationship between the certification route and the security assessment route
Source: Cyberspace Administration of China
The Cyberspace Administration of China releases an announcement on registered generative artificial intelligence services (July to August 2026)
Source: Cyberspace Administration of China
Three categories of high-quality datasets, including Chinese Internet Basic Corpus 4.0, are officially released
Source: Cyberspace Administration of China
The Office of the Central Cyberspace Affairs Commission issues the Notice on Strengthening the Management of Enterprise-Related Infringing Information and Continuously Improving the Online Business Environment, requiring platforms to proactively remove five categories of enterprise-related infringing information and strengthen governance of personal information, accounts and MCNs
Source: Cyberspace Administration of China
https://www.cac.gov.cn/2026-09/18/c_1791396347229199.htm
The Cyberspace Administration of China releases an announcement on the filing of three mobile-device-side generative artificial intelligence services
Source: Cyberspace Administration of China
https://www.cac.gov.cn/2026-09/23/c_1791913977404975.htm
The Office of the Central Cyberspace Affairs Commission reviews progress in cybersecurity work: data security and personal information protection continue to be strengthened, personal-information risks in cross-border scenarios are highlighted, and a case involving unlawful cross-border data transfers by a multinational company is disclosed
Source: Cyberspace Administration of China
https://www.cac.gov.cn/2026-09/13/c_1790876172055373.htm
The Cyberspace Administration of China releases recent typical enforcement cases in cybersecurity, data security and personal information protection
Source: Cyberspace Administration of China
The Office of the Central Cyberspace Affairs Commission reports unlawful and non-compliant collection and use of personal information detected in 30 Apps
Source: Cyberspace Administration of China
https://www.cac.gov.cn/2026-09/20/c_1791481881543149.htm
The Cyberspace Administration of China publicly discloses the second batch of typical cases from the “Qinglang · Optimizing the Online Business Environment and Rectifying Malicious Hype of Enterprise-Related Information” special campaign
Source: Cyberspace Administration of China
https://www.cac.gov.cn/yaowen/A0936index_1.htm
The Ministry of Industry and Information Technology and nine other departments issue the 15th Five-Year Plan for the Development of the Pharmaceutical Industry, proposing deeper AI-enabled upgrading
Source: Ministry of Industry and Information Technology
The Cybersecurity Administration of the Ministry of Industry and Information Technology releases security testing results for critical network equipment (Batch 26), covering routers, switches and programmable logic controllers
Source: Ministry of Industry and Information Technology
https://wap.miit.gov.cn/jgsj/waj/gzdt/art/2026/art_06862e839fa1405c9a0dfc8cbffec325.html
China and the United States reach an eight-point consensus, agreeing to establish a China-U.S. dialogue on artificial intelligence to exchange views on AI-related risks and benefits
Source: State Administration for Market Regulation
The Ministry of Public Security announces interim results of the “Clean Net—2026” special campaign and releases ten typical cases involving the crackdown and rectification of cyber-related violations and crimes
Source: Ministry of Public Security
https://www.mps.gov.cn/n2254098/n4904352/c10611418/content.html
The Cybersecurity Bureau of the Ministry of Public Security releases a case concerning refusal to fulfill information network security management obligations
Source: Cybersecurity Bureau of the Ministry of Public Security
The National Data Administration issues the first batch of data property rights registration certificates to 56 enterprises and institutions
Source: National Data Administration
https://www.nda.gov.cn/sjj/swdt/mtsy/0921/20260921120942131211051_pc.html
The Civil Aviation Administration of China and the National Data Administration jointly issue the Implementation Plan for Building a Civil Aviation Data Governance System
