Technology Governance Wiki - User contributions [en]

Module 5: Artificial Intelligence

2024-11-27T20:16:40Z

Erikads: /* 1. Text and data mining in the US */

== Text and data mining ==
According to [https://eur-lex.europa.eu/eli/dir/2019/790/oj Directive (EU) 2019/790], "‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations". The Directive further provides a framework for the use of such techniques.
=== Brazil ===

==== Introduction ====

Brazil is currently in the process of implementing a national strategy on AI, a process which Brazil began in 2020. The strategy is holistic and considers many different aspects where Brazil is working on legislation, regulation, and AI governance with an eye to ethical use of AI and alignment with international approaches to AI. Brazil’s AI policy also puts a focus on education, workforce & training, research, development and innovation, how AI can be applied in “productive sectors” of the economy and in public bodies, and public security. The overall policy is founded on a goal of stimulating research, innovation and development of AI solutions while maintaining conscious and ethical use of AI. This national strategy is captured in policy documents, including the Brazilian Artificial Intelligence Strategy ([https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/arquivosinteligenciaartificial/ebia-summary_brazilian_4-979_2021.pdf EBIA]), as well as the National Strategy for Intellectual Property ([https://www.gov.br/inpi/pt-br/central-de-conteudo/noticias/cerimonia-marca-50-anos-do-inpi-e-lancamento-da-estrategia-nacional-de-propriedade-intelectual/EstratgiaNacionaldePropriedadeIntelectual.pdf ENPI]) and the National Policy of Innovation.

Pursuant to the Brazilian Artificial Intelligence Strategy, Brazil is working on specific legislation for AI. An initial draft AI Act was introduced in Brazil’s lower legislative chamber (the Chamber of Deputies) in 2020 (PL 21/2020), and was subsequently sent to the upper chamber (the Senate). The Senate convened a committee of experts to hold public hearings and collect public comments, the Comissão de Juristas responsável por subsidiar elaboração de substitutivo sobre inteligência artificial no Brasil ([https://legis.senado.leg.br/atividade/comissoes/comissao/2504/ source]). Other relevant draft laws were also pending in the Senate, so the Senate issued an order to combine, restructure and improve the text of these proposed laws pending input from the Committee. The Committee held meetings in 2022 and issued a final report in December 2022 with proposed changes to text. According to a press release from August 2024, the Senate is still reviewing draft AI legislation. A new draft text incorporating the recommended language from the committee of experts has been assigned bill number PL 2338/23, and it is this bill that appears to be moving forward in the Senate. The Chamber of Deputies’ original draft text PL 21/2020 has not moved forward; several other draft laws that relate to AI are also pending in the Senate. The Senate now has another commission debating the draft AI Act, which is continuing to meet regularly ([https://legis.senado.leg.br/atividade/comissoes/comissao/2629/ source]). Thus, it appears Brazil is getting closer to finalizing the draft legislation.

==== Text and Data Mining in Brazil ====

With the AI legislation in Brazil not yet finalized, from a copyright perspective, Brazil law currently does not authorize text and data mining (TDM) without permission of the copyright holder. Although Brazil’s copyright act, Law No. 9.610 of February 19, 1998 (Law on Copyright and Neighboring Rights), does include some exceptions to the exclusive rights of a copyright holder, none of these exceptions (in Articles 46, 47, and 48 of ) address text and data mining. [source: https://www.wipo.int/wipolex/en/legislation/details/514]. Thus, the work that Brazil’s Senate is doing on the draft AI will be important to regulate text and data mining activities when the law is finalized and approved.

The most recent and active draft AI Act in Brazil, PL 2338/23, includes the following definition of text and data mining:

\Art. 4. For the purposes of this Law, the following definitions are adopted:

[…] VIII – text and data mining: process of extracting and analyzing large amounts of data or partial or full excerpts of textual content, from which patterns and correlations are extracted that will generate relevant information for the development or use of artificial intelligence systems.

The draft law would regulate text and data mining as follows:

Art. 42. The automated use of works, such as extraction, reproduction, storage and transformation, in data and text mining processes in artificial intelligence systems, in activities carried out by research organizations and institutions, journalism and museums, archives and libraries, does not constitute an offense to copyright, provided that:
I – it does not have as its objective the simple reproduction, exhibition or dissemination of the original work itself;
II – the use occurs to the extent necessary for the objective to be achieved;
III – it does not unjustifiably harm the economic interests of the owners; and
IV – it does not compete with the normal exploitation of the works.

§ 1. Any reproductions of works for data mining activities will be kept under strict security conditions, and only for the time necessary to carry out the activity or for the specific purpose of verifying the results of scientific research.

§ 2. The provisions of the caput shall apply to the activity of data and text mining for other analytical activities in artificial intelligence systems, provided that the conditions of the items of the caput and § 1 are met, provided that the activities do not communicate the work to the public and that access to the works has been legitimate.
§ 3. The activity of text and data mining involving personal data shall be subject to the provisions of Law No. 13,709, of August 14, 2018 (General Personal Data Protection Law) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]).

As noted above, this is only a draft legislation, and this could change as the draft bill is debated further in Brazil’s congress.

The draft TDM definition and exception are notable in being fairly aligned with other jurisdictions such as the European Union. Brazil’s draft definition of TDM goes so far as to stipulate that “large amounts of data or partial or full excerpts of textual content” will be permitted to be mined, which suggests even in this definition the intent to provide an exception from the existing copyright regime. The definition also limits this use to the purpose of “development or use of artificial intelligence systems.” Arguably, this language ensures that the exception will be limited to the AI field. The inclusion of TDM when AI systems are in “use” is an interesting addition, since it suggests that TDM might be permissible not only for the training stage, but also when AI is deployed.

Like other jurisdictions such as the EU, Brazil’s draft TDM exception at Article 42 provides for use of works by research organizations and cultural institutions, namely, museums, archives, and libraries. However, it also notably allows an exception for journalism, along with the scientific and cultural uses. It is also notable that draft Article 42 includes a requirement that any use of the TDM exception “does not unjustifiably harm the economic interests of the owners” or compete with or replace the original works. Like the EU, subsection (42)(1) requires security conditions and limits the time for keeping the works.

Draft section 42(2) appears to provide a broader TDM exception that is not limited to scientific research, journalism, or cultural institutions, with additional requirements that entities using 42(2) must also not communicate the work to the public and must have had legitimate access to the works in the first place. This would seem to suggest that scraping is not allowed under draft section 42(2), but possibly is allowed for scientific research, journalistic purposes, or cultural purposes. Notably, this draft broad TDM exception in 42(2) does not include any kind of mechanism for rights holders who do not wish their works to be used in TDM activities to opt-out.

Finally, draft subsection 42(3) states that Brazil’s general data privacy law does apply to TDM activities. Thus, if this proposed language becomes law, entities using the TDM exception will still have to consider data privacy.

=== China ===
=== India ===
[https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry] has stated that India’s existing regime of intellectual property rights (IPR) and copyright is sufficient to protect both rights holders of AI-generated works, and rights holders of content that may be used by Generative AI (e.g., training data). Consequently, the Ministry states there is no reason nor need to develop an additional regime specifically regulating AI and related innovations. As a result, there is no specific regulation to discuss relating to training data and scraping, also known as text and data mining (TDM), for AI training purposes. This paper thus focuses on aspects of the current regulatory regime that are relevant to the question of AI training data, and discusses potential limitations and criticisms of the reliance on the current regime. 

 Important to note is that India also lacks regulation regarding AI generally, not just lacking regulation regarding TDM either generally or for the purposes of AI training. Despite this, the government has addressed the growing challenge of AI through publishing the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence] which highlights numerous legal and societal challenges arising from AI. This Strategy does not explicitly mention copyright or legal issues arising from TDM, but highlights privacy problems that may be relevant for TDM for training as part of the AI lifecycle. [https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry brings attention] to a few specific aspects of the current IPR regime. Exclusive economic rights of a copyright owner are provided by the Copyright Act 1957. For generative AI to make use of copyrighted material under this act, the use must be covered under fair dealing exceptions in Section 52 of the Copyright Act 1957. Additionally, India’s personal data regulatory framework may be a relevant consideration for TDM.
==== 1.1 The Copyright Act 1957 ====
 [https://www.copyright.gov.in/Documents/Copyrightrules1957.pdf The Copyright Act 1957] is India’s main regulatory instrument regarding intellectual property and copyright. Section 13 of the Copyright Act 1957 highlights which works are provided copyright protections, which include (1) original literary, dramatic, musical and artistic works, (2) cinematographic films, and (3) sound recordings. Section 14 expounds on actions that are prohibited to take against copyrighted works. Most relevant is the mention of the prohibitions of “the storing of [the copyrighted work] in any medium by electronic or other means” (emphasis added). This is applicable for the cases of a literary, dramatic, or musical work, a computer programme, an artistic work, and cinematographic films, covering all types of works mentioned in the Copyright Act 1957.
===== 1.1.1 Infringement of Copyright and Fair Dealing Exceptions =====
 Chapter XI Copyright Act 1957 addresses infringements of copyright. Section 51 outlines when copyright will be deemed infringed, which includes when anything is done which is the exclusive right of the copyright holder (Section 51(a)(i)), and other distributions of the copyrighted work, including when it is “to such an extent to affect prejudicially the owner of the copyright” (Section 51(b)(ii)).

 Section 52 outlines when certain acts are not considered an infringement of copyright, commonly known as fair dealing exceptions. Section 52(a)  excludes from infringement “a fair dealing with any work, not being a computer programme,” for the purposes of either “(i) private or personal use; including research; (ii) criticism or review [...]; [and] (iii) the reporting of current events and current affairs.” An accompanying explanation states that the storing of any copyrighted work in an electronic medium for the aforementioned purposes shall not constitute an infringement. Section 52(aa) (sic) excludes from infringements the certain actions towards copyrighted computer programmes, such as when a lawful possessor of a copy makes copies of the programme for certain purposes (Section aa(i)-(ii) (ab), (ac), (ad), …). Section 52 is expansive and outlines numerous other exceptions.
===== 1.1.2 Application of the CRA 1957 to TDM =====
Generally, the Copyright Act 1957 is vague. The fair dealing exceptions in Section 52 are strict and lack any specific reference to TDM or more generally to the use of copyrighted information to develop a product as such. The Copyright Act 1957 does reference electronic storage and recent technological changes such as, for example, listing the circumvention of “an effective technological measure applied for the purpose of protecting any of the rights conferred by this Act” (Section 65A) as an offence. However, such mentions are limited and still revolve around the (illegal) act of creating a copy of a copyrighted work. Much of the Copyright Act 1957 is focused on the illegal replication of works.

 The Copyright Act’s particular focus has resulted in scholarly opinion that the Act would actually not prohibit TDM despite a lack of explicit fair dealing exception. Dr. Arul George Scaria, Co-Director of the [https://ciipc.org/ Centre for Innovation, Intellectual Property, and Competition (CIIPC) at National Law University in Delhi], has argued for the legality of TDM under Indian copyright law. He [https://spicyip.com/2019/08/should-indian-copyright-law-prevent-text-and-data-mining.html argues that Indian copyright law] only protects the expression of ideas, not facts or ideas themselves. So, when a researcher, for example, uses a copyrighted article in the course of TDM, this should be considered a non-expressive use of the work outside of copyright protection. He goes so far as to argue that it is thus “morally and legally impermissible to allow publishers to use End User Licence Agreements or other contractual tools to restrict researchers from using articles for TDM.” 

Additionally, Dr. Scaria emphasises that India’s copyright regime privileges not only the rights of the creators or copyright holders, but also the users of such works. He references the[https://indiankanoon.org/doc/135895592/ Delhi University Photocopy Shop (Single Bench)] decision, wherein Justice Endlaw states that the rights of persons in Section 52, the fair dealing exception, should not be interpreted narrowly or strictly. The rights given to users should be interpreted on par with those given to creators. Lastly, Dr. Scaria argues that India’s fair dealing regime can provide the flexibility to apply to newer technological developments such as TDM. Whilst Dr. Scaria makes a compelling argument, part of that compelling argument derives from his discussion of TDM as done by researchers, rather than addressing, for example, the use of TDM to train AI for ultimately commercial purposes.

Another case did address TDM for another use, by the state. Whilst this does not explicitly address the use of TDM to train AI, it still provides perspective on how TDM might be understood in the context of India’s regulatory framework. The Supreme Court of India, in the case of [https://indiankanoon.org/doc/127517806/ Justice K.S. Puttaswamy (Retired) vs Union of India and Ors.], recognised TDM’s importance for the state. The Court held that “[TDM] with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the state to insist on the collection of authentic data.” However, this case addressed TDM primarily from a privacy law perspective, rather than copyright; consequently, there still is no litigation that addresses the TDM in a copyright context. This raises further concerns considering the lack of explicit inclusion of a TDM fair dealing exception in Section 52 of the Copyright Act 1957.

As a result, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html likely means of justifying TDM is through Section 52(1)(a) ]which allows for private and personal use of copyrighted works, including for research. This provision is nuanced, wherein the making of copyrighted works publicly available to facilitate private and personal use such as by public libraries could be justified. However, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html Calcutta High Court in 2013] stated that “commercial exploitation” does not fall under “private or personal use,” a position reaffirmed by the Bombay High Court in 2018. Thus, it seems that the main way in which TDM could be justified under India’s copyright regulation is through arguing that TDM does not infringe on the expression of the idea or data, and thus copyright does not apply, as argued by Dr. Scaria.
==== 1.2 Database protection ====
 A newer form of intellectual property rights relates to database protection, which may be relevant when it comes to TDM. India does not have an explicit database right in its intellectual property right regime, but it has recently been subsumed into its copyright regulatory framework. [https://link.springer.com/chapter/10.1007/978-981-10-3984-3_10 The Delhi High Court in Himalaya Drug Company v Sumit] ruled that compilations of databases could be considered literary works and consequently covered by the Copyright Act 1957. This would mean use of compilations of databases in TDM contexts would have to fall under fair dealing exceptions in Section 52 of the Copyright Act 1957. 
==== 1.3 Personal data mining ====
 Another problematic aspect of data mining is the use of [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf personal data]. The source of data used for data mining can be essential, and if the data obtained is not public knowledge or obtained consensually, Indian personal protection legislation might apply. Companies and organizations that do not obtain personal data with permission or [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf discriminate] against individuals based on age, sex, gender, race, or religion are not going to be compliant with local or transnational laws. Specifically in India, data mining in such circumstances is regulated by the [https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf Information Technology Act], 2000 (IT Act) (e.g Article 43A which outlines rules on unauthorized access, sensitive personal data, and information, as well as compensation for failure to protect data), and the [https://www.google.com/url?q=https://www.meity.gov.in/writereaddata/files/Digital%2520Personal%2520Data%2520Protection%2520Act%25202023.pdf&sa=D&source=docs&ust=1732737698777765&usg=AOvVaw0wY-MZ1iAH8P634ZfD2-Vf Personal Data Protection Bill, 2019 (PDP Bill)]. However, some scholars discuss that the production of Privacy Preserving Data Mining Techniques[https://www.researchgate.net/profile/Ahmad-Ahmad-79/publication/375343129_Psychological_Burden_of_Caregivers_of_Children_with_Cancer_at_AL-Amal_Hospital_in_Baghdad_City/links/65476ca9b86a1d521bb8fe8a/Psychological-Burden-of-Caregivers-of-Children-with-Cancer-at-AL-Amal-Hospital-in-Baghdad-City.pdf#page=410 could circumvent] regulation from data protection regulation. This approach is somewhat reflected in the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence], wherein the Indian government recommends investing in privacy-preserving AI research methods to reduce the “risks of data exploitation and personal identification (from an anonymisation dataset).”

=== United States ===
=== 1. Text and data mining in the US ===
=== 1.1. Introduction TDM ===
Text- and data mining is a process used to develop AI models. Data is fed into a model and algorithms are applied to the data. The term TDM is not defined in US Law, but rather as "machine and human- based inputs” under Title 15 Commerce and Trade. Another reference can be found under Machine Learning, which mentions "the ability to automatically learn and improve on the basis of data or experience. 

=== 1.2. US definition AI ===
The legal definition of AI originates from the National Artificial Intelligence Initiative Act of 2020, which regulates public bodies' use of AI:
"a machine based system that can, for a given set of human-defined objectives, make predictions,  recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems  use machine- and human-based inputs to perceive real and virtual environments; abstract such  perceptions into models through analysis in an automated manner; and use model inference to  formulate options for information or action.”,
The legal question is: do any restrictions apply to the use of input such as publicly available text or data in digital form for the purpose of training AI models?
To the extent that the input may be protected by copyright, the Copyright Act of 1976 is applicable.
To the extent that the input may be pertaining to data created by human behavior, other acts or constitutional rights may apply.
To the extent that the use of the data may be unfair or harmful to competition or consumer rights, FTC regulations may apply.

=== 1.3. Legal framework ===
==== 1.3.1. U.S. Constitution ====
Patent and Copyright Clause
(a.k.a. Patent Clause, the Copyright Clause, and the Progress Clause)
The Congress shall have Power ...to promote the Progress of Science and useful Arts, by securing for limited Tımes to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

==== 1.3.2. Federal Law ====
==== The Copyright Act of 1976 ====
The United States copyright law is contained in the United States Code, chapters 1 through 8 and 10 through 12 of Title 17. The Copyright Act of 1976, which provides the basic framework for the current copyright law.
The authority has been granted to the US Copyright Office since 1870. 
To the extent that “human-based input’ and data can be a product of human work, it may be protected under the constitutional clause which grants an exclusive right to the Author or Inventor.
Copyright protection is granted to original works of authorship that are fixed in a tangible medium of expression . The author of the work generally holds copyright ownership generally, a right which she may transfer or license their rights to others. 
Essential to the copyright protection in the US is the fair use doctrine, which allows for several exemptions for which limited use of copyrighted material is allowed without the author’s permission. 
Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work.
The legal discussion regarding TDM in the US is evolving essentially around the application of the exceptions under the legal doctrine of fair use.
Following the Executive Order  Executive Order 13859 announcing the American Artificial Intelligence Initiative, the United States Patent and Trademark Office (USPTO) released a report titled “Public Views on Artificial Intelligence and Intellectual Property Policy.” The report consults a wide variety of stakeholder views on the impact of artificial intelligence (AI) across the intellectual property (IP) landscape, including patent, trademark, copyright, and trade secret policy, as well as developing issues about database protection. 
In this report, the USPTO stated:‘ “The ingestion of copyrighted works for purposes of machine learning will almost by definition involve the reproduction of entire works or substantial portions thereof. Accordingly, whether this constitutes copyright infringement will generally be determined by considering the applicability of the fair use doctrine, an exception set forth in section 107 of the Copyright Act, 17 U.S.C. § 107. Fair use is applied on a case-by-case basis, requiring courts to weigh several statutory factors, and is highly fact-dependent.’  § 102).’
The report included the results of a poll among a broad array of public and private stakeholders. The report  showed that the existing legal framework lacks instruments to tackle the challenges of AI. While the majority found the existing U.S. intellectual property laws calibrated correctly to address the evolution of AI (copyright, trademarks, trade secrets, and data fields), some suggested a need for new classes of IP rights. Overall, many agreed that existing commercial law principles (e.g., contract law) might adequately fill any gaps left by IP law in the wake of advances in AI .

==== COPIED ACT bill proposal ====
July 11th 2024 the bipartisan bill was introduced in Congress.
Content Origin Protection and Integrity from Edited and Deepfaked Media Act of 2024
The bill proposal addresses the new IP issues with respect to content by requiring transparency and content provenance information in an aim to protect artistic content.
The intention to establish NIST standards for provenance information seems to open the possibility for remuneration for rights-holders. This would be aligned with the intent of the constitutional right in the Patent and Copyright Clause.

==== 1.3.3. Recent US Court cases regarding TDM ====
NEW YORK TIMES v. OPEN AI INC (2023)
The New York Times claimed that OpenAI and Microsoft, as creators of highly profitable generative AI models, did not give credit or remuneration to the New York Times despite relying on their works. The New York Times further alleges that this conduct not only infringes on their intellectual property rights but could also threaten their business model of providing news coverage, analysis and commentary on current events.
AUTHORS GUILD v. OPEN AI INC (2024)
17 authors argue that OpenAI should have first obtained their permission to use their copyrighted works and now seek a permanent injunction against OpenAI to prevent these alleged harms from reoccurring. The Authors Guild is also seeking damages for the lost opportunity to licence their works and asserts that OpenAI and Microsoft forced them into a position where they unknowingly aided their own market replacement. 

=== 1.4. Policy ===
Two executive orders have been released pertaining to the use of AI by public bodies.
Executive Order 14110 of October 30, 2023 Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence mentions data as understood in 1.1.
Regarding availability of data for training the Executive Order states:
(b) …This effort requires investments in AI-related education, training, development, research, and capacity, while simultaneously tackling novel intellectual property (IP) questions and other problems to protect inventors and creators.
(e) … The Federal Government will enforce existing consumer  protection laws and principles and enact appropriate safeguards against fraud, unintended bias,  discrimination, infringements on privacy, and other harms from AI. Such protections are especially important in critical fields like healthcare, financial services, education,  housing, law, and transportation, where mistakes by or misuse of AI could harm patients, cost  consumers or small businesses, or jeopardize safety or rights. At the same time, my Administration will  promote responsible uses of AI that protect consumers, raise the quality of goods and services, lower  their prices, or expand selection and availability.
(f) Americans’ privacy and civil liberties must be protected as AI continues advancing. Artificial Intelligence is making it easier to extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires. Artificial Intelligence’s capabilities in these areas can increase the risk that personal data could be exploited and exposed. To combat this risk, the Federal Government will ensure that the collection, use, and retention of data is lawful, is secure, and mitigates privacy and confidentiality risks. Agencies shall use available policy and technical tools, including privacy-enhancing technologies (PETs) where appropriate, to protect privacy and to combat the broader legal and societal risks—including the chilling of First Amendment rights—that result from the improper collection and use of people’s data. 
The Executive Order stipulates the need for  “tackling novel intellectual property (IP) question”, “enforce protection laws and principles”and “enact safeguards against harms from AI” as “AI is making it easier to extract …on sensitive information about people’s identities, locations, habits and desires.” The Executive order acknowledges the need for new policies to not only protects copyrights-holders in the context of AI, but also citizens as their behavioral data are being used to train AI-models.

=== 1.5. Enforcement ===
As stated in section 1.1., human-based data may be a broad term, the use of which may violate several laws and regulations.. A certain responsibility  to protect competition in the interest of consumers lies with the FTC. In the case of AI, it may be difficult to assess whether infringement of violations take place.
A special enforcement resolution  was issued by the FTC in November 2023,  “ directing use of compulsory process in a non-public investigation of products and services that use or are produced using artificial intelligence or that purport to detect the use of artificial intelligence”. The specific action enables the FTC to start investigations of possible use of AI in violation with Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 to detect unfair, deceptive, anticompetitive,  collusive, coercive, predatory, exploitative, or exclusionary acts or practices in or affecting commerce relating to products and services that use or are produced using artificial intelligence, including but not limited to, machine-based systems that can, for a given set of defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments, or that purport to use or detect the use of artificial intelligence.
The proposed bill COPIED act may be instrumental in enabling the AI market to become more transparent, for rights-holders to receive remuneration based on standardized provenance mechanisms.

Module 5: Artificial Intelligence

2024-11-27T20:14:46Z

Erikads: /* United States */

== Text and data mining ==
According to [https://eur-lex.europa.eu/eli/dir/2019/790/oj Directive (EU) 2019/790], "‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations". The Directive further provides a framework for the use of such techniques.
=== Brazil ===

==== Introduction ====

Brazil is currently in the process of implementing a national strategy on AI, a process which Brazil began in 2020. The strategy is holistic and considers many different aspects where Brazil is working on legislation, regulation, and AI governance with an eye to ethical use of AI and alignment with international approaches to AI. Brazil’s AI policy also puts a focus on education, workforce & training, research, development and innovation, how AI can be applied in “productive sectors” of the economy and in public bodies, and public security. The overall policy is founded on a goal of stimulating research, innovation and development of AI solutions while maintaining conscious and ethical use of AI. This national strategy is captured in policy documents, including the Brazilian Artificial Intelligence Strategy ([https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/arquivosinteligenciaartificial/ebia-summary_brazilian_4-979_2021.pdf EBIA]), as well as the National Strategy for Intellectual Property ([https://www.gov.br/inpi/pt-br/central-de-conteudo/noticias/cerimonia-marca-50-anos-do-inpi-e-lancamento-da-estrategia-nacional-de-propriedade-intelectual/EstratgiaNacionaldePropriedadeIntelectual.pdf ENPI]) and the National Policy of Innovation.

Pursuant to the Brazilian Artificial Intelligence Strategy, Brazil is working on specific legislation for AI. An initial draft AI Act was introduced in Brazil’s lower legislative chamber (the Chamber of Deputies) in 2020 (PL 21/2020), and was subsequently sent to the upper chamber (the Senate). The Senate convened a committee of experts to hold public hearings and collect public comments, the Comissão de Juristas responsável por subsidiar elaboração de substitutivo sobre inteligência artificial no Brasil ([https://legis.senado.leg.br/atividade/comissoes/comissao/2504/ source]). Other relevant draft laws were also pending in the Senate, so the Senate issued an order to combine, restructure and improve the text of these proposed laws pending input from the Committee. The Committee held meetings in 2022 and issued a final report in December 2022 with proposed changes to text. According to a press release from August 2024, the Senate is still reviewing draft AI legislation. A new draft text incorporating the recommended language from the committee of experts has been assigned bill number PL 2338/23, and it is this bill that appears to be moving forward in the Senate. The Chamber of Deputies’ original draft text PL 21/2020 has not moved forward; several other draft laws that relate to AI are also pending in the Senate. The Senate now has another commission debating the draft AI Act, which is continuing to meet regularly ([https://legis.senado.leg.br/atividade/comissoes/comissao/2629/ source]). Thus, it appears Brazil is getting closer to finalizing the draft legislation.

