Technology Governance Wiki - User contributions [en]

Module 3: Content

2024-10-31T12:51:21Z

Cmercer29: /* India */

== Misinformation and Disinformation Online ==
[https://digital-strategy.ec.europa.eu/en/policies/online-disinformation Disinformation] is false or misleading content that is spread with an intention to deceive or secure economic or political gain, and which may cause public harm. [https://digital-strategy.ec.europa.eu/en/policies/online-disinformation Misinformation] is false or misleading content shared without harmful intent though the effects can be still harmful.
=== Brazil ===
<div>
==== '''The Brazilian Context''' ====

<div>The Brazilian 2018 presidential elections brought the spotlight onto issues of disinformation into the policy debate due to the use of disinformation in Jair Bolsanaro’s campaign. A key aspect of efforts to fight disinformation and the design of policy bills centers around the use of messaging services, primarily [https://www.terra.com.br/byte/no-telegram-golpistas-falavam-de-invasao-ao-congresso-desde-comeco-de-janeiro,eb32e7542879048f48c82e0f30aa4414av9dzxap.html Telegram] and [https://journals.sagepub.com/doi/10.1177/20563051231160632 WhatsApp][https://journals.sagepub.com/doi/10.1177/20563051231160632 , to spread disinformation during] the presidential elections. Due to the fact that the rates of sending traditional (‘SMS’) messages in Brazil were unaffordable and very expensive for the majority of people in Brazil, the web-based [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3618781 WhatsApp offered] a less expensive alternative. The feature that stood out in these messaging apps in particular was the ability to make large-scale messaging chains, which became a prime social-media instrument for targeted political disinformation campaigns in Brazil. Consequently, it was noted that Bolsonaro’s supporters often preyed on Brazil’s ‘poor,’ to gain a voting base in [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj disadvantaged communities]. These WhatsApp-led disinformation campaigns, which later led to the surrounding discussion on disinformation regulation in Brazil, culminated in an [https://edition.cnn.com/2023/01/09/americas/brazil-congress-attack-explained-intl/index.html attack on the Brazilian Congress] by supporters of Bolsanaro after his loss, reminiscent of the January 6 Capitol attack in the United States.

</div>
<div>

Legislation relating to disinformation in Brazil is still in progress, with greater progress after COVID-19. [https://journal.ciu.edu.ge/storage/articles/July2022/U3gaRK9olWAJZAUdy3pC.pdf Numerous bills have been raised] with different approaches to regulating disinformation, such as user-centered, non-content-focused approaches like identification and location requirements of users for platform access, and measures targeting businesses including transparency reports and complaint processes obligations.

</div>
<div>

Due to the overarching societal and political backlash, Brazilian legislators have proposed a very large sum of bills that can be, one way or another, connected to challenges and the problems of the spread of disinformation. In particular, sixty-two disinformation bills were proposed between 2019 and 2022. Academics have tried to analyze the bills to understand the commonalities and differences – for example, one [https://misinforeview.hks.harvard.edu/article/framing-disinformation-through-legislation-evidence-from-policy-proposals-in-brazil/ analysis of these bills] showcased that many do not specify exactly which problem related to disinformation they aim to address, though a common focus is on election-related disinformation. This is particularly challenging due to the [https://misinforeview.hks.harvard.edu/article/framing-disinformation-through-legislation-evidence-from-policy-proposals-in-brazil/ use of one word, desinformação], to describe both intentional and unintentional spread of false information, with a lack of clear definitions in bills.

</div>
<div>

Two main approaches are identified in the bills, the first being a focus on individual criminalization, and the second focusing on platform regulation. [https://journal.ciu.edu.ge/storage/articles/July2022/U3gaRK9olWAJZAUdy3pC.pdf The former was more popular pre-2020], whereas the latter has appeared in more bills after 2020.</div>
<div>While the landscape of Brazilian law on this topic is quite complex, inevitable uncertainty is present when it comes to which bills will be passed and what will be the legal framework chosen to protect the Brazilian people in the coming years. Nonetheless, what seems to be a commonality in the majority of the available academic writing on disinformation is the importance and prominence of the [https://www.tandfonline.com/doi/full/10.1080/13183222.2023.2201801 “Fake News Bill” PL 2630]. The following sections will focus on what are the present legally binding instruments governing the field, the unique role of the judicial branch in this context, and what the most talked about bill, Fake News Bill, has to offer as a mitigation strategy.</div>
<div><br></div>
<div></div>

==== Pre-2020 approaches: Law 13.834/2019 ====

<div>The only law currently in place aiming to regulate disinformation is Law 13.834/2019, more specifically, Article 20. It criminalizes attributing an innocent person to a crime, particularly in the context of elections, to provoke criminal investigations. This Article [https://journal.ciu.edu.ge/storage/articles/July2022/U3gaRK9olWAJZAUdy3pC.pdf reflects the pre-2020 state of disinformation regulation] in Brazil, wherein regulatory approaches focused on the content of individual expressions and aimed to discourage individuals from spreading disinformation. This was done primarily through enhancing pre-existing punishments, such as for libel and defamation, and empowering both platforms and authorities to remove offending content. However, such approaches were critiqued for being heavy-handed in their impacts on freedom of expression.</div>
<div></div>

==== Post-2020 approaches ====

<div>The widespread disinformation claiming that the election that Bolsanaro lost and brought Lula into power was fraudulent brought disinformation regulation even more into policymakers' focus. However, criticisms regarding impacts on freedom of expression and the powers of the government still remained even with the new approaches taken in bills after 2020, which [https://journal.ciu.edu.ge/storage/articles/July2022/U3gaRK9olWAJZAUdy3pC.pdf focuses more on platform regulation] (obligations of content removal, advertisement, and complaint process transparency). Additionally, another development includes the growing role of the Supreme Court in tackling disinformation.</div>
<div></div>

==== The role of the judiciary and Supreme Court ====

<div>The Brazilian judiciary generally plays a large role in combating disinformation due to the [https://www.opendemocracy.net/en/democraciaabierta/brazil-crack-down-fake-news-disinformation-lula-restore-trust-internet/ ‘sluggishness’ of legislators] to pass effective legislation. The Electoral Justice has launched a [https://www.wilsoncenter.org/blog-post/combating-disinformation-brazilian-judiciary-initiatives-2024-municipal-elections Permanent Program to Combat Disinformation] particularly in an electoral context. This program involves an ‘Electoral Disinformation Alert System’ to help detect and respond to false content relating to the electoral process through collaboration with various platforms, companies, and fact-checking agencies. The judiciary collaborates with other public authorities and private institutions in the [https://www.wilsoncenter.org/blog-post/combating-disinformation-brazilian-judiciary-initiatives-2024-municipal-elections ‘Integrated Center for Confronting Disinformation and Defending Democracy’] which focuses on analysing, monitoring, and responding to disinformation. The Centre revolves around tackling disinformation that seeks to delegitimize public institutions and the electoral system through collaboration with platforms and fact-checking agencies. Lastly, the ‘Disinformation Combat Program’ is led by the Supreme Federal Court to address disinformation that impacts public perceptions of and trust in the Court.<p>Additionally, the Supreme Court, more specifically, Justice Alexandre de Moraes, [https://www.opendemocracy.net/en/democraciaabierta/brazil-crack-down-fake-news-disinformation-lula-restore-trust-internet/ has taken a strong stance against fake news.] This is possible due to the strong powers attributed to the Supreme Court in Brazil, which acts as a constitutional court, final court of appeals, and a trial court for elected officials. Justice Moraes was responsible for the blocking of [https://www.france24.com/en/americas/20240831-brazil-block-on-social-media-platform-x-comes-into-effect-after-supreme-court-order X, formerly Twitter, in Brazil] due to [https://apnews.com/article/brazil-musk-x-twitter-moraes-bef06c0dbbb8ed87495b1afbb0edf211 Elon Musk’s unwillingness to comply] with Moraes’ order to block certain individuals associated with the 2023 attack on the Brazilian Congress. X was suspended in Brazil, but access was [https://www.cbsnews.com/news/brazil-supreme-court-lifts-ban-social-media-site-x-elon-musk/ reinstated after Musk] complied with the orders and settled the imposed fines worth $5.2 million. It was noted that such a judiciary order was something that was [https://noticias-stf-wp-prd.s3.sa-east-1.amazonaws.com/wp-content/uploads/wpallimport/uploads/2024/08/30203157/suspensao-item-2.pdf never done before], and critics question whether such actions go against due process. The president of the Brazilian Bar Association (OAB), [https://midiasimcloud.com.br/vegaseferreiraadv/oab-vai-ao-stf-por-revisao-ou-esclarecimento-de-multa-fora-do-devido-processo-para-quem-usar-vpn/ Beto Simonetti], voiced his concern and requested further review of the Supreme Court, specifically around the section of the decision to impose fines for VPN users attempting to access blocked platforms.</div>
<div><br></div>
<div></div>