Source: Civil Aviation Administration of China
http://www.caac.gov.cn/XXGK/XXGK/ZCFB/202609/t20260916_231721.html
The National Computer Virus Emergency Response Center releases the Statistical Analysis Report on Mobile Internet Application Security (2026)
Source: National Computer Virus Emergency Response Center
https://www.cverc.org.cn/head/jishubaogao/ydbg2026.htm
The National Computer Virus Emergency Response Center releases the Comprehensive Security Evaluation Report on Large Models and Agents (2026)
Source: National Computer Virus Emergency Response Center
https://www.cverc.org.cn/head/jishubaogao/dmxbg2026.htm
The National Computer Virus Emergency Response Center reports that 82 mobile applications unlawfully or non-compliantly collect and use personal information
Source: National Cybersecurity Notification Center
The results of the 2026 public testing of artificial intelligence large-model security are released
Source: National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC)
The China Cyberspace Security Association releases the list of Apps that completed optimization and improvement of personal-information collection and use (Batch 3 of 2026)
Source: China Cyberspace Security Association
The China Academy of Information and Communications Technology releases the Annual Observation Report on Global Digital Trade Rules (2026)
Source: China Academy of Information and Communications Technology
The Shanghai Intellectual Property Court issues a first-instance judgment in SAP v. Langze concerning copyright infringement, ordering the defendant to cease the infringement and pay RMB 1.18 million in damages
Source: Shanghai Intellectual Property Court
http://www.shzcfy.gov.cn/detail.jhtml?id=10006683
The Beijing Municipal Cyberspace Administration releases an announcement on registered generative artificial intelligence services
Source: Beijing Municipal Cyberspace Administration
The Beijing Municipal Cyberspace Administration releases an announcement on filed generative artificial intelligence services
Source: Beijing Municipal Cyberspace Administration
The Beijing Municipal Administration for Market Regulation opens investigations into four online hotel and travel booking platform operators in accordance with law
Source: Beijing Municipal Administration for Market Regulation
The Shanghai Information Security Testing Evaluation and Certification Center launches China’s first public service platform for generative artificial intelligence security testing
Source: Shanghai Information Security Testing Evaluation and Certification Center
The Shanghai Municipal Cyberspace Administration releases an announcement on registered generative artificial intelligence services
Source: Shanghai Municipal Cyberspace Administration
The Shanghai Municipal Cyberspace Administration releases an announcement on registered generative artificial intelligence services
Source: Shanghai Municipal Cyberspace Administration
The Hunan Provincial Cyberspace Administration summons seven large-model operators, orders rectification within a prescribed period, and requires investigation of vulnerabilities in information-security guardrails
Source: Hunan Provincial Cyberspace Administration
The Shanxi Provincial Public Security Department releases the results of the “Clean Net 2026” and “Cybersecurity Protection 2026” special campaigns
Source: People's Government of Shanxi Province
https://www.shanxi.gov.cn/ywdt/sxyw/202609/t20260916_10221034.shtml
Wuhan releases the 15th Five-Year Plan for High-Quality Development of the Digital and Intelligent Economy of Wuhan, specifying institutional development for authorized operation of public data, data assets, trusted data spaces and AI security governance
Source: Wuhan Municipal People's Government
https://www.wuhan.gov.cn/zwgk/xxgk/zfwj/szfwj/202609/t20260917_2849323.shtml
The Anhui Communications Administration releases the public notice on the ninth batch of 2026 shell-type approval data clean-up and the report on website approval administration for Issue 8
Source: Anhui Communications Administration
https://ahca.miit.gov.cn/xxgk/zfxxgkzl/fdzdgknr/index.html