==== Text and Data Mining in Brazil ====

With the AI legislation in Brazil not yet finalized, from a copyright perspective, Brazil law currently does not authorize text and data mining (TDM) without permission of the copyright holder. Although Brazil’s copyright act, Law No. 9.610 of February 19, 1998 (Law on Copyright and Neighboring Rights), does include some exceptions to the exclusive rights of a copyright holder, none of these exceptions (in Articles 46, 47, and 48 of ) address text and data mining. [source: https://www.wipo.int/wipolex/en/legislation/details/514]. Thus, the work that Brazil’s Senate is doing on the draft AI will be important to regulate text and data mining activities when the law is finalized and approved.

The most recent and active draft AI Act in Brazil, PL 2338/23, includes the following definition of text and data mining:

\Art. 4. For the purposes of this Law, the following definitions are adopted:

[…] VIII – text and data mining: process of extracting and analyzing large amounts of data or partial or full excerpts of textual content, from which patterns and correlations are extracted that will generate relevant information for the development or use of artificial intelligence systems.

The draft law would regulate text and data mining as follows:

Art. 42. The automated use of works, such as extraction, reproduction, storage and transformation, in data and text mining processes in artificial intelligence systems, in activities carried out by research organizations and institutions, journalism and museums, archives and libraries, does not constitute an offense to copyright, provided that:
I – it does not have as its objective the simple reproduction, exhibition or dissemination of the original work itself;
II – the use occurs to the extent necessary for the objective to be achieved;
III – it does not unjustifiably harm the economic interests of the owners; and
IV – it does not compete with the normal exploitation of the works.

§ 1. Any reproductions of works for data mining activities will be kept under strict security conditions, and only for the time necessary to carry out the activity or for the specific purpose of verifying the results of scientific research.

§ 2. The provisions of the caput shall apply to the activity of data and text mining for other analytical activities in artificial intelligence systems, provided that the conditions of the items of the caput and § 1 are met, provided that the activities do not communicate the work to the public and that access to the works has been legitimate.
§ 3. The activity of text and data mining involving personal data shall be subject to the provisions of Law No. 13,709, of August 14, 2018 (General Personal Data Protection Law) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]).

As noted above, this is only a draft legislation, and this could change as the draft bill is debated further in Brazil’s congress.

The draft TDM definition and exception are notable in being fairly aligned with other jurisdictions such as the European Union. Brazil’s draft definition of TDM goes so far as to stipulate that “large amounts of data or partial or full excerpts of textual content” will be permitted to be mined, which suggests even in this definition the intent to provide an exception from the existing copyright regime. The definition also limits this use to the purpose of “development or use of artificial intelligence systems.” Arguably, this language ensures that the exception will be limited to the AI field. The inclusion of TDM when AI systems are in “use” is an interesting addition, since it suggests that TDM might be permissible not only for the training stage, but also when AI is deployed.

Like other jurisdictions such as the EU, Brazil’s draft TDM exception at Article 42 provides for use of works by research organizations and cultural institutions, namely, museums, archives, and libraries. However, it also notably allows an exception for journalism, along with the scientific and cultural uses. It is also notable that draft Article 42 includes a requirement that any use of the TDM exception “does not unjustifiably harm the economic interests of the owners” or compete with or replace the original works. Like the EU, subsection (42)(1) requires security conditions and limits the time for keeping the works.

Draft section 42(2) appears to provide a broader TDM exception that is not limited to scientific research, journalism, or cultural institutions, with additional requirements that entities using 42(2) must also not communicate the work to the public and must have had legitimate access to the works in the first place. This would seem to suggest that scraping is not allowed under draft section 42(2), but possibly is allowed for scientific research, journalistic purposes, or cultural purposes. Notably, this draft broad TDM exception in 42(2) does not include any kind of mechanism for rights holders who do not wish their works to be used in TDM activities to opt-out.

Finally, draft subsection 42(3) states that Brazil’s general data privacy law does apply to TDM activities. Thus, if this proposed language becomes law, entities using the TDM exception will still have to consider data privacy.

=== China ===
=== India ===
[https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry] has stated that India’s existing regime of intellectual property rights (IPR) and copyright is sufficient to protect both rights holders of AI-generated works, and rights holders of content that may be used by Generative AI (e.g., training data). Consequently, the Ministry states there is no reason nor need to develop an additional regime specifically regulating AI and related innovations. As a result, there is no specific regulation to discuss relating to training data and scraping, also known as text and data mining (TDM), for AI training purposes. This paper thus focuses on aspects of the current regulatory regime that are relevant to the question of AI training data, and discusses potential limitations and criticisms of the reliance on the current regime. 

 Important to note is that India also lacks regulation regarding AI generally, not just lacking regulation regarding TDM either generally or for the purposes of AI training. Despite this, the government has addressed the growing challenge of AI through publishing the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence] which highlights numerous legal and societal challenges arising from AI. This Strategy does not explicitly mention copyright or legal issues arising from TDM, but highlights privacy problems that may be relevant for TDM for training as part of the AI lifecycle. [https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry brings attention] to a few specific aspects of the current IPR regime. Exclusive economic rights of a copyright owner are provided by the Copyright Act 1957. For generative AI to make use of copyrighted material under this act, the use must be covered under fair dealing exceptions in Section 52 of the Copyright Act 1957. Additionally, India’s personal data regulatory framework may be a relevant consideration for TDM.
==== 1.1 The Copyright Act 1957 ====
 [https://www.copyright.gov.in/Documents/Copyrightrules1957.pdf The Copyright Act 1957] is India’s main regulatory instrument regarding intellectual property and copyright. Section 13 of the Copyright Act 1957 highlights which works are provided copyright protections, which include (1) original literary, dramatic, musical and artistic works, (2) cinematographic films, and (3) sound recordings. Section 14 expounds on actions that are prohibited to take against copyrighted works. Most relevant is the mention of the prohibitions of “the storing of [the copyrighted work] in any medium by electronic or other means” (emphasis added). This is applicable for the cases of a literary, dramatic, or musical work, a computer programme, an artistic work, and cinematographic films, covering all types of works mentioned in the Copyright Act 1957.
===== 1.1.1 Infringement of Copyright and Fair Dealing Exceptions =====
 Chapter XI Copyright Act 1957 addresses infringements of copyright. Section 51 outlines when copyright will be deemed infringed, which includes when anything is done which is the exclusive right of the copyright holder (Section 51(a)(i)), and other distributions of the copyrighted work, including when it is “to such an extent to affect prejudicially the owner of the copyright” (Section 51(b)(ii)).

 Section 52 outlines when certain acts are not considered an infringement of copyright, commonly known as fair dealing exceptions. Section 52(a)  excludes from infringement “a fair dealing with any work, not being a computer programme,” for the purposes of either “(i) private or personal use; including research; (ii) criticism or review [...]; [and] (iii) the reporting of current events and current affairs.” An accompanying explanation states that the storing of any copyrighted work in an electronic medium for the aforementioned purposes shall not constitute an infringement. Section 52(aa) (sic) excludes from infringements the certain actions towards copyrighted computer programmes, such as when a lawful possessor of a copy makes copies of the programme for certain purposes (Section aa(i)-(ii) (ab), (ac), (ad), …). Section 52 is expansive and outlines numerous other exceptions.
===== 1.1.2 Application of the CRA 1957 to TDM =====
Generally, the Copyright Act 1957 is vague. The fair dealing exceptions in Section 52 are strict and lack any specific reference to TDM or more generally to the use of copyrighted information to develop a product as such. The Copyright Act 1957 does reference electronic storage and recent technological changes such as, for example, listing the circumvention of “an effective technological measure applied for the purpose of protecting any of the rights conferred by this Act” (Section 65A) as an offence. However, such mentions are limited and still revolve around the (illegal) act of creating a copy of a copyrighted work. Much of the Copyright Act 1957 is focused on the illegal replication of works.

 The Copyright Act’s particular focus has resulted in scholarly opinion that the Act would actually not prohibit TDM despite a lack of explicit fair dealing exception. Dr. Arul George Scaria, Co-Director of the [https://ciipc.org/ Centre for Innovation, Intellectual Property, and Competition (CIIPC) at National Law University in Delhi], has argued for the legality of TDM under Indian copyright law. He [https://spicyip.com/2019/08/should-indian-copyright-law-prevent-text-and-data-mining.html argues that Indian copyright law] only protects the expression of ideas, not facts or ideas themselves. So, when a researcher, for example, uses a copyrighted article in the course of TDM, this should be considered a non-expressive use of the work outside of copyright protection. He goes so far as to argue that it is thus “morally and legally impermissible to allow publishers to use End User Licence Agreements or other contractual tools to restrict researchers from using articles for TDM.” 

Additionally, Dr. Scaria emphasises that India’s copyright regime privileges not only the rights of the creators or copyright holders, but also the users of such works. He references the[https://indiankanoon.org/doc/135895592/ Delhi University Photocopy Shop (Single Bench)] decision, wherein Justice Endlaw states that the rights of persons in Section 52, the fair dealing exception, should not be interpreted narrowly or strictly. The rights given to users should be interpreted on par with those given to creators. Lastly, Dr. Scaria argues that India’s fair dealing regime can provide the flexibility to apply to newer technological developments such as TDM. Whilst Dr. Scaria makes a compelling argument, part of that compelling argument derives from his discussion of TDM as done by researchers, rather than addressing, for example, the use of TDM to train AI for ultimately commercial purposes.

Another case did address TDM for another use, by the state. Whilst this does not explicitly address the use of TDM to train AI, it still provides perspective on how TDM might be understood in the context of India’s regulatory framework. The Supreme Court of India, in the case of [https://indiankanoon.org/doc/127517806/ Justice K.S. Puttaswamy (Retired) vs Union of India and Ors.], recognised TDM’s importance for the state. The Court held that “[TDM] with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the state to insist on the collection of authentic data.” However, this case addressed TDM primarily from a privacy law perspective, rather than copyright; consequently, there still is no litigation that addresses the TDM in a copyright context. This raises further concerns considering the lack of explicit inclusion of a TDM fair dealing exception in Section 52 of the Copyright Act 1957.

As a result, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html likely means of justifying TDM is through Section 52(1)(a) ]which allows for private and personal use of copyrighted works, including for research. This provision is nuanced, wherein the making of copyrighted works publicly available to facilitate private and personal use such as by public libraries could be justified. However, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html Calcutta High Court in 2013] stated that “commercial exploitation” does not fall under “private or personal use,” a position reaffirmed by the Bombay High Court in 2018. Thus, it seems that the main way in which TDM could be justified under India’s copyright regulation is through arguing that TDM does not infringe on the expression of the idea or data, and thus copyright does not apply, as argued by Dr. Scaria.
==== 1.2 Database protection ====
 A newer form of intellectual property rights relates to database protection, which may be relevant when it comes to TDM. India does not have an explicit database right in its intellectual property right regime, but it has recently been subsumed into its copyright regulatory framework. [https://link.springer.com/chapter/10.1007/978-981-10-3984-3_10 The Delhi High Court in Himalaya Drug Company v Sumit] ruled that compilations of databases could be considered literary works and consequently covered by the Copyright Act 1957. This would mean use of compilations of databases in TDM contexts would have to fall under fair dealing exceptions in Section 52 of the Copyright Act 1957. 
==== 1.3 Personal data mining ====
 Another problematic aspect of data mining is the use of [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf personal data]. The source of data used for data mining can be essential, and if the data obtained is not public knowledge or obtained consensually, Indian personal protection legislation might apply. Companies and organizations that do not obtain personal data with permission or [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf discriminate] against individuals based on age, sex, gender, race, or religion are not going to be compliant with local or transnational laws. Specifically in India, data mining in such circumstances is regulated by the [https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf Information Technology Act], 2000 (IT Act) (e.g Article 43A which outlines rules on unauthorized access, sensitive personal data, and information, as well as compensation for failure to protect data), and the [https://www.google.com/url?q=https://www.meity.gov.in/writereaddata/files/Digital%2520Personal%2520Data%2520Protection%2520Act%25202023.pdf&sa=D&source=docs&ust=1732737698777765&usg=AOvVaw0wY-MZ1iAH8P634ZfD2-Vf Personal Data Protection Bill, 2019 (PDP Bill)]. However, some scholars discuss that the production of Privacy Preserving Data Mining Techniques[https://www.researchgate.net/profile/Ahmad-Ahmad-79/publication/375343129_Psychological_Burden_of_Caregivers_of_Children_with_Cancer_at_AL-Amal_Hospital_in_Baghdad_City/links/65476ca9b86a1d521bb8fe8a/Psychological-Burden-of-Caregivers-of-Children-with-Cancer-at-AL-Amal-Hospital-in-Baghdad-City.pdf#page=410 could circumvent] regulation from data protection regulation. This approach is somewhat reflected in the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence], wherein the Indian government recommends investing in privacy-preserving AI research methods to reduce the “risks of data exploitation and personal identification (from an anonymisation dataset).”

=== United States ===
= 1. Text and data mining in the US =
== 1.1. Introduction TDM ==
Text- and data mining is a process used to develop AI models. Data is fed into a model and algorithms are applied to the data. The term TDM is not defined in US Law, but rather as "machine and human- based inputs” under Title 15 Commerce and Trade. Another reference can be found under Machine Learning, which mentions "the ability to automatically learn and improve on the basis of data or experience. 
== 1.2. US definition AI ==
The legal definition of AI originates from the National Artificial Intelligence Initiative Act of 2020, which regulates public bodies' use of AI:"a machine based system that can, for a given set of human-defined objectives, make predictions,  recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems  use machine- and human-based inputs to perceive real and virtual environments; abstract such  perceptions into models through analysis in an automated manner; and use model inference to  formulate options for information or action.”,The legal question is: do any restrictions apply to the use of input such as publicly available text or data in digital form for the purpose of training AI models?To the extent that the input may be protected by copyright, the Copyright Act of 1976 is applicable.To the extent that the input may be pertaining to data created by human behavior, other acts or constitutional rights may apply.To the extent that the use of the data may be unfair or harmful to competition or consumer rights, FTC regulations may apply.
== 1.3. Legal framework ==
=== 1.3.1. U.S. Constitution ===
Patent and Copyright Clause(a.k.a. Patent Clause, the Copyright Clause, and the Progress Clause)The Congress shall have Power ...to promote the Progress of Science and useful Arts, by securing for limited Tımes to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.
=== 1.3.2. Federal Law ===
==== The Copyright Act of 1976 ====
The United States copyright law is contained in the United States Code, chapters 1 through 8 and 10 through 12 of Title 17. The Copyright Act of 1976, which provides the basic framework for the current copyright law.The authority has been granted to the US Copyright Office since 1870. To the extent that “human-based input’ and data can be a product of human work, it may be protected under the constitutional clause which grants an exclusive right to the Author or Inventor.Copyright protection is granted to original works of authorship that are fixed in a tangible medium of expression . The author of the work generally holds copyright ownership generally, a right which she may transfer or license their rights to others. Essential to the copyright protection in the US is the fair use doctrine, which allows for several exemptions for which limited use of copyrighted material is allowed without the author’s permission. Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;(2) the nature of the copyrighted work;(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and(4) the effect of the use upon the potential market for or value of the copyrighted work.The legal discussion regarding TDM in the US is evolving essentially around the application of the exceptions under the legal doctrine of fair use.Following the Executive Order  Executive Order 13859 announcing the American Artificial Intelligence Initiative, the United States Patent and Trademark Office (USPTO) released a report titled “Public Views on Artificial Intelligence and Intellectual Property Policy.” The report consults a wide variety of stakeholder views on the impact of artificial intelligence (AI) across the intellectual property (IP) landscape, including patent, trademark, copyright, and trade secret policy, as well as developing issues about database protection. In this report, the USPTO stated:‘ “The ingestion of copyrighted works for purposes of machine learning will almost by definition involve the reproduction of entire works or substantial portions thereof. Accordingly, whether this constitutes copyright infringement will generally be determined by considering the applicability of the fair use doctrine, an exception set forth in section 107 of the Copyright Act, 17 U.S.C. § 107. Fair use is applied on a case-by-case basis, requiring courts to weigh several statutory factors, and is highly fact-dependent.’  § 102).’The report included the results of a poll among a broad array of public and private stakeholders. The report  showed that the existing legal framework lacks instruments to tackle the challenges of AI. While the majority found the existing U.S. intellectual property laws calibrated correctly to address the evolution of AI (copyright, trademarks, trade secrets, and data fields), some suggested a need for new classes of IP rights. Overall, many agreed that existing commercial law principles (e.g., contract law) might adequately fill any gaps left by IP law in the wake of advances in AI .
==== COPIED ACT bill proposal ====
July 11th 2024 the bipartisan bill was introduced in Congress.Content Origin Protection and Integrity from Edited and Deepfaked Media Act of 2024The bill proposal addresses the new IP issues with respect to content by requiring transparency and content provenance information in an aim to protect artistic content.The intention to establish NIST standards for provenance information seems to open the possibility for remuneration for rights-holders. This would be aligned with the intent of the constitutional right in the Patent and Copyright Clause.
=== 1.3.3. Recent US Court cases regarding TDM ===
NEW YORK TIMES v. OPEN AI INC (2023)The New York Times claimed that OpenAI and Microsoft, as creators of highly profitable generative AI models, did not give credit or remuneration to the New York Times despite relying on their works. The New York Times further alleges that this conduct not only infringes on their intellectual property rights but could also threaten their business model of providing news coverage, analysis and commentary on current events.AUTHORS GUILD v. OPEN AI INC (2024)17 authors argue that OpenAI should have first obtained their permission to use their copyrighted works and now seek a permanent injunction against OpenAI to prevent these alleged harms from reoccurring. The Authors Guild is also seeking damages for the lost opportunity to licence their works and asserts that OpenAI and Microsoft forced them into a position where they unknowingly aided their own market replacement. 
== 1.4. Policy ==
Two executive orders have been released pertaining to the use of AI by public bodies.Executive Order 14110 of October 30, 2023 Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence mentions data as understood in 1.1.Regarding availability of data for training the Executive Order states:(b) …This effort requires investments in AI-related education, training, development, research, and capacity, while simultaneously tackling novel intellectual property (IP) questions and other problems to protect inventors and creators.(e) … The Federal Government will enforce existing consumer  protection laws and principles and enact appropriate safeguards against fraud, unintended bias,  discrimination, infringements on privacy, and other harms from AI. Such protections are especially important in critical fields like healthcare, financial services, education,  housing, law, and transportation, where mistakes by or misuse of AI could harm patients, cost  consumers or small businesses, or jeopardize safety or rights. At the same time, my Administration will  promote responsible uses of AI that protect consumers, raise the quality of goods and services, lower  their prices, or expand selection and availability.(f) Americans’ privacy and civil liberties must be protected as AI continues advancing. Artificial Intelligence is making it easier to extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires. Artificial Intelligence’s capabilities in these areas can increase the risk that personal data could be exploited and exposed. To combat this risk, the Federal Government will ensure that the collection, use, and retention of data is lawful, is secure, and mitigates privacy and confidentiality risks. Agencies shall use available policy and technical tools, including privacy-enhancing technologies (PETs) where appropriate, to protect privacy and to combat the broader legal and societal risks—including the chilling of First Amendment rights—that result from the improper collection and use of people’s data. The Executive Order stipulates the need for  “tackling novel intellectual property (IP) question”, “enforce protection laws and principles”and “enact safeguards against harms from AI” as “AI is making it easier to extract …on sensitive information about people’s identities, locations, habits and desires.” The Executive order acknowledges the need for new policies to not only protects copyrights-holders in the context of AI, but also citizens as their behavioral data are being used to train AI-models.
== 1.5. Enforcement ==
As stated in section 1.1., human-based data may be a broad term, the use of which may violate several laws and regulations.. A certain responsibility  to protect competition in the interest of consumers lies with the FTC. In the case of AI, it may be difficult to assess whether infringement of violations take place.A special enforcement resolution  was issued by the FTC in November 2023,  “ directing use of compulsory process in a non-public investigation of products and services that use or are produced using artificial intelligence or that purport to detect the use of artificial intelligence”. The specific action enables the FTC to start investigations of possible use of AI in violation with Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 to detect unfair, deceptive, anticompetitive,  collusive, coercive, predatory, exploitative, or exclusionary acts or practices in or affecting commerce relating to products and services that use or are produced using artificial intelligence, including but not limited to, machine-based systems that can, for a given set of defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments, or that purport to use or detect the use of artificial intelligence.The proposed bill COPIED act may be instrumental in enabling the AI market to become more transparent, for rights-holders to receive remuneration based on standardized provenance mechanisms.

Module 2: Data

2024-10-09T19:11:29Z

Erikads: /* India */

= Cross-border flows of personal data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
== Brazil ==

=== 1. Introduction ===
Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. 
Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. 
Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.
<div>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" | Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>
Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

=== 2. Broader data protection landscape ===
We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. 

==== 2.1 Constitutional / fundamental rights model ====
Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: 
''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' 
''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''
In 2022, the Constitution was amended to include a specific right to data protection: 
''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{|
|-
| '''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>
|}

==== 2.2 The General Data Protection Law (LGPD) ====
The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:
*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  

==== Scope of Application ====
We have considered the scope of application in three ways: personal, material and territorial. 
*Personal Scope
The LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material Scope
The LGDP applies to any processing operation of personal data. 
::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scope
The LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 
***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).

 
===== Processing of Personal Data =====
Controllers and Processors (Articles 5, 37-40, 42-43) 
*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):
*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.
Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :
*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.
The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== 2.3 Interaction of the Law and the Regulation ====
In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 
*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

=== 3. Substantive detail of cross border data flows ===
Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. 
In no hierarchy, there are various mechanisms that permit international data transfers. 
*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

==== 3.1 When are data transfers allowed? ====
The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 
#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

==== 3.2 Adequacy decisions ====
We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====
Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 
*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).
The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:
I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; and
II - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

==== 3.3 Contractual measures ====
===== Standard contractual clauses =====
The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).
Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | CLAUSE 2. Purpose
2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.
*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:
(NOTE: fill in as much detail as possible with information relating to the international transfer)
|}

<div>

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:</div>
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).

===== Equivalent Standard Contractual Clauses =====
Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.

===== Global Corporate Standards (or Binding Corporate Rules) =====
A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).
*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

 
==== 3.4 Transparency Requirements ====
All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 
#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

== China ==
China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

=== The Cybersecurity Law ===
In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | [https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]
''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''
|}

 Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:
*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

 
=== The Personal Information Protection Law ===
''''''
The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''
''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''
*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:
*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

 
=== The Data Security Law ===
''''''
''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]
The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''
''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''
|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|} 
=== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ===
''''''
A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. 
The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].
Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].
[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.
Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.
Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

 
=== The Digital Silk Road ===
''''''
''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

== India ==
=== 1. Introduction ===
In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).
In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the[https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.

=== 2. Information Technology Act, 2000 ===
Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.
‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.
Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.
‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’
The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 

=== 3. Digital Personal Data Protection Act, 2023 ===
==== 3.1. Scope of Application ====
The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’
The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.
Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.

==== 3.2. Cross-border data transfer ====
Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. 
Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.
It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.
*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.
These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].
Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.
In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

== United States ==
'''No federal 'general consumer' privacy or data protection legislation'''
The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.
In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

Federal level

1. Privacy Act (1974)The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal information
This Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.
The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

2. Executive Order 14117 (February 28, 2024)The 1974 Privacy Act is an older piece of legislation, but there are some more recent developments in the field too. A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).
The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].
Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

3. PADFA (HR 815, Pub. L. 118-50)Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).
While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.
'''Examples of federal sectorial'''''' data protection'''
''' 1. '''Health and medical data (HIPAA)
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).
The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.
With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.
Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].
HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').
''''''

'''2. Financial data privacy (GLB Act)'''The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).
The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.
Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.  
 
The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].
''''''

'''3. Data protection for children (COPPA)'''In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).
As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.
COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.
Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.
COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.
The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation.
 
COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees.
 
'''US State Laws'''
In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

Module 2: Data

2024-10-09T19:10:28Z

Erikads: /* 1.1 Introduction */

= Cross-border flows of personal data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
== Brazil ==

=== 1. Introduction ===
Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. 
Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. 
Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.
<div>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" | Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>
Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

=== 2. Broader data protection landscape ===
We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. 

==== 2.1 Constitutional / fundamental rights model ====
Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: 
''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' 
''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''
In 2022, the Constitution was amended to include a specific right to data protection: 
''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{|
|-
| '''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>
|}

==== 2.2 The General Data Protection Law (LGPD) ====
The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:
*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  

==== Scope of Application ====
We have considered the scope of application in three ways: personal, material and territorial. 
*Personal Scope
The LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material Scope
The LGDP applies to any processing operation of personal data. 
::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scope
The LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 
***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).

 
===== Processing of Personal Data =====
Controllers and Processors (Articles 5, 37-40, 42-43) 
*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):
*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.
Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :
*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.
The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== 2.3 Interaction of the Law and the Regulation ====
In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 
*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

=== 3. Substantive detail of cross border data flows ===
Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. 
In no hierarchy, there are various mechanisms that permit international data transfers. 
*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

==== 3.1 When are data transfers allowed? ====
The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 
#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

==== 3.2 Adequacy decisions ====
We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====
Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 
*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).
The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:
I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; and
II - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

==== 3.3 Contractual measures ====
===== Standard contractual clauses =====
The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).
Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | CLAUSE 2. Purpose
2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.
*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:
(NOTE: fill in as much detail as possible with information relating to the international transfer)
|}

<div>

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:</div>
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).