==== The Fake News Bill PL 2630 ====
Whilst the Fake News Bill takes on a platform regulation perspective, it still focuses primarily on the election context and also seeks to regulate messenger services considering their significant role in spreading disinformation during the 2018 elections. The [https://www.tandfonline.com/doi/full/10.1080/13183222.2023.2201801 original draft of the bill] had concerning rights implications relating to identification requirements, expansion of data retention requirements, and the monitoring of private communications, but many of these were phased out with multi-stakeholder consultations. However, it showcases how polarising disinformation regulation is in Brazil, due to its perceived urgent need with the rise of far-right disinformation campaigns and its high likelihood to impact human rights, particularly freedom of expression. The progress of the Bill can be followed [https://www25.senado.leg.br/web/atividade/materias/-/materia/141944 here].

<div>The March 2022 draft of the [https://www.tandfonline.com/doi/full/10.1080/13183222.2023.2201801 Bill features a variety of obligations as follows]. Unfortunately, following the progress and various drafts of the bills is complicated and inaccessible. However, the March 2022 draft was lauded by civil society organizations in Brazil and seems to represent the new approach of the legislators to be followed.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>'''Chapter 1''' outlines the goals of the bill and definitions. </div>
<div>

*Bill aims to bolster the transparency of social networks, search engines, and instant messaging service providers.
</div>
<div>

*It applies to providers offering the aforementioned services in Brazil with over 10 million registered users.
</div>
|-
| style="width: 100%;" | <div>'''Chapter 2''' outlines the accountability obligations of those providers.</div>
<div>

*''Article 6'' requires all automated accounts to be identified as such to either the users or providers and for sponsored and automated content to be clearly defined to users.
</div>
<div>

*''Articles 9 and 10'' oblige providers to conduct half-yearly transparency reports focusing on the measures implemented to comply with the Bill’s applications, how many decisions taken pertaining to users were reverted after appeals, the systems used in content moderation, aggregated information on content which is ‘irregularly’ reaching greater audiences as identified by the provider, and the characteristics of the human content moderation team.
</div>
<div>

*''Article 13'' empowers legal authorities to request messaging services to register and disclose user interactions for up to 60 days during an investigation.
</div>
<div>

*''Article 15'' obliges platforms to implement procedural rights for users when their content is moderated.
</div>
|-
| style="width: 100%;" | <div>'''Chapter 3 '''introduces transparency criteria for boosted content and advertising with a specific focus on political advertising during electoral campaigns.</div>
<div>

*''Article 19'' requires providers to make public the amount spent by candidates and parties on online political advertising on their platforms, and other characteristics including the period of advertising circulation and general profiling categories of the targeted audience.
</div>
|-
| style="width: 100%;" | <div>'''Chapter 4''' includes a specific regime to apply to platform accounts of public administration and office holders.</div>
<div>

*Article 22 stipulates that politicians cannot block either journalists or non-governmental organisations.
</div>
<div>

*However, ‘parliamentary immunity’ is also extended to the content of the accounts, potentially protecting politicians from moderation decisions even if they participate in spreading false information.
</div>
|-
| style="width: 100%;" | '''Chapter 5''' addresses the promotion of media literacy.
|-
| style="width: 100%;" | '''Chapter 6 '''addresses sanctions to platforms based on turnover.
|-
| style="width: 100%;" | '''Chapter 7''' addresses the new functions of the Brazilian Internet Steering Committee (CGI.br) creating a co-regulatory mechanism.
|-
| style="width: 100%;" | '''Chapter 8''' obliges service providers to create their own self-regulating institutions.
|-
| style="width: 100%;" |
'''Chapter 9''' includes criminal sanctions for the dissemination of fake news.
*''Article 36'' states that criminal sanctions could be applied for the spreading of fake news if it either compromises the integrity of the electoral system or cause physical harm.
|}
</div>
<div></div>
<div><br></div>
<div>

===== How does the Fake News Bill fit into other digital law in Brazil? =====
</div>
<div>

====== Setting the scene with MCI and LGPD ======
</div>
<div>After Brazil hosted the 2014 World Cup, there was great anticipation for the upcoming 2016 Olympic Games in Rio. The opportunity to have such large events in Brazil stimulated [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj a considerable amount of technological development] to take place in the country’s urban areas. As a consequence, social and digital inequalities between different regions of the country seem to have further advanced when it comes to Brazil’s marginalized populations. To aid these issues, Brazilian legislators decided to [https://www.cgi.br/pagina/marco-civil-law-of-the-internet-in-brazil/180#:~:text=1o%20This%20Law%20establishes,the%20municipalities%20in%20this%20regard. codify] “democratic principles of internet openness by advancing a civil right to internet access, protecting net neutrality, providing preliminary guidelines for data privacy, and protecting internet intermediaries.” This was done under the bill named the “Civil Rights Framework for the Internet,” or MCI in short, which was passed in 2014. At the time, the bill was [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj praised by scholars] as a tool with “democratizing potential”.</div>
<div>Soon after, the next step in the legislative agenda was an act focusing on data protection and privacy: the LGPD. While the MCI outlined the important democratic principles of Internet governance, the [https://iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/ LGPD] aimed at specific regulations concerning data privacy. LGPD set out various protections for individuals, and most notably, took heavy inspiration from the EU’s [https://eur-lex.europa.eu/eli/reg/2016/679/oj General Data Protection Regulation ](GDPR).</div>
<div><br></div>
<div>

