The Cyberspace Administration of China Announces Recent Enforcement Cases on Cybersecurity, Data Security, and Personal Information Protection

On September 15, the Cyberspace Administration of China announced that recently, cyberspace administrations across the country have continued to strengthen law enforcement inspections in accordance with the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, and other regulations, and have issued notices on a number of typical cases involving webpage tampering, malicious programs, data leaks, personal information leaks, forced information collection, illegal crossborder data transfers, and AI content labeling. The notice shows that companies and institutions in many places were ordered to make corrections and received penalties such as fines and warnings due to issues such as inadequate cybersecurity management, ineffective technical defenses, or illegal collection and use of personal information. Some responsible individuals were also transferred to public security authorities or dealt with more strictly. The cases cover multiple scenarios, including weak passwords in website backends, malicious code implanted in applications, test data not cleaned up in time, failure of hospital security equipment, apps forcibly requesting permissions, illegal collection of facial information, and personal information being transferred abroad beyond the permitted scope. The Cyberspace Administration of China stated that cybersecurity, data security, and personal information protection are related to national security and public interests, and relevant entities should earnestly fulfill their primary responsibilities and implement requirements such as the minimum necessary principle, encrypted transmission, identity authentication, and security assessment. Cyberspace authorities will continue to intensify law enforcement efforts and promote standardized governance in relevant fields.