===== Equivalent Standard Contractual Clauses =====
Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.

===== Global Corporate Standards (or Binding Corporate Rules) =====
A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).
*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

 
==== 3.4 Transparency Requirements ====
All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 
#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

== China ==
China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

=== The Cybersecurity Law ===
In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | [https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]
''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''
|}

 Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:
*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

 
=== The Personal Information Protection Law ===
''''''
The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''
''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''
*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:
*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

 
=== The Data Security Law ===
''''''
''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]
The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''
''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''
|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|} 
=== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ===
''''''
A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. 
The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].
Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].
[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.
Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.
Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

 
=== The Digital Silk Road ===
''''''
''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

== India ==
=== 1. Introduction ===
In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).
In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the[https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.

=== 2. Information Technology Act, 2000 ===
Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.
‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.
Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.
‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’
The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 

=== 1.3. Digital Personal Data Protection Act, 2023 ===
==== 1.3.1. Scope of Application ====
The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.
==== 1.3.2. Cross-border data transfer ====
Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.
*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.
These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

== United States ==
'''No federal 'general consumer' privacy or data protection legislation'''
The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.
In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

Federal level

1. Privacy Act (1974)The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal information
This Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.
The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

2. Executive Order 14117 (February 28, 2024)The 1974 Privacy Act is an older piece of legislation, but there are some more recent developments in the field too. A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).
The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].
Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

3. PADFA (HR 815, Pub. L. 118-50)Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).
While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.
'''Examples of federal sectorial'''''' data protection'''
''' 1. '''Health and medical data (HIPAA)
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).
The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.
With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.
Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].
HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').
''''''

'''2. Financial data privacy (GLB Act)'''The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).
The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.
Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.  
 
The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].
''''''

'''3. Data protection for children (COPPA)'''In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).
As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.
COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.
Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.
COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.
The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation.
 
COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees.
 
'''US State Laws'''
In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

Module 2: Data

2024-10-09T19:10:14Z

Erikads: /* 1.2 Information Technology Act, 2000 */

= Cross-border flows of personal data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
== Brazil ==

=== 1. Introduction ===
Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. 
Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. 
Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.
<div>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" | Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>
Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

=== 2. Broader data protection landscape ===
We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. 

==== 2.1 Constitutional / fundamental rights model ====
Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: 
''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' 
''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''
In 2022, the Constitution was amended to include a specific right to data protection: 
''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{|
|-
| '''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>
|}

==== 2.2 The General Data Protection Law (LGPD) ====
The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:
*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  

==== Scope of Application ====
We have considered the scope of application in three ways: personal, material and territorial. 
*Personal Scope
The LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material Scope
The LGDP applies to any processing operation of personal data. 
::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scope
The LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 
***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).

 
===== Processing of Personal Data =====
Controllers and Processors (Articles 5, 37-40, 42-43) 
*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):
*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.
Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :
*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.
The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== 2.3 Interaction of the Law and the Regulation ====
In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 
*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

=== 3. Substantive detail of cross border data flows ===
Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. 
In no hierarchy, there are various mechanisms that permit international data transfers. 
*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

==== 3.1 When are data transfers allowed? ====
The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 
#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

==== 3.2 Adequacy decisions ====
We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====
Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 
*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).
The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:
I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; and
II - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

==== 3.3 Contractual measures ====
===== Standard contractual clauses =====
The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).
Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | CLAUSE 2. Purpose
2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.
*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:
(NOTE: fill in as much detail as possible with information relating to the international transfer)
|}

<div>

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:</div>
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).

===== Equivalent Standard Contractual Clauses =====
Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.

===== Global Corporate Standards (or Binding Corporate Rules) =====
A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).
*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

 
==== 3.4 Transparency Requirements ====
All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 
#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

== China ==
China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

=== The Cybersecurity Law ===
In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | [https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]
''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''
|}

 Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:
*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

 
=== The Personal Information Protection Law ===
''''''
The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''
''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''
*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:
*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

 
=== The Data Security Law ===
''''''
''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]
The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''
''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''
|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|} 
=== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ===
''''''
A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. 
The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].
Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].
[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.
Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.
Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

 
=== The Digital Silk Road ===
''''''
''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

== India ==
=== 1.1 Introduction ===
In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the[https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.
=== 2. Information Technology Act, 2000 ===
Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.
‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.
Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.
‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’
The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 

=== 1.3. Digital Personal Data Protection Act, 2023 ===
==== 1.3.1. Scope of Application ====
The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.
==== 1.3.2. Cross-border data transfer ====
Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.
*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.
These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

== United States ==
'''No federal 'general consumer' privacy or data protection legislation'''
The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.
In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

Federal level

1. Privacy Act (1974)The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal information
This Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.
The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

2. Executive Order 14117 (February 28, 2024)The 1974 Privacy Act is an older piece of legislation, but there are some more recent developments in the field too. A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).
The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].
Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

3. PADFA (HR 815, Pub. L. 118-50)Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).
While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.
'''Examples of federal sectorial'''''' data protection'''
''' 1. '''Health and medical data (HIPAA)
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).
The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.
With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.
Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].
HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').
''''''

'''2. Financial data privacy (GLB Act)'''The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).
The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.
Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.  
 
The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].
''''''

'''3. Data protection for children (COPPA)'''In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).
As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.
COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.
Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.
COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.
The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation.
 
COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees.
 
'''US State Laws'''
In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

Module 2: Data

2024-10-09T19:09:24Z

Erikads: /* India */

= Cross-border flows of personal data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
== Brazil ==

=== 1. Introduction ===
Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. 
Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. 
Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.
<div>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" | Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>
Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

=== 2. Broader data protection landscape ===
We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. 

==== 2.1 Constitutional / fundamental rights model ====
Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: 
''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' 
''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''
In 2022, the Constitution was amended to include a specific right to data protection: 
''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{|
|-
| '''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>
|}

==== 2.2 The General Data Protection Law (LGPD) ====
The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:
*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  

==== Scope of Application ====
We have considered the scope of application in three ways: personal, material and territorial. 
*Personal Scope
The LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material Scope
The LGDP applies to any processing operation of personal data. 
::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scope
The LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 
***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).

 
===== Processing of Personal Data =====
Controllers and Processors (Articles 5, 37-40, 42-43) 
*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):
*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.
Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :
*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.
The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== 2.3 Interaction of the Law and the Regulation ====
In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 
*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

=== 3. Substantive detail of cross border data flows ===
Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. 
In no hierarchy, there are various mechanisms that permit international data transfers. 
*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

==== 3.1 When are data transfers allowed? ====
The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 
#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

==== 3.2 Adequacy decisions ====
We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====
Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 
*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).
The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:
I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; and
II - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

==== 3.3 Contractual measures ====
===== Standard contractual clauses =====
The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).
Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | CLAUSE 2. Purpose
2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.
*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:
(NOTE: fill in as much detail as possible with information relating to the international transfer)
|}

<div>

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:</div>
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).

===== Equivalent Standard Contractual Clauses =====
Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.

===== Global Corporate Standards (or Binding Corporate Rules) =====
A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).
*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

 
==== 3.4 Transparency Requirements ====
All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 
#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

== China ==
China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

=== The Cybersecurity Law ===
In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | [https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]
''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''
|}

 Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:
*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

 
=== The Personal Information Protection Law ===
''''''
The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''
''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''
*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:
*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

 
=== The Data Security Law ===
''''''
''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]
The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''
''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''
|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|} 
=== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ===
''''''
A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. 
The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].
Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].
[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.
Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.
Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

 
=== The Digital Silk Road ===
''''''
''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

== India ==
=== 1.1 Introduction ===
In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the[https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.
=== 1.2 Information Technology Act, 2000 ===
Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 
=== 1.3. Digital Personal Data Protection Act, 2023 ===
==== 1.3.1. Scope of Application ====
The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.
==== 1.3.2. Cross-border data transfer ====
Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.
*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.
These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

== United States ==
'''No federal 'general consumer' privacy or data protection legislation'''
The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.
In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

Federal level

1. Privacy Act (1974)The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal information
This Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.
The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

2. Executive Order 14117 (February 28, 2024)The 1974 Privacy Act is an older piece of legislation, but there are some more recent developments in the field too. A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).
The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].
Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

3. PADFA (HR 815, Pub. L. 118-50)Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).
While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.
'''Examples of federal sectorial'''''' data protection'''
''' 1. '''Health and medical data (HIPAA)
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).
The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.
With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.
Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].
HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').
''''''

'''2. Financial data privacy (GLB Act)'''The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).
The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.
Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.  
 
The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].
''''''

'''3. Data protection for children (COPPA)'''In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).
As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.
COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.
Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.
COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.
The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation.
 
COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees.
 
'''US State Laws'''
In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

Module 1: Infrastructures

2024-10-03T13:52:06Z

Erikads: /* References */

== Net Neutrality and Zero-ratings ==
[https://eur-lex.europa.eu/EN/legal-content/glossary/open-internet-and-net-neutrality.html#:~:text=Net%20neutrality%20is%20the%20principle,%2C%20blocking%2C%20throttling%20or%20prioritisation Net neutrality] is the principle that internet service providers (ISPs) treat all online traffic equally and openly, without discrimination, blocking, throttling or prioritisation. [https://www.berec.europa.eu/en/what-is-zero-rating Zero-rating] is a commercial practice whereby an internet access provider applies a zero tariff, or a tariff that is more advantageous, to all or part of the data traffic associated with an application or category of specific applications, offered by partners of that access provider.

=== Brazil ===
====The legal framework and relevant regulatory actors for telecommunications in Brazil====
The national government of Brazil is competent to organize, regulate and investigate the telecommunication sector. This competency is laid down in Law No. 9472/1997, the General Telecommunications Law. The telecom sector should be organized and based on free, broad and fair competition, according to this law. Brazil has no strict limitations on foreign ownership on telecommunication service providers, other than that such companies ought to be organized in accordance to Brazilian law.
=====Anatel=====
The General Telecommunications Law also established the Brazilian national telecom authority, Anatel. Its main tasks are:
* construct policies for granting, providing and using telecommunication services in both the public and private sector
* implement national policies for telecommunications sector, issued by the Brazilian government
* conduct investigations
* issue sanctions for violating provisions in the telecom legislative framework
Most regulation of telecommunications services in Brazil is ex ante, and some provisions also look at the regulation of competition aspects for the market. More specifically Anatels resolution No. 600/2012 provides several guidelines for:
* competition aspects;
* measures concerning transparency, isonomic and non-discriminatory treatment;
* price control;
* the obligation of access and provision of specific network resources;
* the offer of wholesale products according to conditions set by such agency;
* obligations aimed to remedy specific market failures or to comply with the legal and regulatory rules in force; and
* accounting, functional or structural separation.
=====The Brazilian Internet Steering Committee=====
The Brazilian Internet Steering Committee (CGI.br), coordinates and integrates all Internet service initiatives in Brazil, promotes technical quality, innovation, and dissemination of Internet services. Its main tasks include:
* propose policies and procedures regarding regulation of Internet activities;
* recommend standards;
* establish strategic directives;
* coordinate allocation of Internet addresses and registration in the .br domain.
Anatels regulatory parameters and guidelines, which are in turn established by Brazil’s Internet Steering Committee (CGI.br)

=====CADE=====
Another important regulatory body in Brazil is CADE (Administrative Council for Economic Defence), which is the national antitrust authority. For some competition aspects of Anatels regulation, CADE may need to analyse and approve Anatels work, according to Law No. 12,529/2011.
=====The Internet Law (2014)=====
In 2014, the Internet Law was created (Law No. 12.965/2014). This piece of legislation sets out specific conditions and standards for net neutrality and zero-rating. More specifically, preserving and ensuring net neutrality is one of its core principles for using the internet in Brazil (Article 3). Net neutrality is further addressed in article 9, which states that the party in charge of the transmission, switching or routing has the duty to process any conveyed information in a neutral manner. As a result, throttling (intentionally slowing down the speed of a service) is also not allowed. There are some exceptions to this rule, for instance when internet traffic discrimination is necessary for technical reasons or to prioritise emergency services (Article 9). For instance, during the COVID-19 pandemic, mobile network operators were requested to provide zero-rating access for all mobile plans to health applications.
In such exceptional situations, service providers have to take in account some precautions to:
* not cause damage to users
* act with proportionality, transparency and equality to the internet traffic
* inform users pre-emptively in a clear and transparent manner, and take traffic management, mitigation practices and network security into account
* offer services in a non-discriminatory manner for commercial use, and;
* refrain from anticompetitive conduct (Art. 9)

=====Subsequent Decree (2016)=====
In 2016, Law No. 12.965/2014 was complemented by Decree 8871/2016. This Decree specifies technical requirements for the adequate provision of services and applications. These technical requirements shall aim to maintain their stability, safety, integrity, and functionality which arise from:
* Addressing network security issues, such as restriction of mass mailings (spam) and control of denial of service attacks; and
* Handling of exceptional congestion situations of networks, such as alternative routes in cases of main route interruptions and emergencies.

According to article 6 of the decree, such technical measures have to be consistent with international standards and should be in accordance with Anatels regulatory parameters and guidelines, which are in turn established by Brazil’s Internet Steering Committee (CGI.br). On a more technical level, article 9 and 10 of the Decree reinforce net neutrality and the prohibition of anti-competitive treatment of online service providers (i.e. zero-rating). The decree regulates the commercial relationships between the infrastructure operator and actors in the ‘logical’ layer, who cannot “compromise the public and unrestricted nature of Internet access,” “prioritize data packets due to commercial arrangements,” or favor applications offered by the infrastructure operator itself. In short, the decree prohibits zero-rating strategies and determines that content companies must have legal headquarters in Brazil.”

=====Zero-rating allowed after all?=====
However, the zero-rating prohibition was challenged, and successfully so, in 2017. What happened was that an alleged violation of net neutrality was taken by the Public Prosecutor’s Office to CADE, Brazil’s anti-trust authority. The complaint constituted that four major mobile network operators, namely, Claro, Oi, TIM Brasil and Telefônica Brasil, who control almost the entire market, had supposedly adopted discriminatory commercial practices. They were accused of offering their users data plans that differentiate the conditions of access to certain Internet services, through the charging of reduced amounts or even the total exemption from charge (i.e. zero-rating). In another model, called "sponsored access", the holder of the application supposedly remunerates the provider for the data traffic generated by its users. The complaint was that such offers to access apps without consumption of data franchising were a violation of the Brazilian Civil Rights Framework for the Internet. Anatel was notified of this complaint, but was of the opinion that this did not constitute a violation of the relevant provisions in the Internet Law (No. 12.965/2014). Their reasoning was that zero-rating is allowed, as long as it applies to the same class of services. Following Anatel's view on the matter, according to which the zero rating "has economic rationality and generates, undeniably, noticeable well-being via consumer and producer surplus", CADE decided to consider that zero rating should not be prohibited ex ante. CADE stated that these offers are “not expressly prohibited, not discriminatory, provide free access under the same conditions, and that, in practice, they would not have an adverse impact on market concentration.” PROTESTE, a consumer rights group, appealed this decision, “arguing that CADE did not consult with other actors and that, for example, in the case of pre-paid plans, these are used by lower-income sectors, and, since there are mostly zero-rating offers with Facebook and WhatsApp, the aspect of competition and market concentration regarding applications becomes fragile and unfounded.”

This decision was heavily protested by the Brazilian Civil Rights Framework for the Internet Watch. Their view of zero-rating in this case was that (direct quote:) “By subsidizing some applications and creating a fee - that is, the consummation of the franchise - to access the others, zero rating practices can transform the nature of the Internet from a general purpose network, whose modalities of use are defined autonomously by each user, into a network whose purposes are established in a centralized manner by operators. Such an evolution would limit users' Internet experience, discouraging them from venturing beyond the services provided to them free of charge, and would greatly limit the ability to create and disseminate new applications and introduce new competitors to the market. Clearly, this scenario is opposite to what the principle of neutrality aims to promote.” In short: the window for innovation would shrink as a direct result of a more competitive market because certain applications are offered through zero-rating. Moreover, the civil rights group claims, Zero rating practices increase the well-being of the consumer of the services included in the zero rating plans, as well as the providers of these services. They do not increase the well-being of the Internet access consumer, whose choice is dramatically reduced, nor of service providers excluded from the zero rating.

====The Brazilian telecommunications market and its regulation====
=====About operators=====
In Brazil, there are four main operator groups that dominate the mobile telecom market: Telefónica (33,60%), América Móvil (22%), Oi (15.70), and Telecom Italia. The market seems to follow a pro-competitive model. Oi, the fourth-largest operator, provides zero rating for almost all of their plans, but this has not led to significant market growth.

=====About internet usage among the population and costs=====
Most people in Brazil use their mobile phone to access the internet. Since 2016, there has been a steady growth in the coverage of the 4G network (66.68% in 2016 compared to 92.36% in 2022), the number of mobile cellphone and broadband subscriptions, and the percentage of Wi-Fi connection time for mobile Internet users has also increased (from 58.55% in 2016 to 68.2% in 2022). In 2022, the most used mobile social networks in Brazil were, in order, WhatsApp, Instagram, Facebook, TikTok and Facebook Messenger. (p.12) The price of roaming in Brazil has steadily decreased since 2017. This is mostly due to a higher number of operators and a good deployment of 4G mobile access networks. It led to a reduction in access costs, especially for mobile broadband. The affordability is mostly calculated as a percentage of average income, where the aim is that the price of 1 GB of data should not exceed 2% of a person’s average monthly income (the so-called “1 for 2” limit).

Brazil has also seen an increase in app development and digital skills. This, according to one article on the topic, is likely due to a high level of naitonal technological innovation capacity. The article therefore questions whether zero-rating is a risk for the digital market, although it could still pose a risk to the content sector.

=====About zero-rating=====
Generally, in South America, zero-rating is a dominant commercial strategy. The main zero-rating models that are deployed by MNOs, which are promoted by the operators themselves. “They also offer some vertically integrated, lower-cost Internet services, with the same operators providing their own and third-party content, such as messaging and calls (WhatsApp, Line, Messenger), music (Spotify, Deezer), and video (YouTube, Movistar Play, ClaroTv, Oi Play, Amazon Video, and Netflix).”

=====Effects of net neutrality and zero-rating on the market competition in Brazil=====
In general, and in comparison, to other countries in the region, the impact of zero-rating on network neutrality and competition in Brazil is a bit complex. On the one hand Brazil’s mobile markets are less concentrated than its neighbors’, implying more competition in the MNO market. On the other hand, smaller and local app development and content is limited due to the zero-rating of major applications by major MNOs. Zero-rating thus creates certain barriers of entry for smaller competitors. Furthermore, MNOs may also apply zero-rating to their own applications (vertical integration), as long as they don’t discriminate against apps developed by others in the same field. These negative effects are, nevertheless, may be somewhat mitigated by Brazil’s competitive market and government emphasis on digital skills development. Still, the research found no positive relationship between zero-rating and increased mobile access or lower prices.

====Sources used====
* OECD, Digital Trade Review of Brazil (OECD 2022) <https://www.oecd-ilibrary.org/trade/digital-trade-review-of-brazil_0b046dfe-en> accessed 24 September 2024.
* Miguel Botto-Tobar, Henry Cruz and Angela Díaz Cadena (eds), ‘Artificial Intelligence, Computer and Software Engineering Advances: Proceedings of the CIT 2020 Volume 1’ (Springer International Publishing 2021) <https://link.springer.com/10.1007/978-3-030-68080-0> accessed 24 September 2024.
* Roberto Triviño, Antonio Franco and Rafael-Leonardo Ochoa-Urrego, ‘Evaluating Zero Rating: A Comparative Analysis of Four South American Countries’ (2024) 5 Digital Government: Research and Practice 1.
* Website: Observatorio do Marco civil da Internet (05/12/2017). Accessed 24/09/2024: https://www.omci.org.br/jurisprudencia/207/neutralidade-de-rede-e-ordem-economica/
* UNESCO, Assessing internet development in Brazil. Using UNESCO internet universality ROAM-X Indicators.
* Law No. 12,965, April 23, 2014 (Marco Civil Law of the Internet in Brazil)
* Decree No. 8771, May 11, 2016
* Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November 2015 laying down measures concerning open internet access and amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services and Regulation (EU) No 531/2012 on roaming on public mobile communications networks within the Union (the Open Internet Regulation)
* Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast)

=== China ===

China follows a governmental control model for internet and telecommunications regulation. Under this model, the government has control of all aspects of the internet, including who is allowed access, what content is accessible, and the rate of delivery of that content. China can be considered as the most controlling jurisdiction of internet content and is not in support of network neutrality. Access to the internet in China from the outside world is limited and all Internet traffic in China must pass through one of three large computer centers in Beijing, Shangai and Guangzhou. The Chinese government maintains control over China’s gateways to the global internet, giving authorities the ability to cut off cross-border information requests in order to restrict connectivity or access to content hosted on servers outside the country. This arrangement is the foundation for the ‘Great Firewall’, which is considered the world’s most sophisticated internet censorship program.

Another strategy for control of the internet in China is that state-owned companies dominate the ISP sector of the mobile market: China Mobile, China Telecom, and China Unicom. In 2019, British Telecom (BT) became the first foreign telecommunications company to receive permission to provide internet services across the country. Authorities exercise tight control over cybercafes and other public access points, which are licensed by the Ministry of Culture in cooperation with other state entities.

Another key part of the regulation of the telecommunications sector in China is content management, or censorship. This is not the focus of this Wiki. We address elements of cybersecurity or censorship laws as they relate to the infrastructure elements of the telecommunications sector in China (such as from the Cybersecurity Law 2017). Accordingly, the law we focus on here is the '''Telecommunications Regulation 2000'''. Before we jump into the legal framework, we explain first the policy context and then the market structures.

===== Policy Context =====
Chinese internet policy shows distinct features at different stages, heavily influenced by the political thinking and outlook of the leadership at the time as well as China’s social, economic and political conditions.

The early phase, before a period of reform in the 1980s, saw telecommunications under strict state control, with limited infrastructure and services primarily serving governmental needs. Post-1980s economic reforms introduced a gradual liberalisation, allowing room for infrastructural growth and services expansion. This led to the implementation of the Telecommunications Regulation in 2000, establishing a legal framework that aimed to separate government functions from business operations, reduce monopolistic practices, and promote competition and innovation (Article 4). The turn of the millennium saw a rapid acceleration in policy evolution market competition, marked by China's accession to the World Trade Organization ('''WTO''') in 2001.

Before 1998, the telecommunications regulator was the Ministry of Posts and Telecommunication (MPT). Until 1994, the MPT was instrumental in promoting the development of the Chinese telecommunications sector. During this period, the telecoms industry was monopolized and there was no clear distinction between the functions of government and enterprises. From 1998, competition has been introduced into the telecom market, with the creation of a second communications network operator, China Unicom. The second stage started with the establishment of Ministry of Information Industry (MII) in 1998. It became the principal regulator of the telecommunications and information industry and was initially granted operational control over both China Telecom and China Unicom. During 1999 and 2000, China Telecom and China Unicom were restructured to promote greater competition, creating a total of seven distinct Chinese state-owned telecommunications providers each with primary operations in a different functional aspect. Yet, given the relatively low accessibility of telecommunications to the Chinese population, Chinese telecommunications policy remained oriented towards the development of telecommunications infrastructures. With the adoption of the Telecommunications Regulation in 2000, telecommunications regulation entered the stage of regulation according to laws, and a regulatory framework has been established.

The situation shifted in in 2001 with China admission to the WTO. Obligations under the WTO required China to adopt telecommunications regulations to introduce and promote market competition, to protect the rights and interests of consumers and to increase the welfare of consumers. This era led to further reforms, including the restructuring of state-owned enterprises (SOEs), the introduction of foreign investment in the telecommunications sector, and an emphasis on digitalisation. Establishment of MIIT (ministry of Information Technology in 2008, the Antimonopoly Law (AML) was finally adopted in 2007 and became effective in 2008. Similar to competition rules in other jurisdictions, the AML also prohibits anti-competitive agreements (Chapter II), abusing dominant positions (Chapter III), and anticompetitive mergers (Chapter IV).

===== Net Neutrality in China and the Great Firewall =====
A key part of the regulatory framework of the internet in China is the Great Firewall. Although the Great Firewall is inherently content moderation, not specifically related to net neutrality, it is important to understand in order to view internet regulation through the norms of the Chinese political framework.

The Great Firewall controls how internet content is distributed to citizens; what they can and cannot access. While the principle of net neutrality suggests citizens should be able to access different products on the internet without discrimination, the Great Firewall imposes this discrimination as government policy. In other words, net neutrality is not a principle considered in Chinese internet policy, and the policy position is pro-discrimination via content management in the name of national security.

The Great Firewall means that any new domain or platform which wants to enter Chinese cyberspace must adhere to domestic regulations. Consequently, domains that do not adhere to domestic regulations are banned; Facebook, Twitter, YouTube, Wikipedia, and Instagram.

Technologically, the Great Firewall is made up of two software’s:
# Last mile providers of internet services to consumers automatically filter suspicious references, also considered access requests; and
# ISPs implement filters that blocked Chinese websites, also called interconnecting networks.

The GFW relies on filtering methods like blocking Internet Protocol (IP) address, Transmission Control Protocol (TCP) packet filtering and forging, Domain Name System (DNS) spoofing, redirection, and filtering Uniform Resource Locator (URL) by transparent proxies.

The implication of this system is that net neutrality - the equality of access by citizens to different parts of the internet - is not a consideration, as discrimination of content to “advance the dissemination of core socialist values” (Art 6, CSL) is inherent in the internet policy of the state in the name of cyber security.