OVERSEAS

International:

The Chinese and Russian intellectual property offices officially launch a pilot “Focal Point Mechanism” for intellectual property
Source: China National Intellectual Property Administration
https://www.cnipa.gov.cn/art/2026/9/15/art_53_208168.html
Sixty organizations launch a five-year AI language inclusion initiative aiming to reach 3.4 billion people
Source: Gates Foundation
https://www.gatesfoundation.org/ideas/progress/ai-for-good/language-commitment

European Union:

The European Commission proposes the KIDS Act to strengthen online protection for minors
Source: European Commission
https://digital-strategy.ec.europa.eu/en/news/eu-kids-act-restrict-social-media-platforms-access-children-eu
The European Banking Authority (EBA) publishes its final Guidelines on the management of third-party risk
Source: EBA
https://www.eba.europa.eu/publications-and-media/press-releases/eba-publishes-its-final-guidelines-management-third-party-risk-delivering-more-proportionate-and
The European Data Protection Board (EDPB) launches a public consultation on guidelines concerning GDPR administrative fines
Source: EDPB
https://www.edpb.europa.eu/public-consultations/guidelines-042026-on-the-application-of-the-power-to-impose-administrative_en
The European Data Protection Board (EDPB) finalizes guidelines on the interplay between the DSA and the GDPR
Source: EDPB
https://www.edpb.europa.eu/documents/guideline/guidelines-042026-on-the-application-of-the-power-to-impose-administrative_en
The European Union Agency for Cybersecurity (ENISA) implements the Cyber Resilience Act vulnerability and incident reporting requirements
Source: ENISA
https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp
ENISA publishes the ENISA Threat Landscape 2026
Source: ENISA
https://www.enisa.europa.eu/news/exploring-the-evolution-of-the-cyber-threat-landscape-how-dependencies-weaken-our-digital-resilience
The European Data Protection Supervisor (EDPS) publishes a TechDispatch on secure multi-party computation
Source: EDPS
https://www.edps.europa.eu/data-protection/our-work/publications/techdispatch/2026-09-17-techdispatch-12026-secure-multi-party-computation_en
An Advocate General of the Court of Justice of the European Union opines that consent for “partners” to use data is insufficient to authorize direct marketing by partners whose identities are unknown
Source: Court of Justice of the European Union
https://curia.europa.eu/site/upload/docs/application/pdf/2026-09/cp260130en.pdf

United States:

NIST formally publishes NIST IR 8587, establishing security guidance to protect identity and access tokens against forgery, theft and misuse
Source: NIST
https://www.nist.gov/news-events/news/2026/09/nist-finalizes-guidelines-protecting-online-identity-and-access-tokens
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) release guidance to protect federal cloud identity systems
Source: CISA
https://www.cisa.gov/news-events/news/cisa-and-nist-release-guidelines-protect-federal-cloud-identity-systems-token-theft-forgery-and
A U.S. House member’s office announces two bipartisan AI bills: the American AI Security Act and the China FIREWALL Act
Source: Office of U.S. Representative Josh Gottheimer
https://gottheimer.house.gov/posts/release-gottheimer-announces-new-bipartisan-legislation-on-ai-safety-to-protect-jersey-families-national-security
Senators introduce the AI Risk Management and Security Act of 2026
Source: Office of U.S. Senator Brian Schatz
https://www.schatz.senate.gov/news/press-releases/schatz-warner-to-take-to-senate-floor-to-demand-passage-of-new-ai-security-legislation
The New York State Department of Financial Services (NYDFS) issues new guidance on cybersecurity risk assessments
Source: NYDFS
https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20260910
The Governor of California signs child online safety and artificial intelligence legislation
Source: Office of the Governor of California
https://www.gov.ca.gov/2026/09/10/governor-newsom-signs-the-strongest-child-safety-chatbot-and-social-media-laws-in-the-nation/
The Governor of California signs legislation requiring advertisements to disclose AI-generated virtual performers
Source: Office of the Governor of California
https://www.gov.ca.gov/2026/09/16/governor-newsom-signs-new-law-to-protect-workers-require-disclosures-on-ai-generated-advertising/
California signs Executive Order N-9-26 to accelerate implementation of independent third-party oversight of AI
Source: Office of the Governor of California
https://www.gov.ca.gov/2026/09/18/governor-newsom-issues-executive-order-to-accelerate-independent-oversight-and-advance-the-creation-of-an-ai-kill-switch/
Virginia releases the Data Center Accountability Framework and signs Executive Order 22, immediately implementing certain data-center governance measures and establishing an AI Task Force
Source: Office of the Governor of Virginia