===== Critique of the ‘Fake News’ Bill =====
</div>
<div>While the ‘Fake News’ Bill provides a practical example of the challenges of combating disinformation, the spread of propaganda, and defamation in the digital and online environment, critics point out that it might also [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj pose threats] to the data protection principles of the LGPD, and to the “universal internet access and freedom of association provisions” of the MCI. For example, the initial draft of the Fake News Bill took a heavy-handed approach that clashed with both the LGPD and MCI. Even though Article 2 of the initial draft Fake News Bill explicitly mentions its compliance with the LGPD and MCI, Bill’s vagueness and ambiguity was still criticised as potentially posing a threat to freedom of expression and privacy safeguards. For example, the Bill obliges social media providers to monitor user identities by implementing mechanisms to mandate linking phone numbers of users to their accounts, allowing for potentially unauthorized surveillance. Another provision suggested that social media platforms should “track and store the chain of forwarded communications of Brazilian internet users,” connected to the risks of Whatsapp large-scale [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj messaging chains.]</div>
<div>Whilst the May 2022 draft of the Bill makes great strides in response to civil society consultation, this shows an underlying tension within the Brazilian legislature about how strict the approach towards disinformation should be. The harshness of the initially proposed measures is understandable in the Brazilian local context, where disinformation was overwhelmingly used by the far-right and supporters of Jair Bolsanaro to destabilize electoral processes.</div>
<div><br></div>
<div>

===== Current progress of the bill =====
</div>
<div>Since the first draft was put out for discussion, the text of the Bill has seemingly changed many times, sometimes drastically Scholarly articles were written on a variety of drafts throughout this legislative process, and therefore it was challenging to distinguish and identify which draft is being discussed as well as which draft is currently standing and waiting to be approved. The above sections consequently aim to explain the overarching image and vision of the Fake News Bill, and its changing approaches. Therefore, a final conclusion is yet to be made, dependent on if the Bill is passed, and what final form it takes.</div>

=== China ===
<p>In today's [https://dictionary.cambridge.org/dictionary/english/post-truth 'post-truth'] era, the phenomenon of [https://www.taylorfrancis.com/books/mono/10.4324/9780367815677/fake-news-context-lesley-farmer misinformation] and [https://www.eeas.europa.eu/sites/default/files/action_plan_against_disinformation.pdf disinformation] is not only pervasive but also deeply complex, exploiting emotions and biases to polarize audiences and provoke strong reactions. Beyond merely influencing public opinion, however, disinformation often intersects with criminal behaviors, including hate speech, harassment, and invasions of privacy. Technological advances like deep fakes have amplified these issues, enabling highly convincing yet misleading content that can be used for personal attacks or political manipulation. The semantic and regulatory challenges of combating cybercrimes associated with the dissemination of fake news are profound, especially when navigating varied legal definitions and the lack of consensus across different legal systems. For democratic states, regulatory debates around disinformation often focus on preserving freedom of expression while minimizing harm. However, in a tightly controlled, authoritarian context like China, disinformation takes on an additional layer of complexity. Here, the government itself defines and regulates what constitutes 'disinformation' often to reinforce state ideologies and stifle dissent rather than purely for public interest. In this context, the line between combating disinformation and controlling narratives blurs, raising fundamental questions about information integrity, government accountability, and the very definition of 'truth'. </p>

==== The Early Days (1997-2000) ====
<p>In China, fake news are referred to as ''''online rumors'''' and the government has been dealing with them since the early development of the Internet. In April 1994, China officially accessed the [https://download.e-bookshelf.de/download/0017/6346/90/L-G-0017634690-0076175462.pdf Internet] and by 1997 it was already considering introducing laws to address the anticipated influx of allegedly false information associated with international connectivity. For this reason, the Ministry of Public Security enacted Decrees No. 195 and No. 33 to regulate network content. While Decree No. 195 prohibited the creation, access, copying, and dissemination of content that disrupts public order or contains obscene or pornographic material, Decree No. 33 specified nine categories of prohibited content, '''including fabricated or distorted facts, rumor-spreading that disturbs social order''', advocacy of feudal superstitions, obscenity, pornography, gambling, violence, murder, terror, and incitement to criminal activities. It also banned content that publicly insulted or slandered others by fabricating facts.</p>
<p>With the further rise of communication platforms like portals, chat rooms, blogs, the channels for internet users (''''netizens'''') expanded significantly, thus amplifying the social influence of online media and highlighting the value of public opinion on the Internet. However, according to the Chinese Government, along with the heightened influence, a large volume of false, illegal and harmful content has also appeared online.</p>
<p>Therefore, in December 2000, the Ministry of Culture, State Administration of Radio, Film, and Television, All-China Students' Federation, State Informatization Promotion Office, China Telecom, and China Mobile jointly initiated the 'Network Civilization Project'. Under [https://download.e-bookshelf.de/download/0017/6346/90/L-G-0017634690-0076175462.pdf Decree No. 292], the nine types of prohibited content, known as the 'Nine Prohibitions' already outlined in Decree No. 33, were confirmed and further specified and were 'information that endangers social stability and order, including rumor-spreading, social disorder, and activities that undermine social stability; along with content promoting obscenity, pornography, gambling, violence, murder, terror, or incitement to crime'<span style="font-size: 14.4px;"> outlawed.</span></p>

==== PRC Criminal Law ====
<p>In the era of Internet 2.0, individuals have transformed from passive recipients of information into active participants across various network activities, emphasizing the social dynamics of the internet. This shift has facilitated a surge in traditional crimes now committed online, with criminal activities on the internet continually increasing. To address this, the Standing Committee of the National People’s Congress (NPC) introduced the ''[https://download.e-bookshelf.de/download/0017/6346/90/L-G-0017634690-0076175462.pdf Decision on Guarding Internet Security]'' in 2000, extending the ''Criminal Law'' to cover actions such as spreading obscene information, rumor-mongering, slander, fraud, theft, and the unauthorized dissemination of state secrets online. </p>
<p>China’s approach to criminalizing fake news took a significant step on August 29, 2015, when the Standing Committee of the NPC adopted the Ninth Amendment to the ''Criminal Law of the People’s Republic of China'' (PRC). This amendment, which included measures aimed at curbing false information, added Article 291a to the Criminal Law, criminalizing the spread of news that 'seriously disturbs public order' via information networks or other media channels. Offenders under this provision face a range of penalties, including criminal detention, public surveillance, or imprisonment for up to three years. For cases where misinformation is found to have severe consequences, penalties escalate to fixed-term imprisonment ranging from three to seven years. [http://www.npc.gov.cn/zgrdw/englishnpc/Law/2007-12/13/content_1384075.htm Paragraph 2 of Article 291a] explicitly targets the dissemination of false information related to critical situations—such as 'dangerous situations, epidemics, disasters, or alerts'—particularly if this dissemination leads to public disorder. This regulation covers both the creation and intentional sharing of known false information, thereby broadening liability to those who knowingly contribute to the spread of misinformation. The legislation reflects the government’s intention to preemptively address disinformation that could incite panic or social instability, framing the spread of false information as a direct threat to public order. This aligns with the state’s broader strategy of [https://maint.loc.gov/law/help/fake-news/china.php social control], where the management of information is paramount, especially regarding matters that could undermine public trust or prompt criticism of government actions.</p>

==== The First Cybersecurity Law ====
<p>On November 7, 2016, the NPC Standing Committee adopted the [http://www.npc.gov.cn/npc/index.html <em>Cybersecurity Law of the PRC</em>], which took effect on June 1, 2017. This law represents China’s first comprehensive legislation focused on cybersecurity and includes provisions that address the dissemination of fake news as part of a broader strategy to maintain social and economic order. Under Article 12, Paragraph 2, it is prohibited to manufacture or spread online fake news that could disturb social stability, harm the economy, or undermine public trust in institutions. </p>
<p>Article 70 further outlines penalties for violations, stipulating that publication or transmission of prohibited information is subject to fines, shutdowns, and other penalties as defined by the relevant regulations. Article 74 states that violation of the Cybersecurity Law may even result in criminal sanctions, as provided by the Ninth Amendment to the PRC Criminal Law mentioned above. </p>
<p>Importantly, the Cybersecurity Law empowers authorities to address disinformation not only by penalizing those directly responsible for creating or disseminating fake news but also by holding digital platforms accountable. Pursuant to [https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ Article 47], if a network operator identifies any content that is forbidden by law or regulation, it must promptly suspend its transmission, remove the content, take steps to prevent its further spread, maintain relevant records, and notify the appropriate government authority.</p>