==== Telecoms Regulation in China ====
The Chinese government structures its regulations to control political risks through carefully designed institutional arrangements, control of network operation, and tight regulations on end-users.
The legal foundation of telecommunication regulation is stated in China’s State Council Order 195, ‘Interim Regulations on International Interconnections of Computer Information Networks in the PRC’. (PRC meaning People’s Republic of China.) Order 195 granted the Steering Committee on National Information Infrastructure, part of the Ministry of Information Industry, primary regulatory responsibility for China’s internet, which includes determining and coordinating important issues of international interconnections.

:: ''Primary telecoms regulator: Steering Committee on National Information Infrastructure''

In the internet server provision sector, Order 195 divides China’s Internet networks into two categories:
# interconnecting networks and
# access networks.

====== ''Interconnecting networks'' ======
: Interconnecting networks are directly linked to the global internet through international leased lines and must have the approval of the State Council in order to operate. These interconnecting networks assume heavy and important responsibilities of internet regulation, including responsibility for online content blocking and filtering.
: In this area, only four licences have been granted - CERNet and CSTNet and ChinaNet and ChinaGBN. These four interconnecting networks are tied closely to government agencies. ChinaNet is operated by China Telecom, which falls under control of the Ministry of Information Industry (MIIT).

====== ''Access networks'' ======
: The Chinese access networks are the equivalent of internet service providers (ISPs), providing access and content services but no direct global interconnection. An access network provider has to be licenced by and gain global access through one of the four interconnecting networks. ISPs are key to filtering the huge number of sensitive words on the blacklist. In such circumstances, Chinese ISPs are more political than commercial.

: In summary, the provision of internet to consumers resembles:

:: Global internet ➡ Interconnecting network ➡ Access Network ➡ Consumer

==== Telecommunications Regulations ====
The Telecommunications Regulations, first issued in 2000 and then revised in 2016, covers licensing, fee collection, interconnectivity, operation and regulation of telecoms services in mainland China. The Classified Catalogue of Telecommunications Services, effective from 1 March 2016, sets out the specific and categories of services that are regulated under the telecommunications licensing regime. These regulations provides general regulations on domestic telecommunication services, including the licensing of telecommunication services, the provision of telecommunication services, the construction of telecommunications facilities and telecommunications security.

The aim of these regulations are to regulate the order of the telecommunications market, safeguard the legitimate rights and interests of telecommunications subscribers and operators, ensure the safety of telecommunications networks and information, and to promote the sound development of telecommunication industry (article 1). The regulations are addressed to anyone that engage in telecommunications activities or telecommunications-related activities (article 2). Article 4 provides that the supervision and regulation of the telecommunications industry shall be based on the principles of separation of government administration from enterprise management, elimination of monopoly, encouragement of competition and innovation, as well as principle of openness, fairness and impartiality. Under article 5, telecommunications operators shall provide telecommunication subscribers with services that are fast, accurate, secure, convenient and reasonably-priced.

The Telecommunications Regulation is mainly comprised of two substantial chapters for the purpose of promoting competition.

====== ''Licencing scheme'' ======
: As far as market entry is concerned, a two-layer authorisation mechanism is established based firstly on services and secondly on geographic coverage. In terms of services, Category I of basic telecom services and satellite facilities (Category II of basic telecom services) are exclusively licensed by the Ministry of Industry and Information Technology (MIIT), and are so far only awarded to the three SOEs. With regard to other telecom services, intra-provincial operation licenses are administered by provincial-level telecom authorities while inter-provincial ones are authorised by the MIIT.

====== ''Cybersecurity Law'' ======
: The Cybersecurity Law (CSL) establishes the overarching security framework relevant to internet traffic in China, including the governing of internet infrastructure (Art 2 CSL). To safeguard data sovereignty, the CSL imposes data localisation requirements on critical information infrastructure operators. Other relevant obligations in the CSL are:

:: * Article 9: Network operators shall, when conducting business operations and providing services abide by laws and administrative regulations, respect social morality, observe business ethics, operate in good faith, perform their obligations to safeguard cybersecurity, accept supervision by the government and the public, and undertake social responsibilities.
:: * Article 12: The State shall protect the rights of citizens, legal persons and other organisations to use networks in accordance with the law, promote improved network access, provide better network services, provide the public with secure and convenient network services, and guarantee the lawful, orderly and free circulation of network-based information.

: It is unclear what is meant by reference to ‘social morality’ and ‘business ethics’, but that we view this through the prism of Chinese international relations and our understanding of societal values - essentially connecting these ideas to community, state-first control of information. This is not translatable to European norms associated with fundamental rights and the single internal market.

==== Other related legislation ====
Other related legislation includes:
* State Council - Regulations on Security Protection of Computer Information Systems, Administrative Measures for Internet Information Services
* The national intelligence law
* Ministry of Public Security - Administrative Measures for Prevention and Treatment of Computer Viruses
* Ministry of Public Security and five other ministries - Administrative Measures for Hierarchical Protection of Information Security
* NPC Standing Committee - Law on Guarding State Secrets

==== Sources ====

The above information is based on our consideration of the Telecommunications Regulations, Cybersecurity Law and the following secondary sources:
* Hu, Henry L. “The Political Economy of Governing ISPs in China: Perspectives of Net Neutrality and Vertical Integration.” The China Quarterly, Volume no. 207 (2011) 523–40. Available here: http://www.jstor.org/stable/41305255
* Pranavnayar 'The Legality of China’s Great Firewall: How Does the International Law Fare' Metacept 6 June 2021 <https://metacept.com/the-legality-of-chinas-great-firewall-how-does-the-international-law-fare/
* Christine M. Stover, ‘Network Neutrality: A Thematic Analysis of Policy Perspectives Across the Globe’ [2010] Global Media Journal Volume 3(1) pp. 75-86
* Bernd Holzenagel, Xu Junqi and Thomas Hart, ‘Regulating Telecommunications in the EU and China: What Lessons to be Learned?’ Arbeitsberichte Zum Informations-, Telekommunikations- Und Medienrecht Volume 16 [2009]
* Martyn Taylor, ‘Reforming China’s telecommunications law: lessons from the Australian experience’, International Journal of Communications Law and Policy Issue 7 [Winter 2002/2003]
* Becky P Y Loo, ‘Telecommunications reforms in China: Towards an analytical framework’ Telecommunications Policy 28 [2004] pp 679-714
* Report from US Embassy Beijing [2024] Available at: https://irp.fas.org/world/china/netreg.htm
* Zixiang Alex Tan, ‘Regulating China’s Internet: convergence toward a coherent regulatory regime’ Telecommunications Policy Volume 23, Issues 3-4, [1999] pp. 261-276
* Grace Wang, ‘Telecoms regulations in China’ Lexology [2022] Available at: https://www.lexology.com/library/detail.aspx?g=c8e8fd3d-4989-4db0-8887-45fd7a86f1a5
* Liyang Hou, ‘When competition law meets telecom regulation: the Chinese context’ Computer Law and Security Review 31(5) [2015]

=== India ===

The Indian regulatory framework currently features a strong commitment to net neutrality and a ban on zero rating. The development of this framework, however, cannot be understood without due attention paid to the legislative players in India and the context of the proliferation of zero rating services in 2015. Consequently, this section outlines the regulatory authorities responsible for telecommunications regulation in India, the resulting regulatory framework relating to net neutrality and zero-rating, and further challenges to net neutrality and food for thought.
India has a Department of Telecommunications (DoT) which is responsible for setting out its telecommunications policy. Under section 3 of the Telecom Regulatory Authority of India Act by the DoT, the Telecom Regulatory Authority of India (TRAI) was established as a statutory body of the DoT.

===== Zero rating: Facebook's "Free Basics Ban" =====

The debate on net neutrality followed primarily from the debate on the zero rating due to the proliferation of zero rating packages in 2015, the most notorious of which included Facebook’s “Free Basics” service and Airtel’s zero rating platform for app developers. In India, only around 50% of the population purchased data plans for their smartphones, and out of those who used it, it was shown that the average data package used was around 80MB per month in 2015. Therefore, due to the small data packages, zero rating was an attractive and reliable service.
The problem arose with the introduction of Facebook's zero rating model with Internet Access Providers, which included a service called Internet.org, which despite its misleading name offered exclusively Facebook services free of charge under the “Free Basics” model. Internet.org was meant to be an open platform that gives Indian developers additional services offered for free, used by those users who could not afford traditional internet access. Nevertheless, only partner websites and applications would be able to be included, ultimately going against the principles of net neutrality.
As a result of the misleading and untransparent, in 2016, TRAI published the “Prohibition of Discriminatory Tariffs for Data Services Regulations, 2016” which prohibited zero rating. Article 3 of the aforementioned regulation outlines this prohibition, whilst Article 4 stipulates a potential derogation for providing emergency services “or at times of grave public emergency.” However, the telecom provider must notify this reduced tariff to TRAI and the authority’s decision on its compliance with the Discriminatory Tariffs Regulation is final.

===== Net neutrality =====

The ban on zero rating was followed up with an overarching debate on net neutrality. Both TRAI and a Committee under the DoT consequently released papers advocating for the adoption of net neutrality principles throughout telecommunication legislation. As a result, the DoT signed off on TRAI’s recommendation to wholly support net neutrality principles and amended numerous parts of its core telecommunication legislation to integrate such principles. In 2018, the DoT amended the “Unified License for Telecom Service Providers (TSPs) and Unified License (Virtual Network Operators) and Unified Access License Agreement to incorporate the principles of non-discriminatory treatment of content.” In 2019, further amendments occurred regarding the Internet Service Provider License for Regulatory Framework. Some exemptions are present regarding the principles of non-discriminatory treatment of content and/or traffic for when “quality of service is essential,” such as in the cases of autonomous vehicles.
Despite these net neutrality principles, there remains the problem of the Indian government’s ability to legally order ISPs to block access to certain content, either for its own purposes or due to court orders. Whilst India’s net neutrality principles do not presuppose such government requests as violations per se, the problem lies in the perceived clash between the legislative provisions. For example, such government orders would be permissible as long as the measures adopted by the ISP are “proportionate, transient, and transparent;” however, the rules regarding the blocking of content stipulate a legal requirement to maintain the confidentiality of blocking requests and subsequent actions.

==== Opposition to net neutrality ====

Additionally, some scholars critique India’s strict approach to net neutrality due to the rapid developments in the internet space. For example, “complexities such as vertical partnerships between [internet service providers (ISPs)] and [content and application providers],” content delivery networks, and the deployment of 5G show the limits of India’s ex-ante net neutrality approach. As a result, further ex-post enforcement may be necessary to bolster net neutrality in India.

In sum, India’s regulatory framework started with a ban on zero rating as a result of controversy arising from the proliferation of zero rating with services such as Facebook’s “Free Basics.” This later erupted in a political debate on whether India should, as a result, commit fully to net neutrality, which was ultimately answered in the positive when the DoT implemented TRAI’s recommendations throughout India’s various telecommunications regulations. However, criticisms remain about the limited exceptions to net neutrality rules, and the Indian government’s eager censorship through blocking requests to ISPs may still pose threats to a free internet in India.

==== Sources ====

* The Telecom Regulatory Authority of India Act [1997] 199724 <https://www.indiacode.nic.in/handle/123456789/1929>.

* Jon Russel, ‘Under Fire In India, Facebook’s Internet.org Launches In Indonesia’ (TechCrunch, 2015) <https://techcrunch.com/2015/04/20/internet-dot-org-indonesia/>.

* Parmy Olson, ‘This App Is Cashing in on Giving the World Free Data’ (Forbes, 29 July 2015) <https://www.forbes.com/sites/parmyolson/2015/07/29/jana-mobile-data-facebook-internet-org/>, cited in Luca Belli, ‘Net Neutrality Reloaded: Zero Rating, Specialised Service, Ad Blocking and Traffic Management’ (2016) Annual Report of the UN IGF Dynamic Coalition on Net Neutrality.

* Lok Sabha Secretariat, ‘Net Neutrality: India's Position,’ (Parliament Library And Reference, Research, Documentation And Information Service, 2016) Reference note No.6/RN/Ref./February/2016.

* Prohibition of Discriminatory Tariffs for Data Services Regulations [2016] <https://trai.gov.in/sites/default/files/Regulation_Data_Service.pdf>.

* Ministry of Communications, ‘Net Neutrality in India’ (Press Release 1884064, 2022) <https://pib.gov.in/PressReleasePage.aspx?PRID=1884064>.

* Shruti Dhapola, ‘Net Neutrality rules approved by government; Internet to remain free and open in India’ (The Indian Express, 2018)<https://indianexpress.com/article/technology/tech-news-technology/net-neutrality-rules-now-approved-by-telecom-commission-india-internet-timeline-5256139/>

* BBC, ‘India adopts 'world's strongest' net neutrality norms’ (BBC, 2018) <https://www.bbc.com/news/world-asia-india-44796436>.

* The Wire Staff, ‘India Approves New Net Neutrality Rules, Signs off on New Telecom Policy’ (The Wire, 2018) <https://thewire.in/tech/india-approves-new-net-neutrality-rules-signs-off-on-new-telecom-policy>.

* Smriti Parsheera, ‘Net neutrality in India: From rules to enforcement’ (Medianama, 2020) <https://www.medianama.com/2020/05/223-net-neutrality-india-rules-enforcement/>.

* Raghuvansh Seth, ‘Fleeting neutrality: The inadequacies of the ex-ante net neutrality regulations in India’ (2022) 23 Competition and Regulation in Network Industries 1.

=== United States ===
==== Federal Regulatory Framework ====
To the extent that Internet Service Providers (ISPs) are regulated by the United States (US) Congress, it is under the '''[https://en.wikipedia.org/wiki/Communications_Act_of_1934 Communications Act of 1934]''', as amended by the '''[https://en.wikipedia.org/wiki/Telecommunications_Act_of_1996 Telecommunications Act of 1996]'''.

Pursuant to Sec. 1, the purpose of this Act is to regulate
:‘interstate and foreign commerce in communication by wire and radio so as to make available, so far as possible, to all the people of the United States [...] a rapid, efficient, Nation-wide, and world-wide wire and radio communication service with adequate facilities at reasonable charges’.
Sec. 230(b) outlines the policy specifically with respect to the Internet. It is, inter alia, ‘to promote the continued development of’ and ‘to preserve the vibrant and competitive free market for’ the Internet.

Pursuant to Sec. 2(a), this Act applies ‘to all interstate and foreign communication by wire or radio[, and] transmission of energy by radio, [...] and to all persons engaged’ in such pursuits. It also applies ‘to all persons engaged [...] in providing [cable] service’.

To ensure the ‘effective execution of this policy’, Congress created the Federal Communications Commission (FCC) under the Communications Act of 1934.

Yet, the Commission’s authority to regulate the addressees of this Act depends crucially on whether they fall under Title I (‘information service’) or Title II (‘common carrier service’). Common carrier services are expressly prohibited from granting preferential treatment:
:‘It shall be unlawful for any common carrier to make any unjust or unreasonable discrimination in charges, practices, classifications, regulations, facilities, or services for or in connection with like communication service, directly or indirectly, by any means or device, or to make or give any undue or unreasonable preference or advantage to any particular person, class of persons, or locality, or to subject any particular person, class of persons, or locality to any undue or unreasonable prejudice or disadvantage.’
To ensure reasonable pricing rates and non-discriminatory practices, the Communications Act of 1932 grants the FCC broad regulatory authority under Title II. In contrast, Title I services remain mainly unregulated by the FCC.

However, the term ‘information service’, which is defined as ‘the offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making available information via telecommunications’ [sic!], and the term ‘common carrier service’, which is defined as a person ‘engaged as a common carrier for hire’, in any of the pursuits mentioned above, are ambiguous when it comes to ISPs.

So far, the FCC has been responsible for the interpretation of these terms, as affirmed by the Supreme Court in ''National Cable & Telecommunications Association v. Brand X Internet Services'' (2005).

As the Commission’s Commissioners are ‘appointed by the President, by and with the advice and consent of the Senate’, the Commission’s stance on the classification of ISPs and the corresponding regulatory regime has always depended on the administration in power. This has led to relatively frequent shifts in administrative practice in the past.

During the Obama administration (2009-2017), the FCC classified ISPs as Title I services and introduced net neutrality principles in the '''[https://en.wikipedia.org/wiki/Federal_Communications_Commission_Open_Internet_Order_(2010) FCC Open Internet Order 2010]'''. However, the Court of Appeals for the District of Columbia Circuit in ''Comcast Corp. v. FCC'' (2010) and ''Verizon Communications Inc. v. FCC'' (2014) ruled that the FCC lacked the authority to enforce these principles on Title I services. Thus, the FCC reclassified ISPs under Title II in the '''[https://docs.fcc.gov/public/attachments/FCC-15-24A1.pdf FCC Open Internet Order 2015]''', enshrining net neutrality principles. This (first) reclassification was upheld by the Court of Appeals for the District of Columbia Circuit in ''United States Telecom Association v. FCC'' (2016).

Under the Trump administration (2017-2021), the FCC reversed course by reclassifying ISPs as Title I services again ('''[https://docs.fcc.gov/public/attachments/FCC-17-166A1_Rcd.pdf FCC Restoring Internet Freedom Order 2018]'''), effectively rolling back federal net neutrality regulations. This (second) reclassification was upheld by the Court of Appeals for the District of Columbia Circuit in ''Mozilla Corp. v. FC''C (2019).

In the Biden administration (2021-present), the FCC decided to restore net neutrality under Title II in the order on ‘Safeguarding and Securing the Open Internet; Restoring Internet Freedom’ ([https://docs.fcc.gov/public/attachments/FCC-24-52A1.pdf FCC Net Neutrality Order 2024)]'' ''in April 2024.Then, in June 2024, providers under the National Cable & Telecommunications Association filed a lawsuit, challenging the FCC’s authority to reclassify ISPs – just after the Supreme Court in'' Loper Bright Enterprises v. Raimondo and Relentless, Inc. v. Department of Commerce ''(2024) overturned the ''Chevron ''deference established in ''Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc. ''(1984). ''Chevron ''deference directed courts to defer to an agency’s reasonable interpretation of ambiguous statutes – specifically, to agency interpretations of congressional statutes that are ‘silent or ambiguous with respect to the specific issue’ at hand –, and was central to previous cases like ''National Cable & Telecommunications Association v. Brand X Internet Services ''(2005). In lieu of ''Chevron, ''the Supreme Court assigned the determination of congressional ambiguity to the federal courts, with executive agency expertise still to be considered under the weaker ''Skidmore'' deference established in ''Skidmore v. Swift & Co. ''(1944). Then, in August 2024, in a per curiam decision, the Court of Appeals for the Sixth Circuit granted a temporary injunction against the FCC’s 2024 Net Neutrality Order as well as a stay, extending an earlier temporary pause. In a concurring opinion, Chief Judge Sutton writes that the FCC’s flip-flopping on net neutrality between administrations makes it difficult to even apply the lower standard of ''Skidmore'' deference – thus, the ISPs challenging the latest iteration of the rule are likely to succeed on the merits. Citing ''Skidmore''', Sutton writes,
:‘an agency’s power to persuade turns on the thoroughness of its reasoning, its technical expertise, and its consistency with earlier and later pronouncements, especially those contemporaneous with the statute’s enactment. [...] The problem is, we do not know which group of experts to respect.’
Sutton adds,
:‘the consistency query makes matters worse. The Commission’s intention to reverse course for yet a fourth time suggests that its reasoning has more to do with changing presidential administrations than with arriving at the true and durable meaning of the law.’
This leaves the Communications Act of 1934, as amended by the Telecommunications Act of 1996, as the central regulatory framework at the federal level.

==== State Regulatory Framework ====
In response to the FCC’s 2018 Restoring Internet Freedom Order, which rolled back federal net neutrality rules, several states introduced their own legislation to maintain net neutrality. States like California, New York, and Vermont enacted laws prohibiting ISPs from practices such as blocking or throttling content. [https://broadband.ny.gov/#:~:text=The%20mission%20of%20ConnectALL%20is,public%20investments%20across%20the%20state. New York’s ConnectALL program], for instance, prioritises service providers that adhere to net neutrality principles. Additionally, states like Nevada and Minnesota passed laws focusing on ISP privacy and data protections.

The California '''[https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180SB822 Internet Consumer Protection and Network Neutrality Act of 2018]''', which has been lauded as the ‘gold standard’ of net neutrality laws, was signed into law in 2018. With the repeal of the FCC’s 2015 Open Internet Order, California sought to restore similar principles at the state level. Although the US Department of Justice initially challenged the law, arguing that federal regulations preempted state rules, the courts ultimately upheld California’s right to enforce its own net neutrality protections.

The law includes several key provisions to ensure an open internet. First, it prohibits ISPs from blocking or throttling lawful internet traffic, ensuring that all users have equal access to content without interference. It also bans paid prioritisation, preventing ISPs from charging content providers for faster delivery speeds, thus maintaining a level playing field for all internet services, regardless of financial power.
Additionally, the law contains a broad prohibition against unreasonable interference, meaning ISPs cannot engage in practices that unfairly disadvantage or restrict access to lawful content and services. This provision serves as a general safeguard against ISP behaviour that might harm competition or limit consumer choice. Finally, the Act requires ISPs to disclose their network management practices transparently, ensuring consumers are informed about any restrictions that might affect their internet access.

==== Focus On: Zero-Rating in the US ====
With the 2015 Open Internet Order, the FCC addressed and thoroughly analysed the effects of zero-rating and similar practices on competition, consumer welfare and net neutrality. It acknowledged that zero-rating could potentially disrupt the market and encourage the use of restrictive data caps. However, it also noted that, depending on their specific structure, such offerings could provide benefits to consumers (e.g. increased choice and lower costs) and competition (e.g. more investments in broadband infrastructure). The FCC then established a standard under which zero-rating offers would be assessed. In particular, the FCC decided that it would have looked at and assessed such practices ‘under the no-unreasonable interference/disadvantage standard, based on the facts of each individual case, and take action as necessary’.  As a result, in 2016 the FCC’s Wireless Bureau initiated investigations into whether the zero-rating practices of several wireless service providers were consistent with the 2015 Open Internet Order. For instance, among others, [https://docs.fcc.gov/public/attachments/DOC-343337A1.pdf the FCC investigated AT&T for its ‘Data Free TV’] feature of its DIRECTV App, that allowed AT&T Mobility customers who App on a zero-rated basis. The FCC raised many concerns on competition and consumer protection basis, concluding that AT&T seemed to be acting in ways that harmed the open Internet.

Nonetheless, following the 2016 elections and the changes in the membership of the FCC, the Wireless Bureau closed the investigations arguing that ‘free data plans have proven to be popular among consumers’ and that ‘they have also enhanced competition’. This shift in approach led to the repeal of the 2015 net neutrality rules in December 2017. Additionally, the FCC entered into a partnership with the FTC to monitor ISPs and noted that antitrust and consumer protection laws could handle specific cases of anti-competitive behaviour.

As mentioned in paragraph 2, in September 2018, California passed a net neutrality law, considered by many as the strictest in the United States. One section of the law addresses zero-rating specifically and prohibits individual apps from being zero-rated, but it allows for entire categories such as music or video to be zero-rated. Notwithstanding many opponents harshly critique the California law, the FCC has explicitly stated that it does not consider the regulation of zero-rating to be detrimental. This position allows states to experiment and develop their own strategies within the overarching federal framework. Such an approach promotes innovative solutions that can address regional needs and preferences, contributing to a dynamic environment for internet services and consumer protection.

In 2024, the FCC once again addressed the issue of zero-rating with its Net Neutrality Order highlighting several key concerns, including:
* the preferential treatment of certain products over others, particularly through paid agreement or affiliations;
* potential harm to the open internet, akin to the issues associated with paid prioritisation;
* undue advantage given to large providers;
* the creation of negative externalities that elevate costs across the market, stifling innovation and disrupting the virtuous cycle;
* the hindering of consumers’ ability to choose, access, and utilise broadband internet service or the internet content, applications, services or devices of their choice.
To address these potential risks, the FCC proposed to evaluate zero-rating programs under a multi-factor analysis within its general conduct standard, which allows for case-by-case assessments. Indeed, the FCC acknowledges that some zero-rating programs may offer potential benefits or are less likely to cause concerns such as, for instance, zero-rating products during low traffic hours or within the same category of products.

This flexible approach was intended to strike a balance between encouraging beneficial innovations and limiting practices that could distort the market or harm consumers. However, following the appeal brought by broadband providers against the FCC Net Neutrality Order 2024, as of today, there is no enforcement against zero-rating practices at a federal level and uncertainty prevails.