https://www.governor.virginia.gov/newsroom/news-releases/2026/september-releases/name-1123696-en.html
The U.S. Court of Appeals for the Federal Circuit affirms the judgment of non-infringement for Amazon/AWS in the AlterWAN v. Amazon/AWS patent case
Source: U.S. Court of Appeals for the Federal Circuit
https://www.cafc.uscourts.gov/opinions-orders/25-1285.OPINION.9-11-2026_2754055.pdf
The U.S. Court of Appeals for the Ninth Circuit issues a decision in Doe et al. v. GitHub et al.
Source: U.S. Court of Appeals for the Ninth Circuit
https://www.ca9.uscourts.gov/decisions/opinions/
The court orders behavioral remedies in the Google ad-tech antitrust case, expressly adding interoperability and data-portability requirements
Source: U.S. Department of Justice
https://www.justice.gov/opa/pr/department-justice-again-wins-substantial-relief-against-google
Universal, Sony and ten other record companies file a new copyright lawsuit against AI music company Suno in the U.S. District Court for the District of Massachusetts
Source: Justia
https://dockets.justia.com/docket/massachusetts/madce/1:2026cv14275/306399
Consumers sue Anthropic, OpenAI, Google and SpaceXAI in the U.S. District Court for the Northern District of California, alleging that AI competitors coordinated to slow the pace of frontier AI development in violation of antitrust law
Source: Bloomberg Law
https://www.bloomberglaw.com/public/desktop/document/BuistetalvAnthropicPBCetalDocketNo326cv10693NDCalSep182026CourtDo?doc_id=XB2DGFVVCI9HORMAMOFMINMJF4
The California Attorney General obtains a preliminary injunction blocking FMCSA access to commercial driver data
Source: California Attorney General
https://oag.ca.gov/system/files/attachments/press-docs/pi-order_1.pdf
The Federal Trade Commission reaches a USD 930,000 settlement with Cox Media Group and others over allegations of deceptive AI claims
Source: FTC
http://www.ftc.gov/bureau-consumer-protection
The Federal Trade Commission announces that FleetCor agrees to pay USD 100 million to settle allegations of unauthorized charges
Source: FTC
https://www.ftc.gov/about-ftc/bureaus-offices/press-releases?field_bureau_office_association_target_id=672&page=0

United Kingdom:

The United Kingdom confirms that the ICO will formally become the Information Commission on September 30
Source: ICO
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-to-become-information-commission-on-30-september-2026/
Ofcom launches a regulatory assessment of the use of AI in cyber defence
Source: Ofcom
https://www.ofcom.org.uk/online-safety/safety-technology/ofcom-launches-engagement-on-the-role-of-ai-in-cyber-defence
The Parliamentary Joint Committee on Human Rights publishes a report on artificial intelligence regulation and human rights
Source: UK Parliament Joint Committee on Human Rights
https://committees.parliament.uk/publications/54971/documents/304882/default/
The Information Commissioner’s Office updates its guidance on the public-interest test under the Freedom of Information Act
Source: ICO
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs?facet_type=News%2CStatement%2CSpeech&rows=50
The UK National Cyber Security Centre (NCSC) publishes guidance and scheme documents for the Cyber Adversary Simulation (CyAS) scheme
Source: UK National Cyber Security Centre (NCSC)
https://ncsc.gov.uk/blogs/cyber-adversary-simulation-cyas-scheme-documents-now-available

South Korea:

The Personal Information Protection Commission (PIPC) announces that amendments to the Personal Information Protection Act concerning data breaches have taken effect
Source: PIPC
https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12459
The Personal Information Protection Commission announces proposed amendments to the Enforcement Decree of the Personal Information Protection Act
Source: PIPC
https://www.pipc.go.kr/np/cop/bbs/selectBoardList.do?bbsId=BS074&mCode=C020010000
PIPC publishes guidance on responding to personal information breaches
Source: PIPC
https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS217&mCode=D010030000&nttId=12465
PIPC publishes a handbook on the designation and reporting of data protection officers
Source: PIPC
https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS217&mCode=D010030000&nttId=12466
PIPC and KISA hold a corporate briefing on the overseas transfer regime for personal information, with plans to introduce Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs)
Source: PIPC
https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=&nttId=12471
The Personal Information Protection Commission (PIPC) discusses expanding SCCs and BCRs for cross-border transfers at its “Personal Information Future Forum”
Source: PIPC
https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12507
PIPC conducts an inspection of personal-information processing by robot vacuum cleaners involving five brands: Roborock, Samsung, LG, Ecovacs and Xiaomi
Source: PIPC
https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=&nttId=12470
PIPC launches an investigation into Google over an incident involving leakage of sensitive personal information
Source: PIPC
https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12461
PIPC announces personal-information protection improvement recommendations for five companies: Wrtn, Tesla Korea, DeepSeek, OpenAI and Nike
Source: PIPC
https://pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C010010000&nttId=12499

Germany:

The State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania (LfDI MV) publishes an AI guide for small and medium-sized enterprises
Source: LfDI MV
https://www.datenschutz-mv.de/presse/?id=223405&processor=processor.sa.pressemitteilung
The German Federal Court of Justice (BGH) refers questions to the Court of Justice of the European Union (CJEU) for a preliminary ruling on the GDPR “household exemption”
Source: German Federal Court of Justice (BGH)
https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilungen/DE/2026/2026169.html
The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) publishes a technical and data-protection review of Ray-Ban Meta AI glasses
Source: HmbBfDI
https://datenschutz-hamburg.de/news/ray-ban-meta-ai-glasses-hmbbfdi-legt-technischen-und-datenschutzrechtlichen-pruefbericht-vor

France:

The French Data Protection Authority (CNIL) publishes guidance on data protection in electronic invoicing
Source: CNIL
https://www.cnil.fr/fr/facturation-electronique-quels-enjeux
CNIL publishes survey results on the role of data protection officers and regulatory challenges in the age of artificial intelligence
Source: CNIL
https://www.cnil.fr/en/news
The French Data Protection Authority (CNIL) fines EXTIA EUR 300,000 for failing to respect individuals’ rights
Source: EDPB
https://www.edpb.europa.eu/news/failure-to-respect-the-rights-of-individuals-the-cnil-fined-extia-300-000-eur_en

Italy:

An AI Act adaptation legislative decree is issued, adding Article 437-bis to the Criminal Code: the absence of safety measures or human oversight for high-risk AI systems may constitute a criminal offence where it creates a specific safety danger, and the offence is brought within the corporate liability regime under Legislative Decree No. 231/2001
Source: Gazzetta Ufficiale della Repubblica Italiana
https://www.gazzettaufficiale.it/atto/serie_generale/caricaDettaglioAtto/originario?atto.codiceRedazionale=26G00179&atto.dataPubblicazioneGazzetta=2026-09-15&elenco30giorni=true
The Italian National Cybersecurity Agency (ACN) publishes a compliance handbook for NIS entities
Source: ACN
https://www.acn.gov.it/portale/w/online-il-vademecum-per-i-soggetti-nis
The Garante formally discloses a GDPR fine of more than EUR 5.5 million against BBVA Italia, emphasizing that “system desynchronization” does not excuse failure to give effect to users’ right to object
Source: Garante
https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10294220

Ireland:

The Competition and Consumer Protection Commission (CCPC) highlights the new “access by design” requirement under the Data Act
Source: Competition and Consumer Protection Commission (CCPC)
https://www.ccpc.ie/news-and-media/news/article/2026/09/10/access-by-design--new-eu-data-rules-are-good-news-for-consumers-in-ireland
The National Cyber Security Centre (NCSC) publishes guidance on the Cyber Resilience Act
Source: National Cyber Security Centre (NCSC)
https://www.gov.ie/en/department-of-justice-home-affairs-and-migration/press-releases/cyber-resilience-act-guidelines-published-as-reporting-obligations-come-into-effect/
The Data Protection Commission (DPC) fines Google EUR 403 million for unlawful processing of location data
Source: Data Protection Commission (DPC)
https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location

Sweden:

The data protection authority submits comments on a proposal to strengthen oversight of pharmaceutical prescribing
Source: IMY
https://www.imy.se/remissvar/starkt-tillsyn-och-uppfoljning--forslag-for-att-motverka-oegentlig-lakemedelsforskrivning/
The Swedish Authority for Privacy Protection submits consultation comments on proposed registration rules for the national grades database (BEDA)
Source: IMY
https://www.imy.se/remissvar/universitets--och-hogskoleradets-hemstallan-om-registerforfattning-for-den-nationella-betygsdatabasen-beda/
The data protection authority publishes guidance clarifying the scope of Article 10 of the General Data Protection Regulation regarding processing of criminal-offence data
Source: IMY
https://www.imy.se/nyheter/imy-begar-klargorande-om-vilka-brottsuppgifter-som-omfattas-av-artikel-10/
The Swedish Authority for Privacy Protection opens a data-protection investigation into mass text messages sent by the Sweden Democrats before the election
Source: IMY
https://www.imy.se/nyheter/imy-inleder-granskning-av-politiska-partiers-massutskick-av-sms/
IMY fines Miljödata SEK 1.8 million for security deficiencies in connection with a data breach
Source: IMY
https://www.imy.se/nyheter/sanktionsavgift-mot-miljodata-for-bristande-sakerhet/

Spain:

AEPD analyzes data-protection risks relating to the European Digital Identity Wallet
Source: AEPD
https://www.aepd.es/en/en/press-and-communication/blog/eidas2-the-eudi-wallet-and-the-GDPR-(VI)
AEPD issues a formal warning to a company concerning its evaluation of an AI résumé-screening recruitment tool
Source: Spanish Data Protection Agency (AEPD)
https://media.licdn.com/dms/document/media/v2/D4D1FAQEyy9Y-cxl7nw/feedshare-document-sanitized-pdf/B4DaDNhJl6HgBA-/0/1790154415655?e=1790766000&v=beta&t=eQBWcq0lmxRYfrWUthRypzWWpC00mzseTeXV9uEn8Zg
The Spanish Data Protection Agency fines Securitas Direct EUR 100,000 for obstructing the exercise of data-subject rights
Source: EDPB
https://www.edpb.europa.eu/news/news_en

Poland:

The Ministry of Digital Affairs adds eID login functionality to the S46 cybersecurity system
Source: Ministry of Digital Affairs of Poland
https://www.gov.pl/web/cyfryzacja/nowa-funkcjonalnosc-w-systemie-s46--logowanie-przez-eid
The Personal Data Protection Office (UODO) proposes amendments to anti-doping rules in light of a CJEU judgment
Source: UODO
https://uodo.gov.pl/pl/138/4572
The Personal Data Protection Office (UODO) announces additional inspections in the healthcare sector
Source: UODO
https://uodo.gov.pl/pl/138/4570

Denmark: The Danish Agency for Digital Government (Digitaliseringsstyrelsen) completes its first inspections of prohibited AI practices
Source: Danish Agency for Digital Government
https://digst.dk/nyheder/nyhedsarkiv/2026/september/foerste-tilsyn-med-forbudt-ai-praksis-er-afsluttet/
Hungary: The data protection authority (NAIH) issues guidance on “consent for contact purposes” following a court ruling
Source: NAIH
https://naih.hu/hirek/853-koezlemeny-a-hozzajarulason-alapulo-kapcsolattartas-celhoz-koetoettsegerol-atlathatosagarol-es-a-hozzajarulas-terjedelmenek-birosagi-jogertelmezeserol
Norway:

The Norwegian National Security Authority (NSM) publishes corporate guidance on protection against denial-of-service attacks
Source: Norwegian National Security Authority (NSM)
https://nsm.no/aktuelt/tiltak-mot-tjenestenektangrep
The Norwegian Data Protection Authority (Datatilsynet) launches data-protection audits of the hotel industry
Source: Norwegian Data Protection Authority (Datatilsynet)
https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2026/tilsyn-med-hotellbransjen/

Romania:

The National Supervisory Authority for Personal Data Processing (ANSPDCP) publishes its 2025 Activity Report
Source: ANSPDCP
https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_14_09_2026&lang=ro
The data protection supervisory authority discloses that it imposed 105 fines in 2025, with data-security incidents remaining a primary enforcement focus
Source: ANSPDCP
https://ans-extmail.dataprotection.ro/?lang=ro&page=Comunicat_Presa_14_09_2026

Slovenia: The Agency for Communication Networks and Services (AKOS) clarifies obligations for providers of generative AI systems
Source: AKOS
https://www.akos-rs.si/umetna-inteligenca/raziscite/novice/novica/obveznosti-ponudnikov-sistemov-ui-ki-ustvarjajo-sinteticno-zvocno-slikovno-video-ali-besedilno-vsebino
Australia:

Australia launches a consultation on regulation of AI infrastructure, proposing mandatory national standards for large data centers and frontier-model training
Source: Australian Department of the Prime Minister and Cabinet (PM&C)
https://www.pmc.gov.au/domestic-policy/office-ai/ai-infrastructure-consultation
The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) publishes security and governance guidance for agentic AI tools
Source: ACSC
https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/agentic-ai-harnesses
The ACCC completes investigations into Mazda, Kia and BYD and secures improvements to access mechanisms for vehicle service, repair and diagnostic information
Source: ACCC
https://www.accc.gov.au/media-release/mazda-kia-and-byd-improve-access-to-service-and-repair-information-after-accc-investigations