==== Administrative Measures on Internet Information Services ====
===== Licensing Requirements =====
<p>To operate legally in China, social media platforms must hold a valid business license. The ''Administrative Measures on Internet Information Services'', a regulation issued by the State Council on September 25, 2000, applies to any service delivering online information. This regulation requires that commercial internet service providers obtain an operating license from the government, while nonprofit providers must complete a registration process with authorities. The regulation outlines various duties for internet information service providers to ensure cooperation with government authorities. For instance, providers are required to keep records of all published content, along with the exact time of publication, and maintain user information such as account details, IP addresses or domain names, and session durations. These records must be stored for at least sixty days and made available to government authorities upon request.</p>

===== Real-Name Registration =====
<p>Under Chinese law, social media users must provide real-name registration and other identity details to service providers. According to the ''Cybersecurity Law'', providers of information-sharing or messaging services must verify users' identities before granting access to these services. Service providers are prohibited from offering their services to users who have not completed this identity verification.</p>
<p>If service providers fail to enforce real-name registration, authorities may require corrective actions, suspend business operations, shut down websites, revoke licenses, or impose fines ranging from 50,000 to 500,000 yuan on the service providers and between 10,000 and 100,000 yuan on those responsible.</p>

==== Provisions on Internet News Information Services ====
<p>On May 2, 2017, China’s main internet regulatory body, the Cyberspace Administration of China (CAC), introduced the ''Provisions on Administration of Internet News Information Services''.</p>

===== License Requirements =====
<p>According to these provisions, any entity that offers internet news information services to the public—whether via websites, apps, online forums, blogs, microblogs, social media accounts, instant messaging tools, or live broadcasts—must secure an internet news information service license and operate within the license’s authorized scope. Only legal entities established within China's territory are eligible for these licenses, and both the responsible individuals and editors-in-chief must be Chinese citizens. Unauthorized provision of internet news services is subject to fines between 10,000 and 30,000 yuan.</p>

===== Limitations on Reprinting News =====
<p>Providers are restricted to reprinting news that originates from state-approved sources, including central or provincial news organizations, or other specified agencies. Reposted news must include the original source, author, title, and editor to maintain traceability of the information. Violations of these reprint regulations can result in warnings, orders to correct the issue, temporary suspensions, or fines from 5,000 to 30,000 yuan, with potential criminal charges.</p>

===== Prohibited Content =====
<p>The provisions forbid internet news service providers and users from creating, reproducing, publishing, or disseminating content that is barred under relevant laws and regulations. Authorities may issue warnings, enforce corrective measures, suspend services, or levy fines between 20,000 and 30,000 yuan for non-compliance, and violators may also face criminal prosecution.</p>

===== Duties of Service Providers =====
<p>If internet news service providers detect content that violates these provisions or other legal regulations, they are required to immediately halt the transmission, delete the content, maintain relevant records, and report to the appropriate government authorities. Additionally, the provisions reiterate the Cybersecurity Law’s requirement for real-name registration, mandating that service providers verify users' real identities when they access internet news publishing platforms. Non-compliance with these requirements can lead to penalties from state or local internet authorities under the ''Cybersecurity Law''.</p>

==== Provisions on the Administration of Deep Synthesis of Internet-based Information Services (the 'Deep Synthesis Provisions') ====
<p>China’s new Deep Synthesis Provisions, effective January 10, 2023, regulate 'deepfake' technologies—software that creates synthetic media such as text, images, audio, and video using generative models. Jointly issued by the Cyberspace Administration of China (CAC), Ministry of Industry and Information Technology, and Ministry of Public Security, the regulations outline responsibilities for deep synthesis providers and users across data security, transparency, content labeling, and technical security. According to this law, providers must establish criteria for identifying and managing false or harmful content, including user identity verification and algorithm review mechanisms. They must also label synthetic media, such as simulated voices or manipulated images, and report false information to [https://www.ox.ac.uk/event/chinas-deepfake-regulations-navigating-security-misinformation-and-innovation authorities].</p>

==== The Introduction of 'Piyao' in 2018 ====
<p>In 2018, the Chinese government launched 'Piyao', a platform dedicated to countering rumors and disinformation online. The term 'Piyao' itself means 'refute rumors' in Chinese. The platform is managed by the Cyberspace Administration of China (CAC) and serves as an official channel to debunk false information and provide what is claimed to be verified, factual content, particularly on topics deemed sensitive by the Chinese government. The platform distributes [https://tile.loc.gov/storage-services/service/ll/llglrd/2019713404/2019713404.pdf 'authentic'] news drawn from state-run media outlets, party-affiliated local newspapers, and multiple government agencies.</p>

==== Platforms' Self-Regulation ====
<p>In China, major platforms like Weibo and WeChat follow a model of corporate self-regulation that includes internal policies to counter false information, often in cooperation with the Cyberspace Administration of China (CAC). The CAC actively encourages the development of self-regulatory frameworks and industry standards to streamline information control across digital media. This partnership reflects a coordinated approach to information governance, where platforms align their policies with government priorities on sensitive topics. However, this cooperation has a more coercive dimension. On sensitive issues, the Chinese government has a history of employing intimidation tactics, both online and in the real world, to silence dissent and encourage self-censorship. Platforms perceived to deviate from state narratives, particularly on subjects like Xinjiang, Taiwan, or Hong Kong, can face punitive measures, and companies are pressured to comply or face potential repercussions. This extends beyond China's borders: Beijing has leveraged open societies within democratic countries to pursue legal action against critical voices, and it has extended technical censorship to [https://www.state.gov/gec-special-report-how-the-peoples-republic-of-china-seeks-to-reshape-the-global-information-environment/ overseas Chinese-speaking communities], notably on WeChat.</p>

==== The Other Side of the Coin: Censorship in China ====
<p>China’s media landscape is increasingly complex due to growing government intervention in digital spaces. Most Chinese users primarily engage on domestic platforms like WeChat, Weibo, and Toutiao for social interactions and news consumption. Research has shown that censorship and 'astroturfing'—organized efforts by the government or corporations to post comments that appear to be from ordinary users—are widespread on these platforms. The presence and perception of these activities can shape how people interpret content and express themselves online, influencing their views and stifling open dialogue on dominant topics. Censorship practices further restrict information flow, as social media sites are required to follow government directives and often use human moderators to monitor online content. The criteria for what constitutes 'sensitive' content are vague and constantly shifting, prompting platforms to enforce their own, often stricter, content removal policies to ensure compliance. Once content is flagged as sensitive, it is typically removed, with attempts to access it blocked. In some cases, the platform might display a notice explaining the reason for removal, though this depends on the platform's specific policies. This tight control of information creates an environment where counter-narratives are largely absent, allowing misinformation to circulate on key issues and [https://doi.org/10.1145/3313831.3376612 shaping public opinion] accordingly.</p>
<p>Finally, according to a report by the [https://tile.loc.gov/storage-services/service/ll/llglrd/2019713404/2019713404.pdf Global Engagement Center of the United States], the Chinese Government spends billions of dollars every year in order to promote abroad narratives favorable to the Chinese Communist Party (CCP) while stifling critical perspectives on controversial issues such as Taiwan, its human rights practices, and its domestic economy. Through a multifaceted strategy, Beijing aims to establish a global information environment that promotes its viewpoints and discourages criticism. This approach combines propaganda, censorship, digital authoritarianism, strategic partnerships, and influence over Chinese-language media to shape both domestic and international narratives in its favor.</p>