==== References ====

*Communications Act of 1934, 1934-06-19, ch. 652,[http://law.cornell.edu/rio/citation/Pub._L._0- 48 Stat. 1064]
*Telecommunications Act of 1996, [https://www.congress.gov/bill/104th-congress/senate-bill/652 S.652 - 104th Congress (1995-1996), February 8, 1996].
*Federal Communications Commission, ''[https://docs.fcc.gov/public/attachments/FCC-10-201A1.pdf Preserving the Open Internet], ''GN Docket No. 09-191, WC Docket No. 07-52, December 23, 2010. 
*Federal Communications Commission,'' [https://docs.fcc.gov/public/attachments/FCC-15-24A1.pdf Open Internet Order,] ''GN Docket No. 14-28, March 12, 2015. 
*Federal Communications Commission, ''[https://docs.fcc.gov/public/attachments/FCC-17-166A1.pdf Restoring Internet Freedom Order,] ''WC Docket No. 17-108, January 4, 2018. 
*Federal Communications Commission, ''[https://docs.fcc.gov/public/attachments/DOC-401676A1.pdf In the Matter of Safeguarding and Securing the Open Internet; Restoring Internet Freedom]'', 2024 FCC LEXIS 1283, WC Docket No. 23-320, April 4, 2024. 
*Cath Virginia, [https://www.theverge.com/2024/4/25/24140157/fcc-vote-restore-net-neutrality-rosenworcel-biden "FCC votes to restore net neutrality", The Verge], accessed on 25 September 2024.
*''Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc., ''[https://supreme.justia.com/cases/federal/us/467/837/ 467 U.S. 837], 1984.
*''Loper Bright Enterprises, et al. v. Gina Raimondo, Secretary of Commerce, et al. Relentless, Inc. et al. v. Department of Commerce, et al,[https://supreme.justia.com/cases/federal/us/603/22-451/ 22–451]'', June 28, 2024. 
*''National Cable & Telecommunications Association v. Brand X Internet Services'', [https://supreme.justia.com/cases/federal/us/545/967/ 545 U.S. 967 ]2005.
*''Skidmore v. Swift & Co.'', [https://supreme.justia.com/cases/federal/us/323/134/ 323 U.S. 134], 1944. 
*Marguerite Reardon, [https://www.cnet.com/tech/services-and-software/california-net-neutrality-law-sparks-justice-department-lawsuit/ California's net neutrality law sparks Justice Department lawsuit, CNET]'', ''accessed on 25 September 2024. 
*Federal Communications Commission, ''[https://docs.fcc.gov/public/attachments/DOC-343337A1.pdf Letter to Rober W. Quinn]'', Jr., Senior Executive Vice President, External and Legislative Affairs at AT&T regarding AT&T’s Sponsored Data Program, November 9, 2016. 
*OECD, ''[https://www.oecd-ilibrary.org/docserver/6eefc666-en.pdf?expires=1727963693&id=id&accname=ocid56024160&checksum=5607F85D86B8787EB9BFDCD963FE8A9F The Effects of Zero Rating]'', OECD Digital Economy Papers, 2019.
 

{{reflist}}

Module 1: Infrastructures

2024-10-03T12:52:58Z

Erikads: /* Focus On: Zero-Rating in the US */

Module 1: Infrastructures

2024-10-03T12:45:39Z

Erikads: /* State Regulatory Framework */

== Net Neutrality and Zero-ratings ==
[https://eur-lex.europa.eu/EN/legal-content/glossary/open-internet-and-net-neutrality.html#:~:text=Net%20neutrality%20is%20the%20principle,%2C%20blocking%2C%20throttling%20or%20prioritisation Net neutrality] is the principle that internet service providers (ISPs) treat all online traffic equally and openly, without discrimination, blocking, throttling or prioritisation. [https://www.berec.europa.eu/en/what-is-zero-rating Zero-rating] is a commercial practice whereby an internet access provider applies a zero tariff, or a tariff that is more advantageous, to all or part of the data traffic associated with an application or category of specific applications, offered by partners of that access provider.

=== Brazil ===
====The legal framework and relevant regulatory actors for telecommunications in Brazil====
The national government of Brazil is competent to organize, regulate and investigate the telecommunication sector. This competency is laid down in Law No. 9472/1997, the General Telecommunications Law. The telecom sector should be organized and based on free, broad and fair competition, according to this law. Brazil has no strict limitations on foreign ownership on telecommunication service providers, other than that such companies ought to be organized in accordance to Brazilian law.
=====Anatel=====
The General Telecommunications Law also established the Brazilian national telecom authority, Anatel. Its main tasks are:
* construct policies for granting, providing and using telecommunication services in both the public and private sector
* implement national policies for telecommunications sector, issued by the Brazilian government
* conduct investigations
* issue sanctions for violating provisions in the telecom legislative framework
Most regulation of telecommunications services in Brazil is ex ante, and some provisions also look at the regulation of competition aspects for the market. More specifically Anatels resolution No. 600/2012 provides several guidelines for:
* competition aspects;
* measures concerning transparency, isonomic and non-discriminatory treatment;
* price control;
* the obligation of access and provision of specific network resources;
* the offer of wholesale products according to conditions set by such agency;
* obligations aimed to remedy specific market failures or to comply with the legal and regulatory rules in force; and
* accounting, functional or structural separation.
=====The Brazilian Internet Steering Committee=====
The Brazilian Internet Steering Committee (CGI.br), coordinates and integrates all Internet service initiatives in Brazil, promotes technical quality, innovation, and dissemination of Internet services. Its main tasks include:
* propose policies and procedures regarding regulation of Internet activities;
* recommend standards;
* establish strategic directives;
* coordinate allocation of Internet addresses and registration in the .br domain.
Anatels regulatory parameters and guidelines, which are in turn established by Brazil’s Internet Steering Committee (CGI.br)

=====CADE=====
Another important regulatory body in Brazil is CADE (Administrative Council for Economic Defence), which is the national antitrust authority. For some competition aspects of Anatels regulation, CADE may need to analyse and approve Anatels work, according to Law No. 12,529/2011.
=====The Internet Law (2014)=====
In 2014, the Internet Law was created (Law No. 12.965/2014). This piece of legislation sets out specific conditions and standards for net neutrality and zero-rating. More specifically, preserving and ensuring net neutrality is one of its core principles for using the internet in Brazil (Article 3). Net neutrality is further addressed in article 9, which states that the party in charge of the transmission, switching or routing has the duty to process any conveyed information in a neutral manner. As a result, throttling (intentionally slowing down the speed of a service) is also not allowed. There are some exceptions to this rule, for instance when internet traffic discrimination is necessary for technical reasons or to prioritise emergency services (Article 9). For instance, during the COVID-19 pandemic, mobile network operators were requested to provide zero-rating access for all mobile plans to health applications.
In such exceptional situations, service providers have to take in account some precautions to:
* not cause damage to users
* act with proportionality, transparency and equality to the internet traffic
* inform users pre-emptively in a clear and transparent manner, and take traffic management, mitigation practices and network security into account
* offer services in a non-discriminatory manner for commercial use, and;
* refrain from anticompetitive conduct (Art. 9)

=====Subsequent Decree (2016)=====
In 2016, Law No. 12.965/2014 was complemented by Decree 8871/2016. This Decree specifies technical requirements for the adequate provision of services and applications. These technical requirements shall aim to maintain their stability, safety, integrity, and functionality which arise from:
* Addressing network security issues, such as restriction of mass mailings (spam) and control of denial of service attacks; and
* Handling of exceptional congestion situations of networks, such as alternative routes in cases of main route interruptions and emergencies.

According to article 6 of the decree, such technical measures have to be consistent with international standards and should be in accordance with Anatels regulatory parameters and guidelines, which are in turn established by Brazil’s Internet Steering Committee (CGI.br). On a more technical level, article 9 and 10 of the Decree reinforce net neutrality and the prohibition of anti-competitive treatment of online service providers (i.e. zero-rating). The decree regulates the commercial relationships between the infrastructure operator and actors in the ‘logical’ layer, who cannot “compromise the public and unrestricted nature of Internet access,” “prioritize data packets due to commercial arrangements,” or favor applications offered by the infrastructure operator itself. In short, the decree prohibits zero-rating strategies and determines that content companies must have legal headquarters in Brazil.”

=====Zero-rating allowed after all?=====
However, the zero-rating prohibition was challenged, and successfully so, in 2017. What happened was that an alleged violation of net neutrality was taken by the Public Prosecutor’s Office to CADE, Brazil’s anti-trust authority. The complaint constituted that four major mobile network operators, namely, Claro, Oi, TIM Brasil and Telefônica Brasil, who control almost the entire market, had supposedly adopted discriminatory commercial practices. They were accused of offering their users data plans that differentiate the conditions of access to certain Internet services, through the charging of reduced amounts or even the total exemption from charge (i.e. zero-rating). In another model, called "sponsored access", the holder of the application supposedly remunerates the provider for the data traffic generated by its users. The complaint was that such offers to access apps without consumption of data franchising were a violation of the Brazilian Civil Rights Framework for the Internet. Anatel was notified of this complaint, but was of the opinion that this did not constitute a violation of the relevant provisions in the Internet Law (No. 12.965/2014). Their reasoning was that zero-rating is allowed, as long as it applies to the same class of services. Following Anatel's view on the matter, according to which the zero rating "has economic rationality and generates, undeniably, noticeable well-being via consumer and producer surplus", CADE decided to consider that zero rating should not be prohibited ex ante. CADE stated that these offers are “not expressly prohibited, not discriminatory, provide free access under the same conditions, and that, in practice, they would not have an adverse impact on market concentration.” PROTESTE, a consumer rights group, appealed this decision, “arguing that CADE did not consult with other actors and that, for example, in the case of pre-paid plans, these are used by lower-income sectors, and, since there are mostly zero-rating offers with Facebook and WhatsApp, the aspect of competition and market concentration regarding applications becomes fragile and unfounded.”

This decision was heavily protested by the Brazilian Civil Rights Framework for the Internet Watch. Their view of zero-rating in this case was that (direct quote:) “By subsidizing some applications and creating a fee - that is, the consummation of the franchise - to access the others, zero rating practices can transform the nature of the Internet from a general purpose network, whose modalities of use are defined autonomously by each user, into a network whose purposes are established in a centralized manner by operators. Such an evolution would limit users' Internet experience, discouraging them from venturing beyond the services provided to them free of charge, and would greatly limit the ability to create and disseminate new applications and introduce new competitors to the market. Clearly, this scenario is opposite to what the principle of neutrality aims to promote.” In short: the window for innovation would shrink as a direct result of a more competitive market because certain applications are offered through zero-rating. Moreover, the civil rights group claims, Zero rating practices increase the well-being of the consumer of the services included in the zero rating plans, as well as the providers of these services. They do not increase the well-being of the Internet access consumer, whose choice is dramatically reduced, nor of service providers excluded from the zero rating.

====The Brazilian telecommunications market and its regulation====
=====About operators=====
In Brazil, there are four main operator groups that dominate the mobile telecom market: Telefónica (33,60%), América Móvil (22%), Oi (15.70), and Telecom Italia. The market seems to follow a pro-competitive model. Oi, the fourth-largest operator, provides zero rating for almost all of their plans, but this has not led to significant market growth.

=====About internet usage among the population and costs=====
Most people in Brazil use their mobile phone to access the internet. Since 2016, there has been a steady growth in the coverage of the 4G network (66.68% in 2016 compared to 92.36% in 2022), the number of mobile cellphone and broadband subscriptions, and the percentage of Wi-Fi connection time for mobile Internet users has also increased (from 58.55% in 2016 to 68.2% in 2022). In 2022, the most used mobile social networks in Brazil were, in order, WhatsApp, Instagram, Facebook, TikTok and Facebook Messenger. (p.12) The price of roaming in Brazil has steadily decreased since 2017. This is mostly due to a higher number of operators and a good deployment of 4G mobile access networks. It led to a reduction in access costs, especially for mobile broadband. The affordability is mostly calculated as a percentage of average income, where the aim is that the price of 1 GB of data should not exceed 2% of a person’s average monthly income (the so-called “1 for 2” limit).

Brazil has also seen an increase in app development and digital skills. This, according to one article on the topic, is likely due to a high level of naitonal technological innovation capacity. The article therefore questions whether zero-rating is a risk for the digital market, although it could still pose a risk to the content sector.

=====About zero-rating=====
Generally, in South America, zero-rating is a dominant commercial strategy. The main zero-rating models that are deployed by MNOs, which are promoted by the operators themselves. “They also offer some vertically integrated, lower-cost Internet services, with the same operators providing their own and third-party content, such as messaging and calls (WhatsApp, Line, Messenger), music (Spotify, Deezer), and video (YouTube, Movistar Play, ClaroTv, Oi Play, Amazon Video, and Netflix).”

=====Effects of net neutrality and zero-rating on the market competition in Brazil=====
In general, and in comparison, to other countries in the region, the impact of zero-rating on network neutrality and competition in Brazil is a bit complex. On the one hand Brazil’s mobile markets are less concentrated than its neighbors’, implying more competition in the MNO market. On the other hand, smaller and local app development and content is limited due to the zero-rating of major applications by major MNOs. Zero-rating thus creates certain barriers of entry for smaller competitors. Furthermore, MNOs may also apply zero-rating to their own applications (vertical integration), as long as they don’t discriminate against apps developed by others in the same field. These negative effects are, nevertheless, may be somewhat mitigated by Brazil’s competitive market and government emphasis on digital skills development. Still, the research found no positive relationship between zero-rating and increased mobile access or lower prices.

====Sources used====
* OECD, Digital Trade Review of Brazil (OECD 2022) <https://www.oecd-ilibrary.org/trade/digital-trade-review-of-brazil_0b046dfe-en> accessed 24 September 2024.
* Miguel Botto-Tobar, Henry Cruz and Angela Díaz Cadena (eds), ‘Artificial Intelligence, Computer and Software Engineering Advances: Proceedings of the CIT 2020 Volume 1’ (Springer International Publishing 2021) <https://link.springer.com/10.1007/978-3-030-68080-0> accessed 24 September 2024.
* Roberto Triviño, Antonio Franco and Rafael-Leonardo Ochoa-Urrego, ‘Evaluating Zero Rating: A Comparative Analysis of Four South American Countries’ (2024) 5 Digital Government: Research and Practice 1.
* Website: Observatorio do Marco civil da Internet (05/12/2017). Accessed 24/09/2024: https://www.omci.org.br/jurisprudencia/207/neutralidade-de-rede-e-ordem-economica/
* UNESCO, Assessing internet development in Brazil. Using UNESCO internet universality ROAM-X Indicators.
* Law No. 12,965, April 23, 2014 (Marco Civil Law of the Internet in Brazil)
* Decree No. 8771, May 11, 2016
* Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November 2015 laying down measures concerning open internet access and amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services and Regulation (EU) No 531/2012 on roaming on public mobile communications networks within the Union (the Open Internet Regulation)
* Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast)

=== China ===

China follows a governmental control model for internet and telecommunications regulation. Under this model, the government has control of all aspects of the internet, including who is allowed access, what content is accessible, and the rate of delivery of that content. China can be considered as the most controlling jurisdiction of internet content and is not in support of network neutrality. Access to the internet in China from the outside world is limited and all Internet traffic in China must pass through one of three large computer centers in Beijing, Shangai and Guangzhou. The Chinese government maintains control over China’s gateways to the global internet, giving authorities the ability to cut off cross-border information requests in order to restrict connectivity or access to content hosted on servers outside the country. This arrangement is the foundation for the ‘Great Firewall’, which is considered the world’s most sophisticated internet censorship program.

Another strategy for control of the internet in China is that state-owned companies dominate the ISP sector of the mobile market: China Mobile, China Telecom, and China Unicom. In 2019, British Telecom (BT) became the first foreign telecommunications company to receive permission to provide internet services across the country. Authorities exercise tight control over cybercafes and other public access points, which are licensed by the Ministry of Culture in cooperation with other state entities.

Another key part of the regulation of the telecommunications sector in China is content management, or censorship. This is not the focus of this Wiki. We address elements of cybersecurity or censorship laws as they relate to the infrastructure elements of the telecommunications sector in China (such as from the Cybersecurity Law 2017). Accordingly, the law we focus on here is the '''Telecommunications Regulation 2000'''. Before we jump into the legal framework, we explain first the policy context and then the market structures.

===== Policy Context =====
Chinese internet policy shows distinct features at different stages, heavily influenced by the political thinking and outlook of the leadership at the time as well as China’s social, economic and political conditions.

The early phase, before a period of reform in the 1980s, saw telecommunications under strict state control, with limited infrastructure and services primarily serving governmental needs. Post-1980s economic reforms introduced a gradual liberalisation, allowing room for infrastructural growth and services expansion. This led to the implementation of the Telecommunications Regulation in 2000, establishing a legal framework that aimed to separate government functions from business operations, reduce monopolistic practices, and promote competition and innovation (Article 4). The turn of the millennium saw a rapid acceleration in policy evolution market competition, marked by China's accession to the World Trade Organization ('''WTO''') in 2001.

Before 1998, the telecommunications regulator was the Ministry of Posts and Telecommunication (MPT). Until 1994, the MPT was instrumental in promoting the development of the Chinese telecommunications sector. During this period, the telecoms industry was monopolized and there was no clear distinction between the functions of government and enterprises. From 1998, competition has been introduced into the telecom market, with the creation of a second communications network operator, China Unicom. The second stage started with the establishment of Ministry of Information Industry (MII) in 1998. It became the principal regulator of the telecommunications and information industry and was initially granted operational control over both China Telecom and China Unicom. During 1999 and 2000, China Telecom and China Unicom were restructured to promote greater competition, creating a total of seven distinct Chinese state-owned telecommunications providers each with primary operations in a different functional aspect. Yet, given the relatively low accessibility of telecommunications to the Chinese population, Chinese telecommunications policy remained oriented towards the development of telecommunications infrastructures. With the adoption of the Telecommunications Regulation in 2000, telecommunications regulation entered the stage of regulation according to laws, and a regulatory framework has been established.

The situation shifted in in 2001 with China admission to the WTO. Obligations under the WTO required China to adopt telecommunications regulations to introduce and promote market competition, to protect the rights and interests of consumers and to increase the welfare of consumers. This era led to further reforms, including the restructuring of state-owned enterprises (SOEs), the introduction of foreign investment in the telecommunications sector, and an emphasis on digitalisation. Establishment of MIIT (ministry of Information Technology in 2008, the Antimonopoly Law (AML) was finally adopted in 2007 and became effective in 2008. Similar to competition rules in other jurisdictions, the AML also prohibits anti-competitive agreements (Chapter II), abusing dominant positions (Chapter III), and anticompetitive mergers (Chapter IV).

===== Net Neutrality in China and the Great Firewall =====
A key part of the regulatory framework of the internet in China is the Great Firewall. Although the Great Firewall is inherently content moderation, not specifically related to net neutrality, it is important to understand in order to view internet regulation through the norms of the Chinese political framework.

The Great Firewall controls how internet content is distributed to citizens; what they can and cannot access. While the principle of net neutrality suggests citizens should be able to access different products on the internet without discrimination, the Great Firewall imposes this discrimination as government policy. In other words, net neutrality is not a principle considered in Chinese internet policy, and the policy position is pro-discrimination via content management in the name of national security.

The Great Firewall means that any new domain or platform which wants to enter Chinese cyberspace must adhere to domestic regulations. Consequently, domains that do not adhere to domestic regulations are banned; Facebook, Twitter, YouTube, Wikipedia, and Instagram.

Technologically, the Great Firewall is made up of two software’s:
# Last mile providers of internet services to consumers automatically filter suspicious references, also considered access requests; and
# ISPs implement filters that blocked Chinese websites, also called interconnecting networks.

The GFW relies on filtering methods like blocking Internet Protocol (IP) address, Transmission Control Protocol (TCP) packet filtering and forging, Domain Name System (DNS) spoofing, redirection, and filtering Uniform Resource Locator (URL) by transparent proxies.

The implication of this system is that net neutrality - the equality of access by citizens to different parts of the internet - is not a consideration, as discrimination of content to “advance the dissemination of core socialist values” (Art 6, CSL) is inherent in the internet policy of the state in the name of cyber security.

==== Telecoms Regulation in China ====
The Chinese government structures its regulations to control political risks through carefully designed institutional arrangements, control of network operation, and tight regulations on end-users.
The legal foundation of telecommunication regulation is stated in China’s State Council Order 195, ‘Interim Regulations on International Interconnections of Computer Information Networks in the PRC’. (PRC meaning People’s Republic of China.) Order 195 granted the Steering Committee on National Information Infrastructure, part of the Ministry of Information Industry, primary regulatory responsibility for China’s internet, which includes determining and coordinating important issues of international interconnections.

:: ''Primary telecoms regulator: Steering Committee on National Information Infrastructure''

In the internet server provision sector, Order 195 divides China’s Internet networks into two categories:
# interconnecting networks and
# access networks.

====== ''Interconnecting networks'' ======
: Interconnecting networks are directly linked to the global internet through international leased lines and must have the approval of the State Council in order to operate. These interconnecting networks assume heavy and important responsibilities of internet regulation, including responsibility for online content blocking and filtering.
: In this area, only four licences have been granted - CERNet and CSTNet and ChinaNet and ChinaGBN. These four interconnecting networks are tied closely to government agencies. ChinaNet is operated by China Telecom, which falls under control of the Ministry of Information Industry (MIIT).

====== ''Access networks'' ======
: The Chinese access networks are the equivalent of internet service providers (ISPs), providing access and content services but no direct global interconnection. An access network provider has to be licenced by and gain global access through one of the four interconnecting networks. ISPs are key to filtering the huge number of sensitive words on the blacklist. In such circumstances, Chinese ISPs are more political than commercial.

: In summary, the provision of internet to consumers resembles:

:: Global internet ➡ Interconnecting network ➡ Access Network ➡ Consumer

==== Telecommunications Regulations ====
The Telecommunications Regulations, first issued in 2000 and then revised in 2016, covers licensing, fee collection, interconnectivity, operation and regulation of telecoms services in mainland China. The Classified Catalogue of Telecommunications Services, effective from 1 March 2016, sets out the specific and categories of services that are regulated under the telecommunications licensing regime. These regulations provides general regulations on domestic telecommunication services, including the licensing of telecommunication services, the provision of telecommunication services, the construction of telecommunications facilities and telecommunications security.

The aim of these regulations are to regulate the order of the telecommunications market, safeguard the legitimate rights and interests of telecommunications subscribers and operators, ensure the safety of telecommunications networks and information, and to promote the sound development of telecommunication industry (article 1). The regulations are addressed to anyone that engage in telecommunications activities or telecommunications-related activities (article 2). Article 4 provides that the supervision and regulation of the telecommunications industry shall be based on the principles of separation of government administration from enterprise management, elimination of monopoly, encouragement of competition and innovation, as well as principle of openness, fairness and impartiality. Under article 5, telecommunications operators shall provide telecommunication subscribers with services that are fast, accurate, secure, convenient and reasonably-priced.

The Telecommunications Regulation is mainly comprised of two substantial chapters for the purpose of promoting competition.

====== ''Licencing scheme'' ======
: As far as market entry is concerned, a two-layer authorisation mechanism is established based firstly on services and secondly on geographic coverage. In terms of services, Category I of basic telecom services and satellite facilities (Category II of basic telecom services) are exclusively licensed by the Ministry of Industry and Information Technology (MIIT), and are so far only awarded to the three SOEs. With regard to other telecom services, intra-provincial operation licenses are administered by provincial-level telecom authorities while inter-provincial ones are authorised by the MIIT.

====== ''Cybersecurity Law'' ======
: The Cybersecurity Law (CSL) establishes the overarching security framework relevant to internet traffic in China, including the governing of internet infrastructure (Art 2 CSL). To safeguard data sovereignty, the CSL imposes data localisation requirements on critical information infrastructure operators. Other relevant obligations in the CSL are:

:: * Article 9: Network operators shall, when conducting business operations and providing services abide by laws and administrative regulations, respect social morality, observe business ethics, operate in good faith, perform their obligations to safeguard cybersecurity, accept supervision by the government and the public, and undertake social responsibilities.
:: * Article 12: The State shall protect the rights of citizens, legal persons and other organisations to use networks in accordance with the law, promote improved network access, provide better network services, provide the public with secure and convenient network services, and guarantee the lawful, orderly and free circulation of network-based information.

: It is unclear what is meant by reference to ‘social morality’ and ‘business ethics’, but that we view this through the prism of Chinese international relations and our understanding of societal values - essentially connecting these ideas to community, state-first control of information. This is not translatable to European norms associated with fundamental rights and the single internal market.

==== Other related legislation ====
Other related legislation includes:
* State Council - Regulations on Security Protection of Computer Information Systems, Administrative Measures for Internet Information Services
* The national intelligence law
* Ministry of Public Security - Administrative Measures for Prevention and Treatment of Computer Viruses
* Ministry of Public Security and five other ministries - Administrative Measures for Hierarchical Protection of Information Security
* NPC Standing Committee - Law on Guarding State Secrets

==== Sources ====

The above information is based on our consideration of the Telecommunications Regulations, Cybersecurity Law and the following secondary sources:
* Hu, Henry L. “The Political Economy of Governing ISPs in China: Perspectives of Net Neutrality and Vertical Integration.” The China Quarterly, Volume no. 207 (2011) 523–40. Available here: http://www.jstor.org/stable/41305255
* Pranavnayar 'The Legality of China’s Great Firewall: How Does the International Law Fare' Metacept 6 June 2021 <https://metacept.com/the-legality-of-chinas-great-firewall-how-does-the-international-law-fare/
* Christine M. Stover, ‘Network Neutrality: A Thematic Analysis of Policy Perspectives Across the Globe’ [2010] Global Media Journal Volume 3(1) pp. 75-86
* Bernd Holzenagel, Xu Junqi and Thomas Hart, ‘Regulating Telecommunications in the EU and China: What Lessons to be Learned?’ Arbeitsberichte Zum Informations-, Telekommunikations- Und Medienrecht Volume 16 [2009]
* Martyn Taylor, ‘Reforming China’s telecommunications law: lessons from the Australian experience’, International Journal of Communications Law and Policy Issue 7 [Winter 2002/2003]
* Becky P Y Loo, ‘Telecommunications reforms in China: Towards an analytical framework’ Telecommunications Policy 28 [2004] pp 679-714
* Report from US Embassy Beijing [2024] Available at: https://irp.fas.org/world/china/netreg.htm
* Zixiang Alex Tan, ‘Regulating China’s Internet: convergence toward a coherent regulatory regime’ Telecommunications Policy Volume 23, Issues 3-4, [1999] pp. 261-276
* Grace Wang, ‘Telecoms regulations in China’ Lexology [2022] Available at: https://www.lexology.com/library/detail.aspx?g=c8e8fd3d-4989-4db0-8887-45fd7a86f1a5
* Liyang Hou, ‘When competition law meets telecom regulation: the Chinese context’ Computer Law and Security Review 31(5) [2015]

=== India ===

The Indian regulatory framework currently features a strong commitment to net neutrality and a ban on zero rating. The development of this framework, however, cannot be understood without due attention paid to the legislative players in India and the context of the proliferation of zero rating services in 2015. Consequently, this section outlines the regulatory authorities responsible for telecommunications regulation in India, the resulting regulatory framework relating to net neutrality and zero-rating, and further challenges to net neutrality and food for thought.
India has a Department of Telecommunications (DoT) which is responsible for setting out its telecommunications policy. Under section 3 of the Telecom Regulatory Authority of India Act by the DoT, the Telecom Regulatory Authority of India (TRAI) was established as a statutory body of the DoT.