Japan: The Personal Information Protection Commission (PPC) publishes the first set of “basic approaches” for Cabinet Orders and rules supporting the 2026 amendments to the Act on the Protection of Personal Information
Source: Personal Information Protection Commission of Japan (PPC)
https://www.ppc.go.jp/personalinfo/legal/r8kaiseihogohou/
Canada:

The Office of the Privacy Commissioner of Canada, together with relevant information regulators, issues a statement on cooperation to advance privacy and accountability
Source: Office of the Privacy Commissioner of Canada (OPC)
https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_260916/
The Federal Court rules in Diamant Toys Ltd. v. Jouets Bo-Jeux Toys Inc., holding that an injunction for copyright infringement may be granted without proof of actual damages
Source: Federal Court of Canada
https://decisions.fct-cf.gc.ca/fc-cf/decisions/en/item/39614/index.do?site_preference=normal

New Zealand: The Office of the Privacy Commissioner (OPC) confirms that the Privacy Act does not prevent information sharing to protect children
Source: Office of the Privacy Commissioner of New Zealand (OPC)
https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-act-does-not-stand-in-the-way-of-protecting-children-from-harm/
Brazil: The President signs legislation establishing the REDATA special tax regime for data centers
Source: Ministry of Development, Industry, Trade and Services of Brazil (MDIC)
https://www.gov.br/mdic/pt-br/assuntos/noticias/2026-periodo-eleitoral/setembro/presidente-sanciona-o-redata-que-estimula-datacenters-e-desenvolvimento-tecnologico-no-brasil
Philippines: The NPC issues Show Cause Orders to Meta, Roblox, Reddit and Discord, stating that the four platforms may have failed to comply with applicable registration requirements under the Data Privacy Act of 2012 and NPC Circular 16-03
Source: National Privacy Commission of the Philippines (NPC)
https://privacy.gov.ph/statement-of-the-national-privacy-commission-on-intensified-oversight-of-digital-platforms-to-protect-childrens-privacy/
Mexico:

The Ministry of Anti-Corruption and Good Governance announces an investigation into a suspected data breach at Aeroméxico
Source: Ministry of Anti-Corruption and Good Governance of Mexico
https://www.gob.mx/buengobierno/prensa/buen-gobierno-identifico-indicios-de-una-posible-exposicion-de-datos-personales
The Ministry of Anti-Corruption and Good Governance investigates the alleged sale of 12.9 million records containing personal data
Source: Ministry of Anti-Corruption and Good Governance of Mexico
https://www.gob.mx/buengobierno/prensa/buen-gobierno-investiga-presunta-venta-de-mas-de-12-9-millones-de-registros-con-datos-personales

Türkiye: KVKK publishes an implementation guide on data protection for lawyers
Source: KVKK
https://www.kvkk.gov.tr/Icerik/8990/avukatlarin-mesleki-faaliyetlerinde-kisisel-verilerin-korunmasina-iliskin-uygulama-rehberi-yayimlandi
Vietnam: The Government promulgates Decree No. 363/2026/ND-CP establishing administrative penalties for data violations

Source: Government News of Vietnam
https://baochinhphu.vn/thu-thap-du-lieu-lam-lo-thong-tin-nhay-cam-co-the-bi-phat-den-60-trieu-dong-102260923101031855.htm
Egypt: The Supreme Council for Media Regulation (SCMR) and the National Telecommunications Regulatory Authority (NTRA) issue a joint decision to protect children on social media
Source: Ministry of Communications and Information Technology of Egypt (MCIT)
https://mcit.gov.eg/Ar/Media_Center/Latest_News/News/117496
Kenya: The Office of the Data Protection Commissioner (ODPC) publishes a draft notice on additional categories of sensitive personal data
Source: ODPC
https://www.odpc.go.ke/wp-content/uploads/2026/09/Draft-Public-Notice-Additional-Categories-of-Sensitive-Personal-Data.pdf
Industry/Company: Anthropic CEO Dario Amodei calls for “slowing/controlling the pace of capability development in frontier AI models”
Source: Dario Amodei's personal website
https://darioamodei.com/post/we-must-pace-the-frontier

Note

本文由Gen AI翻译，仅供参考。

Translated by Gen AI service. For reference only.

本期编辑：吴小旭陈煜烺陈曦宇颜宇涵张膑月季开张丽