=== India ===
==== Constitution ====
<p>India’s constitution guarantees citizens the right to freedom of speech and expression in Article 19(1)(a). However, the Indian Constitution also says clearly that this right is not absolute; it can be limited by the State in some instances. Article 19(2) says that “reasonable restrictions” can legally be imposed on the freedom of speech and expression in the interests of “the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence.” ([https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf source]) Thus, there are a number of avenues for the State to place at least some restrictions on freedom of speech in India.</p>
<p>India is also a ratifying party to the International Covenant on Civil and Political Rights. Article 19 of the Covenant addresses freedom of expression and when it can be regulated. [source: https://www.ohchr.org/en/instruments-mechanisms/instruments/international-covenant-civil-and-political-rights] However, the Convention does not figure prominently in Indian legislation, which focuses on freedom of expression as regulated under India's Constitution.</p>

==== Criminal law ====
<p>In the area of online speech, one of the most important laws that has historically been used to regulate speech is the Indian Penal Code, which applies to all of India. The Indian Penal Code, which was first enacted in 1860, was recently replaced in 2023 by a new criminal law code, the Bharatiya Nyaya Sanhita (BNS) 2023. BNS Section 197(d) criminalizes certain politically oriented disinformation under the Constitutional exceptions to freedom of speech. Specifically, Section 197(d) imposes criminal penalties on anyone who, by spoken or written words, by signs or by visible representations, or through electronic communication or otherwise, “makes or publishes false or misleading information, jeopardising the sovereignty, unity and integrity or security of India.” The offense is punishable by imprisonment up to 3 years or by fine, or both. ([https://www.indiacode.nic.in/bitstream/123456789/20062/1/a2023-45.pdf#search=bharatiya source]) The BNS (and the previous Indian Penal Code) also criminalize certain types of hate speech.</p>

==== Technology legislation ====
<p>In the technology law field, another important law in India regulating online speech is the Information Technology Act of 2000 (the “IT Act”), another federal law that applies to all of India. The IT Act includes a list of offences punishable by fines, including offences which specifically deal with issues of speech that may be disfavored (speech that is deemed terrorism or obscene) or which is criminal; as well as false or unauthorized speech, such as fraud, breaches of privacy and unlawful disclosure of information. ([https://www.indiacode.nic.in/handle/123456789/1999?view_type=browse source])</p>

===== Safe harbour framework =====
<p>India’s safe harbor provision took its current form in 2011, in Section 79 of the IT Act, around the same time that India promulgated the Information Technology (Intermediary Guidelines) Rules 2011. To take advantage of the safe harbor, intermediaries must only provide the means of communication and not have a say in the content or who the user are. In addition, intermediaries are required to perform certain due diligence and to follow guidelines promulgated by the central government. If intermediaries aid and abet illegal actions or fail to expeditiously remove or disable access to content that is being used to commit an unlawful act, the safe harbor does not apply. (source: https://www.indiacode.nic.in/handle/123456789/1362/simple-search?query=Information%20Technology%20(Intermediaries%20Guidelines)%20Rules,%202011.&searchradio=rules)</p>
<p>The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (the “IT Rules 2021”), which largely replaced the Information Technology (Intermediary Guidelines) Rules of 2011, govern online intermediaries in detail. The IT Rules 2021 were updated in 2023, including as to due diligence obligations for intermediaries. ([https://www.meity.gov.in/writereaddata/files/Information source])</p>

===== Disinformation =====
<p>In regard to disinformation, the IT Rules 2021 impose certain due diligence obligations on all intermediaries in Section 3(1)(b). Section 3(1)(b)(v) requires intermediaries to “make reasonable efforts by itself, and to cause the users of its computer resource to not host, display, upload, modify, publish, transmit, store, update or share any information that … deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates any misinformation or information which is patently false and untrue or misleading in nature or, in respect of any business of the Central Government, is identified as fake or false or misleading by such fact check unit of the Central Government as the Ministry may, by notification published in the Official Gazette, specify; impersonates another person…” Section 3(1)(d) imposes a requirement to take down content that is illegal when notified by an Agency.</p>
<p>When content is taken down, Section 3(1)(g) requires intermediaries to store the content for investigation purposes for at least 180 days or longer if ordered by a court. Section 3(1)(j) requires intermediaries to respond within 72 hours to written requests for information from government agencies which are authorized for investigative, protective or cybersecurity activities, for the purposes of verification of identity, or for the prevention, detection, investigation, or prosecution, of offences under any law for the time being in force, or for cyber security incidents.</p>
<p>Section 3(2) of the IT Rules 2021 requires intermediaries to implement a mechanism for users and victims to file complaints, which the Rules refer to as a “grievance redressal mechanism”. Complaints must be acknowledged within 24 hours and acted upon within 15 days. Section 3A also establishes a grievance appeal mechanism.</p>
<p>India also places additional rules on significant social media intermediaries (“SSMIs”), which are defined as intermediaries that have more than 50 lakh (5 million) registered users in India). ([https://www.meity.gov.in/writereaddata/files/Gazette source]) Section 4 of the IT Rules 2021 requires SSMIs (as well as online gaming intermediaries) to comply with additional due diligence obligations, including:</p>
*appoint a Chief Compliance Officer who shall be responsible for ensuring compliance with the Act and who can be liable for failure to comply in some situations;
*appoint a nodal contact person for 24x7 coordination with law enforcement agencies and officers to ensure compliance to their orders or requisitions;
*appoint a Resident Grievance Officer who is responsible for the grievance redressal mechanism;
*publish monthly compliance reports of complaints received and actions taken, the number of links or parts of information removed or disabled in pursuance of any proactive monitoring via automated tools or other relevant information as may be specified.
*SSMIs also must enable the identification of the first originator of the information on its computer resource as may be required by judicial order in some cases (under certain constitutional exceptions to free speech, in cases of rape, sexually explicit material or child sex abuse material), subject to certain limitations on when such a judicial order can be issued and the scope of the order and what must be revealed.
<p>When a SSMI disables or takes down material, including disinformation, it must ensure that prior to that time, it has provided the user whose information is coming down or being disabled with a notice explaining the reasons for the action, ensure a reasonable opportunity to dispute the action, and ensure the Resident Grievance Office has oversight. SSMIs also must respond to requests for other information from the government that the government may consider necessary for Section 4. Note that under Section 6 of the IT Rules 2021, social media intermediaries that do not meet the 5 million user threshold can still become subject to these higher obligations for SSMIs if they permit the publication or transmission of information in a manner that may create a material risk of harm to the sovereignty and integrity of India, security of the State, friendly relations with foreign States or public order.</p>