===== Zero rating: Facebook's "Free Basics Ban" =====

The debate on net neutrality followed primarily from the debate on the zero rating due to the proliferation of zero rating packages in 2015, the most notorious of which included Facebook’s “Free Basics” service and Airtel’s zero rating platform for app developers. In India, only around 50% of the population purchased data plans for their smartphones, and out of those who used it, it was shown that the average data package used was around 80MB per month in 2015. Therefore, due to the small data packages, zero rating was an attractive and reliable service.
The problem arose with the introduction of Facebook's zero rating model with Internet Access Providers, which included a service called Internet.org, which despite its misleading name offered exclusively Facebook services free of charge under the “Free Basics” model. Internet.org was meant to be an open platform that gives Indian developers additional services offered for free, used by those users who could not afford traditional internet access. Nevertheless, only partner websites and applications would be able to be included, ultimately going against the principles of net neutrality.
As a result of the misleading and untransparent, in 2016, TRAI published the “Prohibition of Discriminatory Tariffs for Data Services Regulations, 2016” which prohibited zero rating. Article 3 of the aforementioned regulation outlines this prohibition, whilst Article 4 stipulates a potential derogation for providing emergency services “or at times of grave public emergency.” However, the telecom provider must notify this reduced tariff to TRAI and the authority’s decision on its compliance with the Discriminatory Tariffs Regulation is final.

===== Net neutrality =====

The ban on zero rating was followed up with an overarching debate on net neutrality. Both TRAI and a Committee under the DoT consequently released papers advocating for the adoption of net neutrality principles throughout telecommunication legislation. As a result, the DoT signed off on TRAI’s recommendation to wholly support net neutrality principles and amended numerous parts of its core telecommunication legislation to integrate such principles. In 2018, the DoT amended the “Unified License for Telecom Service Providers (TSPs) and Unified License (Virtual Network Operators) and Unified Access License Agreement to incorporate the principles of non-discriminatory treatment of content.” In 2019, further amendments occurred regarding the Internet Service Provider License for Regulatory Framework. Some exemptions are present regarding the principles of non-discriminatory treatment of content and/or traffic for when “quality of service is essential,” such as in the cases of autonomous vehicles.
Despite these net neutrality principles, there remains the problem of the Indian government’s ability to legally order ISPs to block access to certain content, either for its own purposes or due to court orders. Whilst India’s net neutrality principles do not presuppose such government requests as violations per se, the problem lies in the perceived clash between the legislative provisions. For example, such government orders would be permissible as long as the measures adopted by the ISP are “proportionate, transient, and transparent;” however, the rules regarding the blocking of content stipulate a legal requirement to maintain the confidentiality of blocking requests and subsequent actions.

==== Opposition to net neutrality ====

Additionally, some scholars critique India’s strict approach to net neutrality due to the rapid developments in the internet space. For example, “complexities such as vertical partnerships between [internet service providers (ISPs)] and [content and application providers],” content delivery networks, and the deployment of 5G show the limits of India’s ex-ante net neutrality approach. As a result, further ex-post enforcement may be necessary to bolster net neutrality in India.

In sum, India’s regulatory framework started with a ban on zero rating as a result of controversy arising from the proliferation of zero rating with services such as Facebook’s “Free Basics.” This later erupted in a political debate on whether India should, as a result, commit fully to net neutrality, which was ultimately answered in the positive when the DoT implemented TRAI’s recommendations throughout India’s various telecommunications regulations. However, criticisms remain about the limited exceptions to net neutrality rules, and the Indian government’s eager censorship through blocking requests to ISPs may still pose threats to a free internet in India.

==== Sources ====

* The Telecom Regulatory Authority of India Act [1997] 199724 <https://www.indiacode.nic.in/handle/123456789/1929>.

* Jon Russel, ‘Under Fire In India, Facebook’s Internet.org Launches In Indonesia’ (TechCrunch, 2015) <https://techcrunch.com/2015/04/20/internet-dot-org-indonesia/>.

* Parmy Olson, ‘This App Is Cashing in on Giving the World Free Data’ (Forbes, 29 July 2015) <https://www.forbes.com/sites/parmyolson/2015/07/29/jana-mobile-data-facebook-internet-org/>, cited in Luca Belli, ‘Net Neutrality Reloaded: Zero Rating, Specialised Service, Ad Blocking and Traffic Management’ (2016) Annual Report of the UN IGF Dynamic Coalition on Net Neutrality.

* Lok Sabha Secretariat, ‘Net Neutrality: India's Position,’ (Parliament Library And Reference, Research, Documentation And Information Service, 2016) Reference note No.6/RN/Ref./February/2016.

* Prohibition of Discriminatory Tariffs for Data Services Regulations [2016] <https://trai.gov.in/sites/default/files/Regulation_Data_Service.pdf>.

* Ministry of Communications, ‘Net Neutrality in India’ (Press Release 1884064, 2022) <https://pib.gov.in/PressReleasePage.aspx?PRID=1884064>.

* Shruti Dhapola, ‘Net Neutrality rules approved by government; Internet to remain free and open in India’ (The Indian Express, 2018)<https://indianexpress.com/article/technology/tech-news-technology/net-neutrality-rules-now-approved-by-telecom-commission-india-internet-timeline-5256139/>

* BBC, ‘India adopts 'world's strongest' net neutrality norms’ (BBC, 2018) <https://www.bbc.com/news/world-asia-india-44796436>.

* The Wire Staff, ‘India Approves New Net Neutrality Rules, Signs off on New Telecom Policy’ (The Wire, 2018) <https://thewire.in/tech/india-approves-new-net-neutrality-rules-signs-off-on-new-telecom-policy>.

* Smriti Parsheera, ‘Net neutrality in India: From rules to enforcement’ (Medianama, 2020) <https://www.medianama.com/2020/05/223-net-neutrality-india-rules-enforcement/>.

* Raghuvansh Seth, ‘Fleeting neutrality: The inadequacies of the ex-ante net neutrality regulations in India’ (2022) 23 Competition and Regulation in Network Industries 1.

=== United States ===
==== Federal Regulatory Framework ====
To the extent that Internet Service Providers (ISPs) are regulated by the United States (US) Congress, it is under the '''[https://en.wikipedia.org/wiki/Communications_Act_of_1934 Communications Act of 1934]''', as amended by the '''[https://en.wikipedia.org/wiki/Telecommunications_Act_of_1996 Telecommunications Act of 1996]'''.

Pursuant to Sec. 1, the purpose of this Act is to regulate
:‘interstate and foreign commerce in communication by wire and radio so as to make available, so far as possible, to all the people of the United States [...] a rapid, efficient, Nation-wide, and world-wide wire and radio communication service with adequate facilities at reasonable charges’.
Sec. 230(b) outlines the policy specifically with respect to the Internet. It is, inter alia, ‘to promote the continued development of’ and ‘to preserve the vibrant and competitive free market for’ the Internet.

Pursuant to Sec. 2(a), this Act applies ‘to all interstate and foreign communication by wire or radio[, and] transmission of energy by radio, [...] and to all persons engaged’ in such pursuits. It also applies ‘to all persons engaged [...] in providing [cable] service’.

To ensure the ‘effective execution of this policy’, Congress created the Federal Communications Commission (FCC) under the Communications Act of 1934.

Yet, the Commission’s authority to regulate the addressees of this Act depends crucially on whether they fall under Title I (‘information service’) or Title II (‘common carrier service’). Common carrier services are expressly prohibited from granting preferential treatment:
:‘It shall be unlawful for any common carrier to make any unjust or unreasonable discrimination in charges, practices, classifications, regulations, facilities, or services for or in connection with like communication service, directly or indirectly, by any means or device, or to make or give any undue or unreasonable preference or advantage to any particular person, class of persons, or locality, or to subject any particular person, class of persons, or locality to any undue or unreasonable prejudice or disadvantage.’
To ensure reasonable pricing rates and non-discriminatory practices, the Communications Act of 1932 grants the FCC broad regulatory authority under Title II. In contrast, Title I services remain mainly unregulated by the FCC.

However, the term ‘information service’, which is defined as ‘the offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making available information via telecommunications’ [sic!], and the term ‘common carrier service’, which is defined as a person ‘engaged as a common carrier for hire’, in any of the pursuits mentioned above, are ambiguous when it comes to ISPs.

So far, the FCC has been responsible for the interpretation of these terms, as affirmed by the Supreme Court in ''National Cable & Telecommunications Association v. Brand X Internet Services'' (2005).

As the Commission’s Commissioners are ‘appointed by the President, by and with the advice and consent of the Senate’, the Commission’s stance on the classification of ISPs and the corresponding regulatory regime has always depended on the administration in power. This has led to relatively frequent shifts in administrative practice in the past.

During the Obama administration (2009-2017), the FCC classified ISPs as Title I services and introduced net neutrality principles in the '''[https://en.wikipedia.org/wiki/Federal_Communications_Commission_Open_Internet_Order_(2010) FCC Open Internet Order 2010]'''. However, the Court of Appeals for the District of Columbia Circuit in ''Comcast Corp. v. FCC'' (2010) and ''Verizon Communications Inc. v. FCC'' (2014) ruled that the FCC lacked the authority to enforce these principles on Title I services. Thus, the FCC reclassified ISPs under Title II in the '''[https://docs.fcc.gov/public/attachments/FCC-15-24A1.pdf FCC Open Internet Order 2015]''', enshrining net neutrality principles. This (first) reclassification was upheld by the Court of Appeals for the District of Columbia Circuit in ''United States Telecom Association v. FCC'' (2016).

Under the Trump administration (2017-2021), the FCC reversed course by reclassifying ISPs as Title I services again ('''[https://docs.fcc.gov/public/attachments/FCC-17-166A1_Rcd.pdf FCC Restoring Internet Freedom Order 2018]'''), effectively rolling back federal net neutrality regulations. This (second) reclassification was upheld by the Court of Appeals for the District of Columbia Circuit in ''Mozilla Corp. v. FC''C (2019).

In the Biden administration (2021-present), the FCC decided to restore net neutrality under Title II in the order on ‘Safeguarding and Securing the Open Internet; Restoring Internet Freedom’ ([https://docs.fcc.gov/public/attachments/FCC-24-52A1.pdf FCC Net Neutrality Order 2024)]'' ''in April 2024.Then, in June 2024, providers under the National Cable & Telecommunications Association filed a lawsuit, challenging the FCC’s authority to reclassify ISPs – just after the Supreme Court in'' Loper Bright Enterprises v. Raimondo and Relentless, Inc. v. Department of Commerce ''(2024) overturned the ''Chevron ''deference established in ''Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc. ''(1984). ''Chevron ''deference directed courts to defer to an agency’s reasonable interpretation of ambiguous statutes – specifically, to agency interpretations of congressional statutes that are ‘silent or ambiguous with respect to the specific issue’ at hand –, and was central to previous cases like ''National Cable & Telecommunications Association v. Brand X Internet Services ''(2005). In lieu of ''Chevron, ''the Supreme Court assigned the determination of congressional ambiguity to the federal courts, with executive agency expertise still to be considered under the weaker ''Skidmore'' deference established in ''Skidmore v. Swift & Co. ''(1944). Then, in August 2024, in a per curiam decision, the Court of Appeals for the Sixth Circuit granted a temporary injunction against the FCC’s 2024 Net Neutrality Order as well as a stay, extending an earlier temporary pause. In a concurring opinion, Chief Judge Sutton writes that the FCC’s flip-flopping on net neutrality between administrations makes it difficult to even apply the lower standard of ''Skidmore'' deference – thus, the ISPs challenging the latest iteration of the rule are likely to succeed on the merits. Citing ''Skidmore''', Sutton writes,
:‘an agency’s power to persuade turns on the thoroughness of its reasoning, its technical expertise, and its consistency with earlier and later pronouncements, especially those contemporaneous with the statute’s enactment. [...] The problem is, we do not know which group of experts to respect.’
Sutton adds,
:‘the consistency query makes matters worse. The Commission’s intention to reverse course for yet a fourth time suggests that its reasoning has more to do with changing presidential administrations than with arriving at the true and durable meaning of the law.’
This leaves the Communications Act of 1934, as amended by the Telecommunications Act of 1996, as the central regulatory framework at the federal level.

==== State Regulatory Framework ====
In response to the FCC’s 2018 Restoring Internet Freedom Order, which rolled back federal net neutrality rules, several states introduced their own legislation to maintain net neutrality. States like California, New York, and Vermont enacted laws prohibiting ISPs from practices such as blocking or throttling content. [https://broadband.ny.gov/#:~:text=The%20mission%20of%20ConnectALL%20is,public%20investments%20across%20the%20state. New York’s ConnectALL program], for instance, prioritises service providers that adhere to net neutrality principles. Additionally, states like Nevada and Minnesota passed laws focusing on ISP privacy and data protections.

The California '''[https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180SB822 Internet Consumer Protection and Network Neutrality Act of 2018]''', which has been lauded as the ‘gold standard’ of net neutrality laws, was signed into law in 2018. With the repeal of the FCC’s 2015 Open Internet Order, California sought to restore similar principles at the state level. Although the US Department of Justice initially challenged the law, arguing that federal regulations preempted state rules, the courts ultimately upheld California’s right to enforce its own net neutrality protections.

The law includes several key provisions to ensure an open internet. First, it prohibits ISPs from blocking or throttling lawful internet traffic, ensuring that all users have equal access to content without interference. It also bans paid prioritisation, preventing ISPs from charging content providers for faster delivery speeds, thus maintaining a level playing field for all internet services, regardless of financial power.
Additionally, the law contains a broad prohibition against unreasonable interference, meaning ISPs cannot engage in practices that unfairly disadvantage or restrict access to lawful content and services. This provision serves as a general safeguard against ISP behaviour that might harm competition or limit consumer choice. Finally, the Act requires ISPs to disclose their network management practices transparently, ensuring consumers are informed about any restrictions that might affect their internet access.

====Focus On: Zero-Rating in the US====
With the 2015 Open Internet Order, the FCC addressed and thoroughly analysed the effects of zero-rating and similar practices on competition, consumer welfare and net neutrality. It acknowledged that zero-rating could potentially disrupt the market and encourage the use of restrictive data caps. However, it also noted that, depending on their specific structure, such offerings could provide benefits to consumers (e.g. increased choice and lower costs) and competition (e.g. more investments in broadband infrastructure). The FCC then established a standard under which zero-rating offers would be assessed. In particular, the FCC decided that it would have looked at and assessed such practices ‘under the no-unreasonable interference/disadvantage standard, based on the facts of each individual case, and take action as necessary’.9 As a result, in 2016 the FCC’s Wireless Bureau initiated investigations into whether the zero-rating practices of several wireless service providers were consistent with the 2015 Open Internet Order. For instance, among others, the FCC investigated AT&T for its ‘Data Free TV’ feature of its DIRECTV App, that allowed AT&T Mobility customers who App on a zero-rated basis. The FCC raised many concerns on competition and consumer protection basis, concluding that AT&T seemed to be acting in ways that harmed the open Internet.10

Nonetheless, following the 2016 elections and the changes in the membership of the FCC, the Wireless Bureau closed the investigations arguing that ‘free data plans have proven to be popular among consumers’ and that ‘they have also enhanced competition’.11 This shift in approach led to the repeal of the 2015 net neutrality rules in December 2017. Additionally, the FCC entered into a partnership with the FTC to monitor ISPs and noted that antitrust and consumer protection laws could handle specific cases of anti-competitive behaviour.

As mentioned in paragraph 2., in September 2018, California passed a net neutrality law, considered by many as the strictest in the United States. One section of the law addresses zero-rating specifically and prohibits individual apps from being zero-rated, but it allows for entire categories such as music or video to be zero-rated. Notwithstanding many opponents harshly critique the California law, the FCC has explicitly stated that it does not consider the regulation of zero-rating to be detrimental.12 This position allows states to experiment and develop their own strategies within the overarching federal framework. Such an approach promotes innovative solutions that can address regional needs and preferences, contributing to a dynamic environment for internet services and consumer protection.

In 2024, the FCC once again addressed the issue of zero-rating with its Net Neutrality Order highlighting several key concerns, including:
* the preferential treatment of certain products over others, particularly through paid agreement or affiliations;
* potential harm to the open internet, akin to the issues associated with paid prioritisation;
* undue advantage given to large providers;
* the creation of negative externalities that elevate costs across the market, stifling innovation and disrupting the virtuous cycle;
* the hindering of consumers’ ability to choose, access, and utilise broadband internet service or the internet content, applications, services or devices of their choice.
To address these potential risks, the FCC proposed to evaluate zero-rating programs under a multi-factor analysis within its general conduct standard, which allows for case-by-case assessments. Indeed, the FCC acknowledges that some zero-rating programs may offer potential benefits or are less likely to cause concerns such as, for instance, zero-rating products during low traffic hours or within the same category of products.

This flexible approach was intended to strike a balance between encouraging beneficial innovations and limiting practices that could distort the market or harm consumers. However, following the appeal brought by broadband providers against the FCC Net Neutrality Order 2024, as of today, there is no enforcement against zero-rating practices at a federal level and uncertainty prevails.

====References====
{{reflist}}

Module 1: Infrastructures

2024-10-03T12:43:01Z

Erikads: /* Federal Regulatory Framework */

== Net Neutrality and Zero-ratings ==
[https://eur-lex.europa.eu/EN/legal-content/glossary/open-internet-and-net-neutrality.html#:~:text=Net%20neutrality%20is%20the%20principle,%2C%20blocking%2C%20throttling%20or%20prioritisation Net neutrality] is the principle that internet service providers (ISPs) treat all online traffic equally and openly, without discrimination, blocking, throttling or prioritisation. [https://www.berec.europa.eu/en/what-is-zero-rating Zero-rating] is a commercial practice whereby an internet access provider applies a zero tariff, or a tariff that is more advantageous, to all or part of the data traffic associated with an application or category of specific applications, offered by partners of that access provider.

=== Brazil ===
====The legal framework and relevant regulatory actors for telecommunications in Brazil====
The national government of Brazil is competent to organize, regulate and investigate the telecommunication sector. This competency is laid down in Law No. 9472/1997, the General Telecommunications Law. The telecom sector should be organized and based on free, broad and fair competition, according to this law. Brazil has no strict limitations on foreign ownership on telecommunication service providers, other than that such companies ought to be organized in accordance to Brazilian law.
=====Anatel=====
The General Telecommunications Law also established the Brazilian national telecom authority, Anatel. Its main tasks are:
* construct policies for granting, providing and using telecommunication services in both the public and private sector
* implement national policies for telecommunications sector, issued by the Brazilian government
* conduct investigations
* issue sanctions for violating provisions in the telecom legislative framework
Most regulation of telecommunications services in Brazil is ex ante, and some provisions also look at the regulation of competition aspects for the market. More specifically Anatels resolution No. 600/2012 provides several guidelines for:
* competition aspects;
* measures concerning transparency, isonomic and non-discriminatory treatment;
* price control;
* the obligation of access and provision of specific network resources;
* the offer of wholesale products according to conditions set by such agency;
* obligations aimed to remedy specific market failures or to comply with the legal and regulatory rules in force; and
* accounting, functional or structural separation.
=====The Brazilian Internet Steering Committee=====
The Brazilian Internet Steering Committee (CGI.br), coordinates and integrates all Internet service initiatives in Brazil, promotes technical quality, innovation, and dissemination of Internet services. Its main tasks include:
* propose policies and procedures regarding regulation of Internet activities;
* recommend standards;
* establish strategic directives;
* coordinate allocation of Internet addresses and registration in the .br domain.
Anatels regulatory parameters and guidelines, which are in turn established by Brazil’s Internet Steering Committee (CGI.br)

=====CADE=====
Another important regulatory body in Brazil is CADE (Administrative Council for Economic Defence), which is the national antitrust authority. For some competition aspects of Anatels regulation, CADE may need to analyse and approve Anatels work, according to Law No. 12,529/2011.
=====The Internet Law (2014)=====
In 2014, the Internet Law was created (Law No. 12.965/2014). This piece of legislation sets out specific conditions and standards for net neutrality and zero-rating. More specifically, preserving and ensuring net neutrality is one of its core principles for using the internet in Brazil (Article 3). Net neutrality is further addressed in article 9, which states that the party in charge of the transmission, switching or routing has the duty to process any conveyed information in a neutral manner. As a result, throttling (intentionally slowing down the speed of a service) is also not allowed. There are some exceptions to this rule, for instance when internet traffic discrimination is necessary for technical reasons or to prioritise emergency services (Article 9). For instance, during the COVID-19 pandemic, mobile network operators were requested to provide zero-rating access for all mobile plans to health applications.
In such exceptional situations, service providers have to take in account some precautions to:
* not cause damage to users
* act with proportionality, transparency and equality to the internet traffic
* inform users pre-emptively in a clear and transparent manner, and take traffic management, mitigation practices and network security into account
* offer services in a non-discriminatory manner for commercial use, and;
* refrain from anticompetitive conduct (Art. 9)

=====Subsequent Decree (2016)=====
In 2016, Law No. 12.965/2014 was complemented by Decree 8871/2016. This Decree specifies technical requirements for the adequate provision of services and applications. These technical requirements shall aim to maintain their stability, safety, integrity, and functionality which arise from:
* Addressing network security issues, such as restriction of mass mailings (spam) and control of denial of service attacks; and
* Handling of exceptional congestion situations of networks, such as alternative routes in cases of main route interruptions and emergencies.

According to article 6 of the decree, such technical measures have to be consistent with international standards and should be in accordance with Anatels regulatory parameters and guidelines, which are in turn established by Brazil’s Internet Steering Committee (CGI.br). On a more technical level, article 9 and 10 of the Decree reinforce net neutrality and the prohibition of anti-competitive treatment of online service providers (i.e. zero-rating). The decree regulates the commercial relationships between the infrastructure operator and actors in the ‘logical’ layer, who cannot “compromise the public and unrestricted nature of Internet access,” “prioritize data packets due to commercial arrangements,” or favor applications offered by the infrastructure operator itself. In short, the decree prohibits zero-rating strategies and determines that content companies must have legal headquarters in Brazil.”

=====Zero-rating allowed after all?=====
However, the zero-rating prohibition was challenged, and successfully so, in 2017. What happened was that an alleged violation of net neutrality was taken by the Public Prosecutor’s Office to CADE, Brazil’s anti-trust authority. The complaint constituted that four major mobile network operators, namely, Claro, Oi, TIM Brasil and Telefônica Brasil, who control almost the entire market, had supposedly adopted discriminatory commercial practices. They were accused of offering their users data plans that differentiate the conditions of access to certain Internet services, through the charging of reduced amounts or even the total exemption from charge (i.e. zero-rating). In another model, called "sponsored access", the holder of the application supposedly remunerates the provider for the data traffic generated by its users. The complaint was that such offers to access apps without consumption of data franchising were a violation of the Brazilian Civil Rights Framework for the Internet. Anatel was notified of this complaint, but was of the opinion that this did not constitute a violation of the relevant provisions in the Internet Law (No. 12.965/2014). Their reasoning was that zero-rating is allowed, as long as it applies to the same class of services. Following Anatel's view on the matter, according to which the zero rating "has economic rationality and generates, undeniably, noticeable well-being via consumer and producer surplus", CADE decided to consider that zero rating should not be prohibited ex ante. CADE stated that these offers are “not expressly prohibited, not discriminatory, provide free access under the same conditions, and that, in practice, they would not have an adverse impact on market concentration.” PROTESTE, a consumer rights group, appealed this decision, “arguing that CADE did not consult with other actors and that, for example, in the case of pre-paid plans, these are used by lower-income sectors, and, since there are mostly zero-rating offers with Facebook and WhatsApp, the aspect of competition and market concentration regarding applications becomes fragile and unfounded.”

This decision was heavily protested by the Brazilian Civil Rights Framework for the Internet Watch. Their view of zero-rating in this case was that (direct quote:) “By subsidizing some applications and creating a fee - that is, the consummation of the franchise - to access the others, zero rating practices can transform the nature of the Internet from a general purpose network, whose modalities of use are defined autonomously by each user, into a network whose purposes are established in a centralized manner by operators. Such an evolution would limit users' Internet experience, discouraging them from venturing beyond the services provided to them free of charge, and would greatly limit the ability to create and disseminate new applications and introduce new competitors to the market. Clearly, this scenario is opposite to what the principle of neutrality aims to promote.” In short: the window for innovation would shrink as a direct result of a more competitive market because certain applications are offered through zero-rating. Moreover, the civil rights group claims, Zero rating practices increase the well-being of the consumer of the services included in the zero rating plans, as well as the providers of these services. They do not increase the well-being of the Internet access consumer, whose choice is dramatically reduced, nor of service providers excluded from the zero rating.