===== News and publishers =====
<p>Section 5 requires social media intermediaries to conduct additional due diligence for news and current affairs content. These intermediaries must put publishers of news and current affairs content under additional terms of service that requires the publishers to furnish the publisher’s user account information to the Ministry of Information and Broadcasting. Publishers can then receive a mark of verification.</p>
<p>Failure to comply with the IT Rules 2021 can result in loss of the safe harbor for the intermediary.</p>
<p>The IT Rules 2021 also contain a Code of Ethics and Procedure and Safeguards in Relation to Digital Media in Part III, which regulates publishers of news and current affairs content and online curated content that operate in India. The Code of Ethics imposes rules to prevent many types of problematic content, including hate speech, illegal content, content that may be harmful to children, etc. Through application of the existing journalistic and broadcasting codes, the Code also promotes the practice of providing accurate and reliable content and discourages sensationalism and fake news. ([https://mib.gov.in/sites/default/files/FAQs%20on%20Digital%20Media%20Ethics%20Code.pdf Source])</p>

=== United States ===
==== Definitions ====
<p>According to the European Commission’s High Level Group (HLEG), [https://digital-strategy.ec.europa.eu/en/library/final-report-high-level-expert-group-fake-news-and-online-disinformation disinformation] is defined as ‘false, inaccurate, or misleading information, designed, presented and promoted to intentionally cause public harm or for profit’. [https://digital-strategy.ec.europa.eu/en/policies/online-disinformation Misinformation] is defined as ‘misleading or inaccurate information shared by the people who don’t recognize it as such’.</p><p>In the U.S, clear definitions for "misinformation" and "disinformation" are not fully codified across all statutes. However, governmental agencies like the Cybersecurity and Infrastructure Security Agency (CISA) provide generally accepted definitions. [https://www.cisa.gov/topics/election-security/foreign-influence-operations-and-disinformation#:~:text=Disinformation%20is%20deliberately%20created%20to,mislead%2C%20harm%2C%20or%20manipulate Misinformation] is typically understood as false or inaccurate information shared without the intent to deceive. It occurs when incorrect information is spread inadvertently, often due to misunderstandings or mistakes, rather than a purposeful intent to mislead. [https://www.cisa.gov/topics/election-security/foreign-influence-operations-and-disinformation#:~:text=Disinformation%20is%20deliberately%20created%20to,mislead%2C%20harm%2C%20or%20manipulate Disinformation], by contrast, is false information deliberately crafted and disseminated with the intent to mislead, manipulate, or cause harm. Disinformation is frequently used in contexts involving political, social, or economic influence campaigns, such as [https://www.tandfonline.com/doi/full/10.1080/17577632.2024.2362483 election interference or propaganda efforts].</p>
==== Freedom of Speech and Legal Protection ====
<p>In [https://www.thefire.org/research-learn/john-stuart-mills-enduring-arguments-free-speech On Liberty], John Stuart Mill makes the case in favour of freedom of speech arguing that truth and ideas can only be achieved if both true and false statements and opinions are allowed to remain uncensored. Indeed, in the United States, false statements are often granted legal protection so as to protect other values and avoid a chilling effect on public discourse. As will be discussed below, the guarantee of free speech in the First Amendment also implements the values that underpin it, which include facilitating representative democracy and self-government, advancing knowledge and truth in the marketplace of ideas, promoting individual autonomy, self-expression and self-fulfilment.</p><p>Under the First Amendment to the U.S. Constitution:</p>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.''
|}
<p>As a general rule, the government may not regulate speech “because of its message, its ideas, its subject matter, or its content.” [Police Dep’t of Chicago v. Mosle, 408 U.S. 92, 95 (1972)].</p>

<p>The Congressional Research Service (CRS) published an In Focus [https://crsreports.congress.gov/product/pdf/IF/IF12180 report] in 2022 that says: </p>
*The Supreme Court has said the Free Speech Clause protects false speech when viewed as a broad category, but the government may restrict limited subcategories of false speech without violating the First Amendment.
*Defamation, fraud, political advertising, and broadcast speech are subject to special consideration. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | '''Case note: New York Times Co. v. Sullivan, 376 U.S. 254 (1964)'''
|-
| style="width: 100%;" | <p>New York Times Co. v. Sullivan was a landmark U.S Supreme Court ruling on freedom of speech protections under the First Amendment to the U.S Constitution to restrict the ability of public officials to sue for defamation. The Court held that, in order to prove libel, a public official must show that what was said against them was made with actual malice – "that is, with knowledge that it was false or with reckless disregard for the truth."</p><p>This imposes a high threshold as it only applies to defamatory speech against public officials and only if actual malice is shown.</p>

The reasons are twofold. Protection of false speech is based on the concern of a chilling effect, where regulation of false speech would also chill true speech through fear of breaking the law. The Supreme Court has recognized that false statements may not add much value to the marketplace of ideas. Even so, there is a concern that by prohibiting false speech, the government would also “chill” more valuable speech, meaning it would cause people to self-censor out of fear of violating the law. Consequently, the First Amendment creates “breathing space” protecting the false statements and hyperbole that are “inevitable in free debate.” In the words of Justice Brennansaid: ‘even a false statement may be deemed to make a valuable contribution to a public debate’.
|}

==== Strict Scrutiny in Content-Based Legislation<br> ====
As a general rule, if a US law targets speech based on its expressive content, that content-based regulation will trigger strict scrutiny analysis. Under strict scrutiny, a law is presumptively unconstitutional unless the government can show the challenged law is the least restrictive means of targeting speech while also serving a compelling governmental interest. <br>
{| class="wikitable" style="border-collapse: collapse; width: 100%; height: 46px;"
|- style="height: 23px;"
| style="width: 100%; height: 23px;" | '''Case note: United States v. Alvarez, 567 U.S. 709 (2012)'''<br>
|- style="height: 23px;"
| style="width: 100%; height: 23px;" |

In United States v. Alvarez, the U.S Supreme Court ruled that the Stolen Valor Act of 2005, a federal law prohibiting false statements about receiving military decorations or medals, was violating the First’s Amendment guarantee of the right to free speech.

The four-Justice plurality opinion clarified “that falsity alone may not suffice to bring the speech outside the First Amendment.” Thus, the plurality opinion applied strict scrutiny to the Stolen Valor Act as a content-based law.  Moreover, the Court held that the law was not sufficiently narrowly tailored because it punished false statements regardless of the context or purpose. Accordingly, there was no “direct causal link” showing the law’s broad scope was necessary to the government’s goal of protecting the integrity of the military honors system. 
|}

==== Election Speech ====
<p>False, misleading, and intimidating speech has proliferated in both online and real world spaces, particularly as it relates to elections. Although the right to free speech is generally protected by the First Amendment, that right does not extend to saying anything, anywhere, in any manner. When governments identify efforts to intimidate, deter, or otherwise interfere with voters, the First Amendment allows them to safeguard the fundamental right of citizens to vote freely without fear, threat, or undue influence. Governments can also take steps to prevent, suppress, or remove false and misleading speech that seeks to disrupt the process of voting. </p>
{| class="wikitable" style="border-collapse: collapse; width: 100%; height: 122px;"
|- style="height: 76px;"
| style="width: 32.1782%; height: 76px;" | Are election related false statements Protected by the first Amendment?
| style="width: 67.8218%; height: 76px;" | Generally, yes, but [https://www.law.georgetown.edu/icap/wp-content/uploads/sites/32/2024/08/Fact-Sheet-False-Misleading-and-Intimidating-Election-Information.pdf not if they interfere with the voting process]. The Constitution protects lies, especially if they are not under oath and can be easily countered (United States v. Alvarez). However, false statements can be regulated in contexts such as fraud, defamation, libel, statements to government officials, perjury, misrepresentation as a government official, and misleading advertising or commercial speech.
|- style="height: 23px;"
| style="width: 32.1782%; height: 23px;" | What types of false statements about elections can be constitutionally prohibited?
| style="width: 67.8218%; height: 23px;" | [https://www.law.georgetown.edu/icap/wp-content/uploads/sites/32/2024/08/Fact-Sheet-False-Misleading-and-Intimidating-Election-Information.pdf Regulation allowed for misleading voting process information]: Governments can prohibit false or misleading speech about voting logistics, like when, where, or how to vote, to protect voter access (Minn. Voters All. v. Mansky). The government’s interest in protecting voting rights is emphasized, especially during election campaigns when false statements can have adverse public consequences (McIntyre v. Ohio Elections Comm’n).
|- style="height: 23px;"
| style="width: 32.1782%; height: 23px;" | Can the government regulate other types of election-related speech?
| style="width: 67.8218%; height: 23px;" | Yes, [https://www.law.georgetown.edu/icap/wp-content/uploads/sites/32/2024/08/Fact-Sheet-False-Misleading-and-Intimidating-Election-Information.pdf when necessary to protect voting integrity]. The Supreme Court has recognized that government has compelling interests in protecting voters “from confusion and undue influence,”and in “preserving the integrity of its election process” [Burson v. Freeman].  “Preventing voter intimidation and election fraud” is “necessary,” and “ensuring that every vote is cast freely, without intimidation or undue influence, is  a valid and important state interest” [Brnovich v. Democratic Nat’l Comm.]  Thus, where it is necessary to regulate speech about elections—a content-based category of speech that is subject to strict scrutiny—the government can take steps that are the least restrictive means necessary to protect this compelling interest.
|}
{| class="wikitable" style="border-collapse: collapse; width: 100%; height: 276px;"
|- style="height: 23px;"
| style="width: 100%; height: 23px;" | '''Case note: Social Media Influencer Sentenced for Election Interference in 2016 Presidential Race'''
|- style="height: 253px;"
| style="width: 100%; height: 253px;" | In a recent case, the [https://www.justice.gov/opa/pr/social-media-influencer-sentenced-election-interference-2016-presidential-race Department of Justice] successfully prosecuted a social media influencer who made online posts ahead of the 2016 election to “disseminate fraudulent messages that encouraged supporters of presidential candidate Hillary Clinton to ‘vote’ via text message or social media, which was legally invalid”.  Although the defendant challenged his prosecution by claiming that his deceptive posts were “political speech,” a federal court found that his speech was “merely a single element within a course of criminal conduct”—namely, a conspiracy to interfere with the right to vote [[https://harvardlawreview.org/print/vol-137/united-states-v-mackey/ United States v. Mackey]]. Accordingly, the speech was “integral to criminal conduct” and thus unprotected by the First Amendment. The court also found that intentionally false speech about voting procedures did not fall within the core of political speech and that it could be regulated by the government where it did not address the substance of what was on the ballot but instead dealt with access to the ballot. Thus, speech that harms the integrity of the election process—such as misinformation about where, when, or how to vote—can be regulated even where speech about a candidate or a candidate’s views, even if false, could not be.
|}
<p><br></p>
==== Role of Social Media Platforms ====
<p>Recent events such as the Cambridge Analytics scandal or the allegations of Russian interference into the 2016 elections have shown how important online intermediaries and platforms are.</p><p>Online intermediaries and social media platforms have a large amount of freedom when it comes to speech violations. [https://crsreports.congress.gov/product/pdf/R/R46751#:~:text=Section%20230%20of%20the%20Communications,users%20of%20interactive%20computer%20services. Section 230] of title 47 of the U.S. Code, part of a codification of the Communications Act of 1934 (Section 9 of the Communications Decency Act / Section 509 of the Telecommunications Act of 1996) has been interpreted to mean that operators of Internet services are not publishers (and thus not legally liable for the words of third parties who use their services).</p>
*Section 230(c)(1): "No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."
*Section 230 confers full immunity on ‘interactive computer services’, from liability for torts others commit on their websites or online forums, even if the provider fails to take action after receiving notice of the harmful or offensive content.
*Through the so-called Good Samaritan provision, this section also protects ISPs from liability for restricting access to certain material or giving others the technical means to restrict access to that material.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | '''Case note: Murthy v Missouri, 603 U.S (2024)'''
|-
| style="width: 100%;" | <p>In [https://www.supremecourt.gov/opinions/23pdf/23-411_3dq3.pdf Murthy v. Missouri], the Supreme Court rejected a suit brought by two states and several social media users against Executive Branch officials and agencies, claiming that government officials’ contacts with social media companies about misinformation related to the COVID-19 pandemic and the 2020 election violated First Amendment guarantees against government censorship [Murthy v. Missouri].</p><p>The Court emphasized that social media companies already had policies against misinformation and disinformation, which they enforced by “exercising their independent judgment” even after consulting with government officials as well as outside experts. The Court held that the plaintiffs lacked standing, in part because they could not “link past social media restrictions” imposed by the social media companies to the government officials’ communications in which they identified potential misleading and false speech. Most major social media companies have in place policies against election-related misinformation and disinformation. After Murthy, social media companies remain free to enforce these policies on their own platforms by exercising their own judgment and conferring with outside experts, including government officials who may reach out to alert them to potential false statements. Unless there is “evidence of continued pressure” from government officials to interfere with companies’ independent application of their content- moderation policies, companies are “free to enforce, or not enforce, those policies,” even if those decisions are informed by contacts with government actors.</p>
|}

==== State Legislation ====
<p>The federal government does not regulate false statement about the subject-matter of elections, but many states do. These laws impose liability for a number of different types of false claims.</p><p>[https://medialaw.unc.edu/wp-content/uploads/2021/08/State-Regulation-of-Election-Related-Speech.08.04.2021.pdf Thirty-eight states] have statutes that directly target the content of election-related speech:</p>
*Sixteen states have statutes that prohibit false statements about a candidate for public office. 
*Fourteen states have statutes that prohibit false statements about a ballot measure, proposal, referendum, or petition before the electorate. 
*Thirteen states have statutes that prohibit false statements about voting requirements or procedures.
* Eleven states have statutes that prohibit false statements about the source, authorization, or sponsorship of a political advertisement or about a speaker’s affiliation with an organization, candidate, or party. 
*Nine states have statutes that prohibit false statements that a candidate, party, or ballot measure has the endorsement or support of a person or organization. 
*Seven states have statutes that prohibit false statements about incumbency.
<p>A number of states have false statement laws that explicitly apply to online actions and that can be applied to election deception.</p>
*California law prohibits “political cyber-fraud,” which includes intentionally causing visitors to believe advocacy or information posted on a political website represents the views of candidate or someone in favor or opposed to a ballot measure, when it does not [Cal. Penal Code 18320-18323).
*[http://www.theguardian.com/technology/ng-interactive/2019/jun/22/the-rise-of-the-deepfake-and-the-threat-to-democracy Texas law] (and California law until 2022) prohibits distribution of election-related “deepfakes,” which use artificial intelligence to create highly realistic videos that appear to portray real people when they do not.