====The Brazilian telecommunications market and its regulation====
=====About operators=====
In Brazil, there are four main operator groups that dominate the mobile telecom market: Telefónica (33,60%), América Móvil (22%), Oi (15.70), and Telecom Italia. The market seems to follow a pro-competitive model. Oi, the fourth-largest operator, provides zero rating for almost all of their plans, but this has not led to significant market growth.

=====About internet usage among the population and costs=====
Most people in Brazil use their mobile phone to access the internet. Since 2016, there has been a steady growth in the coverage of the 4G network (66.68% in 2016 compared to 92.36% in 2022), the number of mobile cellphone and broadband subscriptions, and the percentage of Wi-Fi connection time for mobile Internet users has also increased (from 58.55% in 2016 to 68.2% in 2022). In 2022, the most used mobile social networks in Brazil were, in order, WhatsApp, Instagram, Facebook, TikTok and Facebook Messenger. (p.12) The price of roaming in Brazil has steadily decreased since 2017. This is mostly due to a higher number of operators and a good deployment of 4G mobile access networks. It led to a reduction in access costs, especially for mobile broadband. The affordability is mostly calculated as a percentage of average income, where the aim is that the price of 1 GB of data should not exceed 2% of a person’s average monthly income (the so-called “1 for 2” limit).

Brazil has also seen an increase in app development and digital skills. This, according to one article on the topic, is likely due to a high level of naitonal technological innovation capacity. The article therefore questions whether zero-rating is a risk for the digital market, although it could still pose a risk to the content sector.

=====About zero-rating=====
Generally, in South America, zero-rating is a dominant commercial strategy. The main zero-rating models that are deployed by MNOs, which are promoted by the operators themselves. “They also offer some vertically integrated, lower-cost Internet services, with the same operators providing their own and third-party content, such as messaging and calls (WhatsApp, Line, Messenger), music (Spotify, Deezer), and video (YouTube, Movistar Play, ClaroTv, Oi Play, Amazon Video, and Netflix).”

=====Effects of net neutrality and zero-rating on the market competition in Brazil=====
In general, and in comparison, to other countries in the region, the impact of zero-rating on network neutrality and competition in Brazil is a bit complex. On the one hand Brazil’s mobile markets are less concentrated than its neighbors’, implying more competition in the MNO market. On the other hand, smaller and local app development and content is limited due to the zero-rating of major applications by major MNOs. Zero-rating thus creates certain barriers of entry for smaller competitors. Furthermore, MNOs may also apply zero-rating to their own applications (vertical integration), as long as they don’t discriminate against apps developed by others in the same field. These negative effects are, nevertheless, may be somewhat mitigated by Brazil’s competitive market and government emphasis on digital skills development. Still, the research found no positive relationship between zero-rating and increased mobile access or lower prices.

====Sources used====
* OECD, Digital Trade Review of Brazil (OECD 2022) <https://www.oecd-ilibrary.org/trade/digital-trade-review-of-brazil_0b046dfe-en> accessed 24 September 2024.
* Miguel Botto-Tobar, Henry Cruz and Angela Díaz Cadena (eds), ‘Artificial Intelligence, Computer and Software Engineering Advances: Proceedings of the CIT 2020 Volume 1’ (Springer International Publishing 2021) <https://link.springer.com/10.1007/978-3-030-68080-0> accessed 24 September 2024.
* Roberto Triviño, Antonio Franco and Rafael-Leonardo Ochoa-Urrego, ‘Evaluating Zero Rating: A Comparative Analysis of Four South American Countries’ (2024) 5 Digital Government: Research and Practice 1.
* Website: Observatorio do Marco civil da Internet (05/12/2017). Accessed 24/09/2024: https://www.omci.org.br/jurisprudencia/207/neutralidade-de-rede-e-ordem-economica/
* UNESCO, Assessing internet development in Brazil. Using UNESCO internet universality ROAM-X Indicators.
* Law No. 12,965, April 23, 2014 (Marco Civil Law of the Internet in Brazil)
* Decree No. 8771, May 11, 2016
* Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November 2015 laying down measures concerning open internet access and amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services and Regulation (EU) No 531/2012 on roaming on public mobile communications networks within the Union (the Open Internet Regulation)
* Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast)

=== China ===

China follows a governmental control model for internet and telecommunications regulation. Under this model, the government has control of all aspects of the internet, including who is allowed access, what content is accessible, and the rate of delivery of that content. China can be considered as the most controlling jurisdiction of internet content and is not in support of network neutrality. Access to the internet in China from the outside world is limited and all Internet traffic in China must pass through one of three large computer centers in Beijing, Shangai and Guangzhou. The Chinese government maintains control over China’s gateways to the global internet, giving authorities the ability to cut off cross-border information requests in order to restrict connectivity or access to content hosted on servers outside the country. This arrangement is the foundation for the ‘Great Firewall’, which is considered the world’s most sophisticated internet censorship program.

Another strategy for control of the internet in China is that state-owned companies dominate the ISP sector of the mobile market: China Mobile, China Telecom, and China Unicom. In 2019, British Telecom (BT) became the first foreign telecommunications company to receive permission to provide internet services across the country. Authorities exercise tight control over cybercafes and other public access points, which are licensed by the Ministry of Culture in cooperation with other state entities.

Another key part of the regulation of the telecommunications sector in China is content management, or censorship. This is not the focus of this Wiki. We address elements of cybersecurity or censorship laws as they relate to the infrastructure elements of the telecommunications sector in China (such as from the Cybersecurity Law 2017). Accordingly, the law we focus on here is the '''Telecommunications Regulation 2000'''. Before we jump into the legal framework, we explain first the policy context and then the market structures.

===== Policy Context =====
Chinese internet policy shows distinct features at different stages, heavily influenced by the political thinking and outlook of the leadership at the time as well as China’s social, economic and political conditions.

The early phase, before a period of reform in the 1980s, saw telecommunications under strict state control, with limited infrastructure and services primarily serving governmental needs. Post-1980s economic reforms introduced a gradual liberalisation, allowing room for infrastructural growth and services expansion. This led to the implementation of the Telecommunications Regulation in 2000, establishing a legal framework that aimed to separate government functions from business operations, reduce monopolistic practices, and promote competition and innovation (Article 4). The turn of the millennium saw a rapid acceleration in policy evolution market competition, marked by China's accession to the World Trade Organization ('''WTO''') in 2001.

Before 1998, the telecommunications regulator was the Ministry of Posts and Telecommunication (MPT). Until 1994, the MPT was instrumental in promoting the development of the Chinese telecommunications sector. During this period, the telecoms industry was monopolized and there was no clear distinction between the functions of government and enterprises. From 1998, competition has been introduced into the telecom market, with the creation of a second communications network operator, China Unicom. The second stage started with the establishment of Ministry of Information Industry (MII) in 1998. It became the principal regulator of the telecommunications and information industry and was initially granted operational control over both China Telecom and China Unicom. During 1999 and 2000, China Telecom and China Unicom were restructured to promote greater competition, creating a total of seven distinct Chinese state-owned telecommunications providers each with primary operations in a different functional aspect. Yet, given the relatively low accessibility of telecommunications to the Chinese population, Chinese telecommunications policy remained oriented towards the development of telecommunications infrastructures. With the adoption of the Telecommunications Regulation in 2000, telecommunications regulation entered the stage of regulation according to laws, and a regulatory framework has been established.

The situation shifted in in 2001 with China admission to the WTO. Obligations under the WTO required China to adopt telecommunications regulations to introduce and promote market competition, to protect the rights and interests of consumers and to increase the welfare of consumers. This era led to further reforms, including the restructuring of state-owned enterprises (SOEs), the introduction of foreign investment in the telecommunications sector, and an emphasis on digitalisation. Establishment of MIIT (ministry of Information Technology in 2008, the Antimonopoly Law (AML) was finally adopted in 2007 and became effective in 2008. Similar to competition rules in other jurisdictions, the AML also prohibits anti-competitive agreements (Chapter II), abusing dominant positions (Chapter III), and anticompetitive mergers (Chapter IV).

===== Net Neutrality in China and the Great Firewall =====
A key part of the regulatory framework of the internet in China is the Great Firewall. Although the Great Firewall is inherently content moderation, not specifically related to net neutrality, it is important to understand in order to view internet regulation through the norms of the Chinese political framework.

The Great Firewall controls how internet content is distributed to citizens; what they can and cannot access. While the principle of net neutrality suggests citizens should be able to access different products on the internet without discrimination, the Great Firewall imposes this discrimination as government policy. In other words, net neutrality is not a principle considered in Chinese internet policy, and the policy position is pro-discrimination via content management in the name of national security.

The Great Firewall means that any new domain or platform which wants to enter Chinese cyberspace must adhere to domestic regulations. Consequently, domains that do not adhere to domestic regulations are banned; Facebook, Twitter, YouTube, Wikipedia, and Instagram.

Technologically, the Great Firewall is made up of two software’s:
# Last mile providers of internet services to consumers automatically filter suspicious references, also considered access requests; and
# ISPs implement filters that blocked Chinese websites, also called interconnecting networks.

The GFW relies on filtering methods like blocking Internet Protocol (IP) address, Transmission Control Protocol (TCP) packet filtering and forging, Domain Name System (DNS) spoofing, redirection, and filtering Uniform Resource Locator (URL) by transparent proxies.

The implication of this system is that net neutrality - the equality of access by citizens to different parts of the internet - is not a consideration, as discrimination of content to “advance the dissemination of core socialist values” (Art 6, CSL) is inherent in the internet policy of the state in the name of cyber security.

==== Telecoms Regulation in China ====
The Chinese government structures its regulations to control political risks through carefully designed institutional arrangements, control of network operation, and tight regulations on end-users.
The legal foundation of telecommunication regulation is stated in China’s State Council Order 195, ‘Interim Regulations on International Interconnections of Computer Information Networks in the PRC’. (PRC meaning People’s Republic of China.) Order 195 granted the Steering Committee on National Information Infrastructure, part of the Ministry of Information Industry, primary regulatory responsibility for China’s internet, which includes determining and coordinating important issues of international interconnections.

:: ''Primary telecoms regulator: Steering Committee on National Information Infrastructure''

In the internet server provision sector, Order 195 divides China’s Internet networks into two categories:
# interconnecting networks and
# access networks.

====== ''Interconnecting networks'' ======
: Interconnecting networks are directly linked to the global internet through international leased lines and must have the approval of the State Council in order to operate. These interconnecting networks assume heavy and important responsibilities of internet regulation, including responsibility for online content blocking and filtering.
: In this area, only four licences have been granted - CERNet and CSTNet and ChinaNet and ChinaGBN. These four interconnecting networks are tied closely to government agencies. ChinaNet is operated by China Telecom, which falls under control of the Ministry of Information Industry (MIIT).

====== ''Access networks'' ======
: The Chinese access networks are the equivalent of internet service providers (ISPs), providing access and content services but no direct global interconnection. An access network provider has to be licenced by and gain global access through one of the four interconnecting networks. ISPs are key to filtering the huge number of sensitive words on the blacklist. In such circumstances, Chinese ISPs are more political than commercial.

: In summary, the provision of internet to consumers resembles:

:: Global internet ➡ Interconnecting network ➡ Access Network ➡ Consumer

==== Telecommunications Regulations ====
The Telecommunications Regulations, first issued in 2000 and then revised in 2016, covers licensing, fee collection, interconnectivity, operation and regulation of telecoms services in mainland China. The Classified Catalogue of Telecommunications Services, effective from 1 March 2016, sets out the specific and categories of services that are regulated under the telecommunications licensing regime. These regulations provides general regulations on domestic telecommunication services, including the licensing of telecommunication services, the provision of telecommunication services, the construction of telecommunications facilities and telecommunications security.

The aim of these regulations are to regulate the order of the telecommunications market, safeguard the legitimate rights and interests of telecommunications subscribers and operators, ensure the safety of telecommunications networks and information, and to promote the sound development of telecommunication industry (article 1). The regulations are addressed to anyone that engage in telecommunications activities or telecommunications-related activities (article 2). Article 4 provides that the supervision and regulation of the telecommunications industry shall be based on the principles of separation of government administration from enterprise management, elimination of monopoly, encouragement of competition and innovation, as well as principle of openness, fairness and impartiality. Under article 5, telecommunications operators shall provide telecommunication subscribers with services that are fast, accurate, secure, convenient and reasonably-priced.

The Telecommunications Regulation is mainly comprised of two substantial chapters for the purpose of promoting competition.

====== ''Licencing scheme'' ======
: As far as market entry is concerned, a two-layer authorisation mechanism is established based firstly on services and secondly on geographic coverage. In terms of services, Category I of basic telecom services and satellite facilities (Category II of basic telecom services) are exclusively licensed by the Ministry of Industry and Information Technology (MIIT), and are so far only awarded to the three SOEs. With regard to other telecom services, intra-provincial operation licenses are administered by provincial-level telecom authorities while inter-provincial ones are authorised by the MIIT.

====== ''Cybersecurity Law'' ======
: The Cybersecurity Law (CSL) establishes the overarching security framework relevant to internet traffic in China, including the governing of internet infrastructure (Art 2 CSL). To safeguard data sovereignty, the CSL imposes data localisation requirements on critical information infrastructure operators. Other relevant obligations in the CSL are:

:: * Article 9: Network operators shall, when conducting business operations and providing services abide by laws and administrative regulations, respect social morality, observe business ethics, operate in good faith, perform their obligations to safeguard cybersecurity, accept supervision by the government and the public, and undertake social responsibilities.
:: * Article 12: The State shall protect the rights of citizens, legal persons and other organisations to use networks in accordance with the law, promote improved network access, provide better network services, provide the public with secure and convenient network services, and guarantee the lawful, orderly and free circulation of network-based information.

: It is unclear what is meant by reference to ‘social morality’ and ‘business ethics’, but that we view this through the prism of Chinese international relations and our understanding of societal values - essentially connecting these ideas to community, state-first control of information. This is not translatable to European norms associated with fundamental rights and the single internal market.

==== Other related legislation ====
Other related legislation includes:
* State Council - Regulations on Security Protection of Computer Information Systems, Administrative Measures for Internet Information Services
* The national intelligence law
* Ministry of Public Security - Administrative Measures for Prevention and Treatment of Computer Viruses
* Ministry of Public Security and five other ministries - Administrative Measures for Hierarchical Protection of Information Security
* NPC Standing Committee - Law on Guarding State Secrets

==== Sources ====

The above information is based on our consideration of the Telecommunications Regulations, Cybersecurity Law and the following secondary sources:
* Hu, Henry L. “The Political Economy of Governing ISPs in China: Perspectives of Net Neutrality and Vertical Integration.” The China Quarterly, Volume no. 207 (2011) 523–40. Available here: http://www.jstor.org/stable/41305255
* Pranavnayar 'The Legality of China’s Great Firewall: How Does the International Law Fare' Metacept 6 June 2021 <https://metacept.com/the-legality-of-chinas-great-firewall-how-does-the-international-law-fare/
* Christine M. Stover, ‘Network Neutrality: A Thematic Analysis of Policy Perspectives Across the Globe’ [2010] Global Media Journal Volume 3(1) pp. 75-86
* Bernd Holzenagel, Xu Junqi and Thomas Hart, ‘Regulating Telecommunications in the EU and China: What Lessons to be Learned?’ Arbeitsberichte Zum Informations-, Telekommunikations- Und Medienrecht Volume 16 [2009]
* Martyn Taylor, ‘Reforming China’s telecommunications law: lessons from the Australian experience’, International Journal of Communications Law and Policy Issue 7 [Winter 2002/2003]
* Becky P Y Loo, ‘Telecommunications reforms in China: Towards an analytical framework’ Telecommunications Policy 28 [2004] pp 679-714
* Report from US Embassy Beijing [2024] Available at: https://irp.fas.org/world/china/netreg.htm
* Zixiang Alex Tan, ‘Regulating China’s Internet: convergence toward a coherent regulatory regime’ Telecommunications Policy Volume 23, Issues 3-4, [1999] pp. 261-276
* Grace Wang, ‘Telecoms regulations in China’ Lexology [2022] Available at: https://www.lexology.com/library/detail.aspx?g=c8e8fd3d-4989-4db0-8887-45fd7a86f1a5
* Liyang Hou, ‘When competition law meets telecom regulation: the Chinese context’ Computer Law and Security Review 31(5) [2015]

=== India ===

The Indian regulatory framework currently features a strong commitment to net neutrality and a ban on zero rating. The development of this framework, however, cannot be understood without due attention paid to the legislative players in India and the context of the proliferation of zero rating services in 2015. Consequently, this section outlines the regulatory authorities responsible for telecommunications regulation in India, the resulting regulatory framework relating to net neutrality and zero-rating, and further challenges to net neutrality and food for thought.
India has a Department of Telecommunications (DoT) which is responsible for setting out its telecommunications policy. Under section 3 of the Telecom Regulatory Authority of India Act by the DoT, the Telecom Regulatory Authority of India (TRAI) was established as a statutory body of the DoT.

===== Zero rating: Facebook's "Free Basics Ban" =====

The debate on net neutrality followed primarily from the debate on the zero rating due to the proliferation of zero rating packages in 2015, the most notorious of which included Facebook’s “Free Basics” service and Airtel’s zero rating platform for app developers. In India, only around 50% of the population purchased data plans for their smartphones, and out of those who used it, it was shown that the average data package used was around 80MB per month in 2015. Therefore, due to the small data packages, zero rating was an attractive and reliable service.
The problem arose with the introduction of Facebook's zero rating model with Internet Access Providers, which included a service called Internet.org, which despite its misleading name offered exclusively Facebook services free of charge under the “Free Basics” model. Internet.org was meant to be an open platform that gives Indian developers additional services offered for free, used by those users who could not afford traditional internet access. Nevertheless, only partner websites and applications would be able to be included, ultimately going against the principles of net neutrality.
As a result of the misleading and untransparent, in 2016, TRAI published the “Prohibition of Discriminatory Tariffs for Data Services Regulations, 2016” which prohibited zero rating. Article 3 of the aforementioned regulation outlines this prohibition, whilst Article 4 stipulates a potential derogation for providing emergency services “or at times of grave public emergency.” However, the telecom provider must notify this reduced tariff to TRAI and the authority’s decision on its compliance with the Discriminatory Tariffs Regulation is final.

===== Net neutrality =====

The ban on zero rating was followed up with an overarching debate on net neutrality. Both TRAI and a Committee under the DoT consequently released papers advocating for the adoption of net neutrality principles throughout telecommunication legislation. As a result, the DoT signed off on TRAI’s recommendation to wholly support net neutrality principles and amended numerous parts of its core telecommunication legislation to integrate such principles. In 2018, the DoT amended the “Unified License for Telecom Service Providers (TSPs) and Unified License (Virtual Network Operators) and Unified Access License Agreement to incorporate the principles of non-discriminatory treatment of content.” In 2019, further amendments occurred regarding the Internet Service Provider License for Regulatory Framework. Some exemptions are present regarding the principles of non-discriminatory treatment of content and/or traffic for when “quality of service is essential,” such as in the cases of autonomous vehicles.
Despite these net neutrality principles, there remains the problem of the Indian government’s ability to legally order ISPs to block access to certain content, either for its own purposes or due to court orders. Whilst India’s net neutrality principles do not presuppose such government requests as violations per se, the problem lies in the perceived clash between the legislative provisions. For example, such government orders would be permissible as long as the measures adopted by the ISP are “proportionate, transient, and transparent;” however, the rules regarding the blocking of content stipulate a legal requirement to maintain the confidentiality of blocking requests and subsequent actions.

==== Opposition to net neutrality ====

Additionally, some scholars critique India’s strict approach to net neutrality due to the rapid developments in the internet space. For example, “complexities such as vertical partnerships between [internet service providers (ISPs)] and [content and application providers],” content delivery networks, and the deployment of 5G show the limits of India’s ex-ante net neutrality approach. As a result, further ex-post enforcement may be necessary to bolster net neutrality in India.

In sum, India’s regulatory framework started with a ban on zero rating as a result of controversy arising from the proliferation of zero rating with services such as Facebook’s “Free Basics.” This later erupted in a political debate on whether India should, as a result, commit fully to net neutrality, which was ultimately answered in the positive when the DoT implemented TRAI’s recommendations throughout India’s various telecommunications regulations. However, criticisms remain about the limited exceptions to net neutrality rules, and the Indian government’s eager censorship through blocking requests to ISPs may still pose threats to a free internet in India.

==== Sources ====

* The Telecom Regulatory Authority of India Act [1997] 199724 <https://www.indiacode.nic.in/handle/123456789/1929>.

* Jon Russel, ‘Under Fire In India, Facebook’s Internet.org Launches In Indonesia’ (TechCrunch, 2015) <https://techcrunch.com/2015/04/20/internet-dot-org-indonesia/>.

* Parmy Olson, ‘This App Is Cashing in on Giving the World Free Data’ (Forbes, 29 July 2015) <https://www.forbes.com/sites/parmyolson/2015/07/29/jana-mobile-data-facebook-internet-org/>, cited in Luca Belli, ‘Net Neutrality Reloaded: Zero Rating, Specialised Service, Ad Blocking and Traffic Management’ (2016) Annual Report of the UN IGF Dynamic Coalition on Net Neutrality.

* Lok Sabha Secretariat, ‘Net Neutrality: India's Position,’ (Parliament Library And Reference, Research, Documentation And Information Service, 2016) Reference note No.6/RN/Ref./February/2016.

* Prohibition of Discriminatory Tariffs for Data Services Regulations [2016] <https://trai.gov.in/sites/default/files/Regulation_Data_Service.pdf>.

* Ministry of Communications, ‘Net Neutrality in India’ (Press Release 1884064, 2022) <https://pib.gov.in/PressReleasePage.aspx?PRID=1884064>.

* Shruti Dhapola, ‘Net Neutrality rules approved by government; Internet to remain free and open in India’ (The Indian Express, 2018)<https://indianexpress.com/article/technology/tech-news-technology/net-neutrality-rules-now-approved-by-telecom-commission-india-internet-timeline-5256139/>

* BBC, ‘India adopts 'world's strongest' net neutrality norms’ (BBC, 2018) <https://www.bbc.com/news/world-asia-india-44796436>.

* The Wire Staff, ‘India Approves New Net Neutrality Rules, Signs off on New Telecom Policy’ (The Wire, 2018) <https://thewire.in/tech/india-approves-new-net-neutrality-rules-signs-off-on-new-telecom-policy>.

* Smriti Parsheera, ‘Net neutrality in India: From rules to enforcement’ (Medianama, 2020) <https://www.medianama.com/2020/05/223-net-neutrality-india-rules-enforcement/>.

* Raghuvansh Seth, ‘Fleeting neutrality: The inadequacies of the ex-ante net neutrality regulations in India’ (2022) 23 Competition and Regulation in Network Industries 1.

=== United States ===
==== Federal Regulatory Framework ====
To the extent that Internet Service Providers (ISPs) are regulated by the United States (US) Congress, it is under the '''[https://en.wikipedia.org/wiki/Communications_Act_of_1934 Communications Act of 1934]''', as amended by the '''[https://en.wikipedia.org/wiki/Telecommunications_Act_of_1996 Telecommunications Act of 1996]'''.

Pursuant to Sec. 1, the purpose of this Act is to regulate
:‘interstate and foreign commerce in communication by wire and radio so as to make available, so far as possible, to all the people of the United States [...] a rapid, efficient, Nation-wide, and world-wide wire and radio communication service with adequate facilities at reasonable charges’.
Sec. 230(b) outlines the policy specifically with respect to the Internet. It is, inter alia, ‘to promote the continued development of’ and ‘to preserve the vibrant and competitive free market for’ the Internet.

Pursuant to Sec. 2(a), this Act applies ‘to all interstate and foreign communication by wire or radio[, and] transmission of energy by radio, [...] and to all persons engaged’ in such pursuits. It also applies ‘to all persons engaged [...] in providing [cable] service’.

To ensure the ‘effective execution of this policy’, Congress created the Federal Communications Commission (FCC) under the Communications Act of 1934.

Yet, the Commission’s authority to regulate the addressees of this Act depends crucially on whether they fall under Title I (‘information service’) or Title II (‘common carrier service’). Common carrier services are expressly prohibited from granting preferential treatment:
:‘It shall be unlawful for any common carrier to make any unjust or unreasonable discrimination in charges, practices, classifications, regulations, facilities, or services for or in connection with like communication service, directly or indirectly, by any means or device, or to make or give any undue or unreasonable preference or advantage to any particular person, class of persons, or locality, or to subject any particular person, class of persons, or locality to any undue or unreasonable prejudice or disadvantage.’
To ensure reasonable pricing rates and non-discriminatory practices, the Communications Act of 1932 grants the FCC broad regulatory authority under Title II. In contrast, Title I services remain mainly unregulated by the FCC.

However, the term ‘information service’, which is defined as ‘the offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making available information via telecommunications’ [sic!], and the term ‘common carrier service’, which is defined as a person ‘engaged as a common carrier for hire’, in any of the pursuits mentioned above, are ambiguous when it comes to ISPs.

So far, the FCC has been responsible for the interpretation of these terms, as affirmed by the Supreme Court in ''National Cable & Telecommunications Association v. Brand X Internet Services'' (2005).

As the Commission’s Commissioners are ‘appointed by the President, by and with the advice and consent of the Senate’, the Commission’s stance on the classification of ISPs and the corresponding regulatory regime has always depended on the administration in power. This has led to relatively frequent shifts in administrative practice in the past.