Module 2: Data

2024-10-09T18:13:05Z

Cmercer29: /* United States */

= Cross-border flows of personal data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
== Brazil ==

=== 1. Introduction ===
<p>Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. </p>
<p>Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. </p>
<p>Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.</p>
<div>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" | <p style="margin-left: 25px;"><span style="text-decoration: underline;">Aside: What is Brazil’s AI Plan?</span> </p>
<p style="margin-left: 25px;">On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. </p>
<p style="margin-left: 25px;">The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.</p>
|}</div>
|}
</div>
<p>Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. </p>

=== 2. Broader data protection landscape ===
<p>We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. </p>

==== 2.1 Constitutional / fundamental rights model ====
<p>Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: </p>
<p style="margin-left: 50px;">''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;''<br></p>
<p style="margin-left: 50px;">''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''</p>
<p>In 2022, the Constitution was amended to include a specific right to data protection: </p>
<p style="margin-left: 50px;">''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''</p>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{|
|-
| <p>'''<span style="text-decoration: underline;">National context for Brazil:</span>''' </p>
<p>Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. </p>
<p>Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.</p>
<p>[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:</p>
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>
|}

==== 2.2 The General Data Protection Law (LGPD) ====
<p>The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:</p>
*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  

==== Scope of Application ====
<p>We have considered the scope of application in three ways: personal, material and territorial. </p>
*<span style="text-decoration: underline;">Personal Scope</span>
<p style="margin-left: 25px;">The LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).</p>

<br>
*<span style="text-decoration: underline;">Material Scope</span>
<p style="margin-left: 25px;">The LGDP applies to any processing operation of personal data. </p>
::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

<br>
*<span style="text-decoration: underline;">Territorial scope</span>
<p style="margin-left: 25px;">The LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: </p>
***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).

<br>
===== Processing of Personal Data =====
<p><span style="text-decoration: underline;">Controllers and Processors</span> (Articles 5, 37-40, 42-43) </p>
*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

<br><p><span style="text-decoration: underline;">Principles:</span> Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):</p>
*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.
<p><span style="text-decoration: underline;">Legal basis:</span> The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :</p>
*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.
<p>The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.</p>

==== 2.3 Interaction of the Law and the Regulation ====
<p>In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). </p>

<br><p>The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): </p>
*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

=== 3. Substantive detail of cross border data flows ===
<p>Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. </p>

<br><p>Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. </p>
<p>In no hierarchy, there are various mechanisms that permit international data transfers. </p>
*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

<br><p>The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.</p>

==== 3.1 When are data transfers allowed? ====
<p>The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): </p>
#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

==== 3.2 Adequacy decisions ====
<p>We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. </p>

===== How is the level of protection assessed for adequacy in the recipient country? =====
<p>Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: </p>
*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).
<p>The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:</p>
<p>I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; and</p>
<p>II - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. </p>

==== 3.3 Contractual measures ====
===== Standard contractual clauses =====
<p>The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).</p>
<p>Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. </p>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <p style="margin-left: 50px;">CLAUSE 2. Purpose</p>
<p style="margin-left: 50px;">2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.</p>
*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:
<p style="margin-left: 50px;">(NOTE: fill in as much detail as possible with information relating to the international transfer)</p>
|}

<div>

{| style="font-size: 14.4px;"
|-
|
<br>
|}
Broadly, the template standard contractual clauses include detail about:</div>
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).

===== Equivalent Standard Contractual Clauses =====
<p>Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.</p>

===== Global Corporate Standards (or Binding Corporate Rules) =====
<p>A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).</p>
*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

<br>
==== 3.4 Transparency Requirements ====
<p>All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. </p>
#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

<br><p>These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).</p>

== China ==
<p>China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.</p>

=== <span style="font-size: 14pt;">The Cybersecurity Law</span> ===
<p>In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. </p>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <p>[https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]</p>
<p>''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''</p>
|}

<br><p>Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:</p>
*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

<br>
=== <span style="font-size: 14pt;">The Personal Information Protection Law</span> ===
<p>'''<span style="font-size: 14pt;"></span>'''</p>
<p>The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: </p>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <p>''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''</p>
<p>''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''</p>
*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}<p>Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:</p>
*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

<br>
=== <span style="font-size: 14pt;">The Data Security Law</span> ===
<p>'''<span style="font-size: 14pt;"></span>'''</p>
'''<span style="font-size: 14pt;"></span>'''<p>The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]</p>
<p>The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:</p>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <p>''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''</p>
<p>''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''</p>
|}<p>Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]</p>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}<p>The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]</p>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|}<p><br></p>
=== <span style="font-size: 14pt;">Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments</span> ===
<p>'''<span style="font-size: 14pt;"></span>'''</p>
<p>A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. </p>
<p>The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].</p>
<p>Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].</p>
[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. <p>Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.</p>
<p>Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.</p>
<p>Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.</p>

<br>
=== <span style="font-size: 14pt;">The Digital Silk Road</span> ===
<p>'''<span style="font-size: 14pt;"></span>'''</p>
'''<span style="font-size: 14pt;"></span>'''<p>On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.</p>

== India ==
== United States ==
<p style="font-weight: 400;">'''No federal 'general consumer' privacy or data protection legislation'''</p>
<p style="font-weight: 400;">The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.</p>
<p style="font-weight: 400;">In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.</p>

<span style="text-decoration: underline;"><strong style="font-size: 14.4px;">Federal level</strong></span>

<strong style="font-size: 14.4px;">1. Privacy Act (1974)</strong><p style="font-weight: 400;">The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:</p>
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal information
<p style="font-weight: 400;">This Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.</p>
<p style="font-weight: 400;">The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))</p>

<strong style="font-size: 14.4px;">2. Executive Order 14117 (February 28, 2024)</strong><p style="font-weight: 400;">The 1974 Privacy Act is an older piece of legislation, but there are some more recent developments in the field too. A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).</p>
<p style="font-weight: 400;">The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].</p>
<p style="font-weight: 400;">Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].</p>

<strong style="font-size: 14.4px;">3. PADFA (HR 815, Pub. L. 118-50)</strong><p style="font-weight: 400;">Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).</p>
<p style="font-weight: 400;">While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.</p>
<p style="font-weight: 400;"><span style="text-decoration: underline;">'''Examples of federal sectorial'''''' data protection'''</span></p>
<p style="font-weight: 400;">''' 1. '''<strong style="font-size: 14.4px;">Health and medical data (HIPAA)</strong></p>
<p style="font-weight: 400;">The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).</p>
<p style="font-weight: 400;">The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.</p>
<p style="font-weight: 400;">With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.</p>
<p style="font-weight: 400;">Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].</p>
<p style="font-weight: 400;">HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').</p>
''''''

'''2. Financial data privacy (GLB Act)'''<p style="font-weight: 400;">The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).</p>
<p style="font-weight: 400;">The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.</p>
<p style="font-weight: 400;">Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.  </p>
<p style="font-weight: 400;"><br></p>
<p style="font-weight: 400;">The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].</p>
''''''

'''3. Data protection for children (COPPA)'''<p style="font-weight: 400;">In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).</p>
<p style="font-weight: 400;">As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.</p>
<p style="font-weight: 400;">COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.</p>
<p style="font-weight: 400;">Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.</p>
<p style="font-weight: 400;">COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.</p>
<p style="font-weight: 400;">The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation.</p>
<p style="font-weight: 400;"><br></p>
<p style="font-weight: 400;">COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees.</p>
<p style="font-weight: 400;"><br></p>
<p style="font-weight: 400;"><span style="text-decoration: underline;">'''US State Laws'''</span></p>
<p style="font-weight: 400;">In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.</p>