During the Obama administration (2009-2017), the FCC classified ISPs as Title I services and introduced net neutrality principles in the '''[https://en.wikipedia.org/wiki/Federal_Communications_Commission_Open_Internet_Order_(2010) FCC Open Internet Order 2010]'''. However, the Court of Appeals for the District of Columbia Circuit in ''Comcast Corp. v. FCC'' (2010) and ''Verizon Communications Inc. v. FCC'' (2014) ruled that the FCC lacked the authority to enforce these principles on Title I services. Thus, the FCC reclassified ISPs under Title II in the '''[https://docs.fcc.gov/public/attachments/FCC-15-24A1.pdf FCC Open Internet Order 2015]''', enshrining net neutrality principles. This (first) reclassification was upheld by the Court of Appeals for the District of Columbia Circuit in ''United States Telecom Association v. FCC'' (2016).

Under the Trump administration (2017-2021), the FCC reversed course by reclassifying ISPs as Title I services again ('''[https://docs.fcc.gov/public/attachments/FCC-17-166A1_Rcd.pdf FCC Restoring Internet Freedom Order 2018]'''), effectively rolling back federal net neutrality regulations. This (second) reclassification was upheld by the Court of Appeals for the District of Columbia Circuit in ''Mozilla Corp. v. FC''C (2019).

In the Biden administration (2021-present), the FCC decided to restore net neutrality under Title II in the order on ‘Safeguarding and Securing the Open Internet; Restoring Internet Freedom’ ([https://docs.fcc.gov/public/attachments/FCC-24-52A1.pdf FCC Net Neutrality Order 2024)]'' ''in April 2024.Then, in June 2024, providers under the National Cable & Telecommunications Association filed a lawsuit, challenging the FCC’s authority to reclassify ISPs – just after the Supreme Court in'' Loper Bright Enterprises v. Raimondo and Relentless, Inc. v. Department of Commerce ''(2024) overturned the ''Chevron ''deference established in ''Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc. ''(1984). ''Chevron ''deference directed courts to defer to an agency’s reasonable interpretation of ambiguous statutes – specifically, to agency interpretations of congressional statutes that are ‘silent or ambiguous with respect to the specific issue’ at hand –, and was central to previous cases like ''National Cable & Telecommunications Association v. Brand X Internet Services ''(2005). In lieu of ''Chevron, ''the Supreme Court assigned the determination of congressional ambiguity to the federal courts, with executive agency expertise still to be considered under the weaker ''Skidmore'' deference established in ''Skidmore v. Swift & Co. ''(1944). Then, in August 2024, in a per curiam decision, the Court of Appeals for the Sixth Circuit granted a temporary injunction against the FCC’s 2024 Net Neutrality Order as well as a stay, extending an earlier temporary pause. In a concurring opinion, Chief Judge Sutton writes that the FCC’s flip-flopping on net neutrality between administrations makes it difficult to even apply the lower standard of ''Skidmore'' deference – thus, the ISPs challenging the latest iteration of the rule are likely to succeed on the merits. Citing ''Skidmore''', Sutton writes,
:‘an agency’s power to persuade turns on the thoroughness of its reasoning, its technical expertise, and its consistency with earlier and later pronouncements, especially those contemporaneous with the statute’s enactment. [...] The problem is, we do not know which group of experts to respect.’
Sutton adds,
:‘the consistency query makes matters worse. The Commission’s intention to reverse course for yet a fourth time suggests that its reasoning has more to do with changing presidential administrations than with arriving at the true and durable meaning of the law.’
This leaves the Communications Act of 1934, as amended by the Telecommunications Act of 1996, as the central regulatory framework at the federal level.

====State Regulatory Framework====
In response to the FCC’s 2018 Restoring Internet Freedom Order, which rolled back federal net neutrality rules, several states introduced their own legislation to maintain net neutrality. States like California, New York, and Vermont enacted laws prohibiting ISPs from practices such as blocking or throttling content. New York’s ConnectALL program, for instance, prioritises service providers that adhere to net neutrality principles. Additionally, states like Nevada and Minnesota passed laws focusing on ISP privacy and data protections.

The California '''Internet Consumer Protection and Network Neutrality Act of 2018''', which has been lauded as the ‘gold standard’ of net neutrality laws,8 was signed into law in 2018. With the repeal of the FCC’s 2015 Open Internet Order, California sought to restore similar principles at the state level. Although the US Department of Justice initially challenged the law, arguing that federal regulations preempted state rules, the courts ultimately upheld California’s right to enforce its own net neutrality protections.

The law includes several key provisions to ensure an open internet. First, it prohibits ISPs from blocking or throttling lawful internet traffic, ensuring that all users have equal access to content without interference. It also bans paid prioritisation, preventing ISPs from charging content providers for faster delivery speeds, thus maintaining a level playing field for all internet services, regardless of financial power.
Additionally, the law contains a broad prohibition against unreasonable interference, meaning ISPs cannot engage in practices that unfairly disadvantage or restrict access to lawful content and services. This provision serves as a general safeguard against ISP behaviour that might harm competition or limit consumer choice. Finally, the Act requires ISPs to disclose their network management practices transparently, ensuring consumers are informed about any restrictions that might affect their internet access.

====Focus On: Zero-Rating in the US====
With the 2015 Open Internet Order, the FCC addressed and thoroughly analysed the effects of zero-rating and similar practices on competition, consumer welfare and net neutrality. It acknowledged that zero-rating could potentially disrupt the market and encourage the use of restrictive data caps. However, it also noted that, depending on their specific structure, such offerings could provide benefits to consumers (e.g. increased choice and lower costs) and competition (e.g. more investments in broadband infrastructure). The FCC then established a standard under which zero-rating offers would be assessed. In particular, the FCC decided that it would have looked at and assessed such practices ‘under the no-unreasonable interference/disadvantage standard, based on the facts of each individual case, and take action as necessary’.9 As a result, in 2016 the FCC’s Wireless Bureau initiated investigations into whether the zero-rating practices of several wireless service providers were consistent with the 2015 Open Internet Order. For instance, among others, the FCC investigated AT&T for its ‘Data Free TV’ feature of its DIRECTV App, that allowed AT&T Mobility customers who App on a zero-rated basis. The FCC raised many concerns on competition and consumer protection basis, concluding that AT&T seemed to be acting in ways that harmed the open Internet.10

Nonetheless, following the 2016 elections and the changes in the membership of the FCC, the Wireless Bureau closed the investigations arguing that ‘free data plans have proven to be popular among consumers’ and that ‘they have also enhanced competition’.11 This shift in approach led to the repeal of the 2015 net neutrality rules in December 2017. Additionally, the FCC entered into a partnership with the FTC to monitor ISPs and noted that antitrust and consumer protection laws could handle specific cases of anti-competitive behaviour.

As mentioned in paragraph 2., in September 2018, California passed a net neutrality law, considered by many as the strictest in the United States. One section of the law addresses zero-rating specifically and prohibits individual apps from being zero-rated, but it allows for entire categories such as music or video to be zero-rated. Notwithstanding many opponents harshly critique the California law, the FCC has explicitly stated that it does not consider the regulation of zero-rating to be detrimental.12 This position allows states to experiment and develop their own strategies within the overarching federal framework. Such an approach promotes innovative solutions that can address regional needs and preferences, contributing to a dynamic environment for internet services and consumer protection.

In 2024, the FCC once again addressed the issue of zero-rating with its Net Neutrality Order highlighting several key concerns, including:
* the preferential treatment of certain products over others, particularly through paid agreement or affiliations;
* potential harm to the open internet, akin to the issues associated with paid prioritisation;
* undue advantage given to large providers;
* the creation of negative externalities that elevate costs across the market, stifling innovation and disrupting the virtuous cycle;
* the hindering of consumers’ ability to choose, access, and utilise broadband internet service or the internet content, applications, services or devices of their choice.
To address these potential risks, the FCC proposed to evaluate zero-rating programs under a multi-factor analysis within its general conduct standard, which allows for case-by-case assessments. Indeed, the FCC acknowledges that some zero-rating programs may offer potential benefits or are less likely to cause concerns such as, for instance, zero-rating products during low traffic hours or within the same category of products.

This flexible approach was intended to strike a balance between encouraging beneficial innovations and limiting practices that could distort the market or harm consumers. However, following the appeal brought by broadband providers against the FCC Net Neutrality Order 2024, as of today, there is no enforcement against zero-rating practices at a federal level and uncertainty prevails.

====References====
{{reflist}}

Module 1: Infrastructures

2024-10-03T12:36:56Z

Erikads: /* Federal Regulatory Framework */

== Net Neutrality and Zero-ratings ==
[https://eur-lex.europa.eu/EN/legal-content/glossary/open-internet-and-net-neutrality.html#:~:text=Net%20neutrality%20is%20the%20principle,%2C%20blocking%2C%20throttling%20or%20prioritisation Net neutrality] is the principle that internet service providers (ISPs) treat all online traffic equally and openly, without discrimination, blocking, throttling or prioritisation. [https://www.berec.europa.eu/en/what-is-zero-rating Zero-rating] is a commercial practice whereby an internet access provider applies a zero tariff, or a tariff that is more advantageous, to all or part of the data traffic associated with an application or category of specific applications, offered by partners of that access provider.

=== Brazil ===
====The legal framework and relevant regulatory actors for telecommunications in Brazil====
The national government of Brazil is competent to organize, regulate and investigate the telecommunication sector. This competency is laid down in Law No. 9472/1997, the General Telecommunications Law. The telecom sector should be organized and based on free, broad and fair competition, according to this law. Brazil has no strict limitations on foreign ownership on telecommunication service providers, other than that such companies ought to be organized in accordance to Brazilian law.
=====Anatel=====
The General Telecommunications Law also established the Brazilian national telecom authority, Anatel. Its main tasks are:
* construct policies for granting, providing and using telecommunication services in both the public and private sector
* implement national policies for telecommunications sector, issued by the Brazilian government
* conduct investigations
* issue sanctions for violating provisions in the telecom legislative framework
Most regulation of telecommunications services in Brazil is ex ante, and some provisions also look at the regulation of competition aspects for the market. More specifically Anatels resolution No. 600/2012 provides several guidelines for:
* competition aspects;
* measures concerning transparency, isonomic and non-discriminatory treatment;
* price control;
* the obligation of access and provision of specific network resources;
* the offer of wholesale products according to conditions set by such agency;
* obligations aimed to remedy specific market failures or to comply with the legal and regulatory rules in force; and
* accounting, functional or structural separation.
=====The Brazilian Internet Steering Committee=====
The Brazilian Internet Steering Committee (CGI.br), coordinates and integrates all Internet service initiatives in Brazil, promotes technical quality, innovation, and dissemination of Internet services. Its main tasks include:
* propose policies and procedures regarding regulation of Internet activities;
* recommend standards;
* establish strategic directives;
* coordinate allocation of Internet addresses and registration in the .br domain.
Anatels regulatory parameters and guidelines, which are in turn established by Brazil’s Internet Steering Committee (CGI.br)

=====CADE=====
Another important regulatory body in Brazil is CADE (Administrative Council for Economic Defence), which is the national antitrust authority. For some competition aspects of Anatels regulation, CADE may need to analyse and approve Anatels work, according to Law No. 12,529/2011.
=====The Internet Law (2014)=====
In 2014, the Internet Law was created (Law No. 12.965/2014). This piece of legislation sets out specific conditions and standards for net neutrality and zero-rating. More specifically, preserving and ensuring net neutrality is one of its core principles for using the internet in Brazil (Article 3). Net neutrality is further addressed in article 9, which states that the party in charge of the transmission, switching or routing has the duty to process any conveyed information in a neutral manner. As a result, throttling (intentionally slowing down the speed of a service) is also not allowed. There are some exceptions to this rule, for instance when internet traffic discrimination is necessary for technical reasons or to prioritise emergency services (Article 9). For instance, during the COVID-19 pandemic, mobile network operators were requested to provide zero-rating access for all mobile plans to health applications.
In such exceptional situations, service providers have to take in account some precautions to:
* not cause damage to users
* act with proportionality, transparency and equality to the internet traffic
* inform users pre-emptively in a clear and transparent manner, and take traffic management, mitigation practices and network security into account
* offer services in a non-discriminatory manner for commercial use, and;
* refrain from anticompetitive conduct (Art. 9)

=====Subsequent Decree (2016)=====
In 2016, Law No. 12.965/2014 was complemented by Decree 8871/2016. This Decree specifies technical requirements for the adequate provision of services and applications. These technical requirements shall aim to maintain their stability, safety, integrity, and functionality which arise from:
* Addressing network security issues, such as restriction of mass mailings (spam) and control of denial of service attacks; and
* Handling of exceptional congestion situations of networks, such as alternative routes in cases of main route interruptions and emergencies.

According to article 6 of the decree, such technical measures have to be consistent with international standards and should be in accordance with Anatels regulatory parameters and guidelines, which are in turn established by Brazil’s Internet Steering Committee (CGI.br). On a more technical level, article 9 and 10 of the Decree reinforce net neutrality and the prohibition of anti-competitive treatment of online service providers (i.e. zero-rating). The decree regulates the commercial relationships between the infrastructure operator and actors in the ‘logical’ layer, who cannot “compromise the public and unrestricted nature of Internet access,” “prioritize data packets due to commercial arrangements,” or favor applications offered by the infrastructure operator itself. In short, the decree prohibits zero-rating strategies and determines that content companies must have legal headquarters in Brazil.”

=====Zero-rating allowed after all?=====
However, the zero-rating prohibition was challenged, and successfully so, in 2017. What happened was that an alleged violation of net neutrality was taken by the Public Prosecutor’s Office to CADE, Brazil’s anti-trust authority. The complaint constituted that four major mobile network operators, namely, Claro, Oi, TIM Brasil and Telefônica Brasil, who control almost the entire market, had supposedly adopted discriminatory commercial practices. They were accused of offering their users data plans that differentiate the conditions of access to certain Internet services, through the charging of reduced amounts or even the total exemption from charge (i.e. zero-rating). In another model, called "sponsored access", the holder of the application supposedly remunerates the provider for the data traffic generated by its users. The complaint was that such offers to access apps without consumption of data franchising were a violation of the Brazilian Civil Rights Framework for the Internet. Anatel was notified of this complaint, but was of the opinion that this did not constitute a violation of the relevant provisions in the Internet Law (No. 12.965/2014). Their reasoning was that zero-rating is allowed, as long as it applies to the same class of services. Following Anatel's view on the matter, according to which the zero rating "has economic rationality and generates, undeniably, noticeable well-being via consumer and producer surplus", CADE decided to consider that zero rating should not be prohibited ex ante. CADE stated that these offers are “not expressly prohibited, not discriminatory, provide free access under the same conditions, and that, in practice, they would not have an adverse impact on market concentration.” PROTESTE, a consumer rights group, appealed this decision, “arguing that CADE did not consult with other actors and that, for example, in the case of pre-paid plans, these are used by lower-income sectors, and, since there are mostly zero-rating offers with Facebook and WhatsApp, the aspect of competition and market concentration regarding applications becomes fragile and unfounded.”

This decision was heavily protested by the Brazilian Civil Rights Framework for the Internet Watch. Their view of zero-rating in this case was that (direct quote:) “By subsidizing some applications and creating a fee - that is, the consummation of the franchise - to access the others, zero rating practices can transform the nature of the Internet from a general purpose network, whose modalities of use are defined autonomously by each user, into a network whose purposes are established in a centralized manner by operators. Such an evolution would limit users' Internet experience, discouraging them from venturing beyond the services provided to them free of charge, and would greatly limit the ability to create and disseminate new applications and introduce new competitors to the market. Clearly, this scenario is opposite to what the principle of neutrality aims to promote.” In short: the window for innovation would shrink as a direct result of a more competitive market because certain applications are offered through zero-rating. Moreover, the civil rights group claims, Zero rating practices increase the well-being of the consumer of the services included in the zero rating plans, as well as the providers of these services. They do not increase the well-being of the Internet access consumer, whose choice is dramatically reduced, nor of service providers excluded from the zero rating.

====The Brazilian telecommunications market and its regulation====
=====About operators=====
In Brazil, there are four main operator groups that dominate the mobile telecom market: Telefónica (33,60%), América Móvil (22%), Oi (15.70), and Telecom Italia. The market seems to follow a pro-competitive model. Oi, the fourth-largest operator, provides zero rating for almost all of their plans, but this has not led to significant market growth.

=====About internet usage among the population and costs=====
Most people in Brazil use their mobile phone to access the internet. Since 2016, there has been a steady growth in the coverage of the 4G network (66.68% in 2016 compared to 92.36% in 2022), the number of mobile cellphone and broadband subscriptions, and the percentage of Wi-Fi connection time for mobile Internet users has also increased (from 58.55% in 2016 to 68.2% in 2022). In 2022, the most used mobile social networks in Brazil were, in order, WhatsApp, Instagram, Facebook, TikTok and Facebook Messenger. (p.12) The price of roaming in Brazil has steadily decreased since 2017. This is mostly due to a higher number of operators and a good deployment of 4G mobile access networks. It led to a reduction in access costs, especially for mobile broadband. The affordability is mostly calculated as a percentage of average income, where the aim is that the price of 1 GB of data should not exceed 2% of a person’s average monthly income (the so-called “1 for 2” limit).

Brazil has also seen an increase in app development and digital skills. This, according to one article on the topic, is likely due to a high level of naitonal technological innovation capacity. The article therefore questions whether zero-rating is a risk for the digital market, although it could still pose a risk to the content sector.

=====About zero-rating=====
Generally, in South America, zero-rating is a dominant commercial strategy. The main zero-rating models that are deployed by MNOs, which are promoted by the operators themselves. “They also offer some vertically integrated, lower-cost Internet services, with the same operators providing their own and third-party content, such as messaging and calls (WhatsApp, Line, Messenger), music (Spotify, Deezer), and video (YouTube, Movistar Play, ClaroTv, Oi Play, Amazon Video, and Netflix).”

=====Effects of net neutrality and zero-rating on the market competition in Brazil=====
In general, and in comparison, to other countries in the region, the impact of zero-rating on network neutrality and competition in Brazil is a bit complex. On the one hand Brazil’s mobile markets are less concentrated than its neighbors’, implying more competition in the MNO market. On the other hand, smaller and local app development and content is limited due to the zero-rating of major applications by major MNOs. Zero-rating thus creates certain barriers of entry for smaller competitors. Furthermore, MNOs may also apply zero-rating to their own applications (vertical integration), as long as they don’t discriminate against apps developed by others in the same field. These negative effects are, nevertheless, may be somewhat mitigated by Brazil’s competitive market and government emphasis on digital skills development. Still, the research found no positive relationship between zero-rating and increased mobile access or lower prices.

====Sources used====
* OECD, Digital Trade Review of Brazil (OECD 2022) <https://www.oecd-ilibrary.org/trade/digital-trade-review-of-brazil_0b046dfe-en> accessed 24 September 2024.
* Miguel Botto-Tobar, Henry Cruz and Angela Díaz Cadena (eds), ‘Artificial Intelligence, Computer and Software Engineering Advances: Proceedings of the CIT 2020 Volume 1’ (Springer International Publishing 2021) <https://link.springer.com/10.1007/978-3-030-68080-0> accessed 24 September 2024.
* Roberto Triviño, Antonio Franco and Rafael-Leonardo Ochoa-Urrego, ‘Evaluating Zero Rating: A Comparative Analysis of Four South American Countries’ (2024) 5 Digital Government: Research and Practice 1.
* Website: Observatorio do Marco civil da Internet (05/12/2017). Accessed 24/09/2024: https://www.omci.org.br/jurisprudencia/207/neutralidade-de-rede-e-ordem-economica/
* UNESCO, Assessing internet development in Brazil. Using UNESCO internet universality ROAM-X Indicators.
* Law No. 12,965, April 23, 2014 (Marco Civil Law of the Internet in Brazil)
* Decree No. 8771, May 11, 2016
* Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November 2015 laying down measures concerning open internet access and amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services and Regulation (EU) No 531/2012 on roaming on public mobile communications networks within the Union (the Open Internet Regulation)
* Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast)

=== China ===

China follows a governmental control model for internet and telecommunications regulation. Under this model, the government has control of all aspects of the internet, including who is allowed access, what content is accessible, and the rate of delivery of that content. China can be considered as the most controlling jurisdiction of internet content and is not in support of network neutrality. Access to the internet in China from the outside world is limited and all Internet traffic in China must pass through one of three large computer centers in Beijing, Shangai and Guangzhou. The Chinese government maintains control over China’s gateways to the global internet, giving authorities the ability to cut off cross-border information requests in order to restrict connectivity or access to content hosted on servers outside the country. This arrangement is the foundation for the ‘Great Firewall’, which is considered the world’s most sophisticated internet censorship program.

Another strategy for control of the internet in China is that state-owned companies dominate the ISP sector of the mobile market: China Mobile, China Telecom, and China Unicom. In 2019, British Telecom (BT) became the first foreign telecommunications company to receive permission to provide internet services across the country. Authorities exercise tight control over cybercafes and other public access points, which are licensed by the Ministry of Culture in cooperation with other state entities.

Another key part of the regulation of the telecommunications sector in China is content management, or censorship. This is not the focus of this Wiki. We address elements of cybersecurity or censorship laws as they relate to the infrastructure elements of the telecommunications sector in China (such as from the Cybersecurity Law 2017). Accordingly, the law we focus on here is the '''Telecommunications Regulation 2000'''. Before we jump into the legal framework, we explain first the policy context and then the market structures.

===== Policy Context =====
Chinese internet policy shows distinct features at different stages, heavily influenced by the political thinking and outlook of the leadership at the time as well as China’s social, economic and political conditions.

The early phase, before a period of reform in the 1980s, saw telecommunications under strict state control, with limited infrastructure and services primarily serving governmental needs. Post-1980s economic reforms introduced a gradual liberalisation, allowing room for infrastructural growth and services expansion. This led to the implementation of the Telecommunications Regulation in 2000, establishing a legal framework that aimed to separate government functions from business operations, reduce monopolistic practices, and promote competition and innovation (Article 4). The turn of the millennium saw a rapid acceleration in policy evolution market competition, marked by China's accession to the World Trade Organization ('''WTO''') in 2001.

Before 1998, the telecommunications regulator was the Ministry of Posts and Telecommunication (MPT). Until 1994, the MPT was instrumental in promoting the development of the Chinese telecommunications sector. During this period, the telecoms industry was monopolized and there was no clear distinction between the functions of government and enterprises. From 1998, competition has been introduced into the telecom market, with the creation of a second communications network operator, China Unicom. The second stage started with the establishment of Ministry of Information Industry (MII) in 1998. It became the principal regulator of the telecommunications and information industry and was initially granted operational control over both China Telecom and China Unicom. During 1999 and 2000, China Telecom and China Unicom were restructured to promote greater competition, creating a total of seven distinct Chinese state-owned telecommunications providers each with primary operations in a different functional aspect. Yet, given the relatively low accessibility of telecommunications to the Chinese population, Chinese telecommunications policy remained oriented towards the development of telecommunications infrastructures. With the adoption of the Telecommunications Regulation in 2000, telecommunications regulation entered the stage of regulation according to laws, and a regulatory framework has been established.

The situation shifted in in 2001 with China admission to the WTO. Obligations under the WTO required China to adopt telecommunications regulations to introduce and promote market competition, to protect the rights and interests of consumers and to increase the welfare of consumers. This era led to further reforms, including the restructuring of state-owned enterprises (SOEs), the introduction of foreign investment in the telecommunications sector, and an emphasis on digitalisation. Establishment of MIIT (ministry of Information Technology in 2008, the Antimonopoly Law (AML) was finally adopted in 2007 and became effective in 2008. Similar to competition rules in other jurisdictions, the AML also prohibits anti-competitive agreements (Chapter II), abusing dominant positions (Chapter III), and anticompetitive mergers (Chapter IV).

===== Net Neutrality in China and the Great Firewall =====
A key part of the regulatory framework of the internet in China is the Great Firewall. Although the Great Firewall is inherently content moderation, not specifically related to net neutrality, it is important to understand in order to view internet regulation through the norms of the Chinese political framework.

The Great Firewall controls how internet content is distributed to citizens; what they can and cannot access. While the principle of net neutrality suggests citizens should be able to access different products on the internet without discrimination, the Great Firewall imposes this discrimination as government policy. In other words, net neutrality is not a principle considered in Chinese internet policy, and the policy position is pro-discrimination via content management in the name of national security.

The Great Firewall means that any new domain or platform which wants to enter Chinese cyberspace must adhere to domestic regulations. Consequently, domains that do not adhere to domestic regulations are banned; Facebook, Twitter, YouTube, Wikipedia, and Instagram.

Technologically, the Great Firewall is made up of two software’s:
# Last mile providers of internet services to consumers automatically filter suspicious references, also considered access requests; and
# ISPs implement filters that blocked Chinese websites, also called interconnecting networks.

The GFW relies on filtering methods like blocking Internet Protocol (IP) address, Transmission Control Protocol (TCP) packet filtering and forging, Domain Name System (DNS) spoofing, redirection, and filtering Uniform Resource Locator (URL) by transparent proxies.

The implication of this system is that net neutrality - the equality of access by citizens to different parts of the internet - is not a consideration, as discrimination of content to “advance the dissemination of core socialist values” (Art 6, CSL) is inherent in the internet policy of the state in the name of cyber security.

==== Telecoms Regulation in China ====
The Chinese government structures its regulations to control political risks through carefully designed institutional arrangements, control of network operation, and tight regulations on end-users.
The legal foundation of telecommunication regulation is stated in China’s State Council Order 195, ‘Interim Regulations on International Interconnections of Computer Information Networks in the PRC’. (PRC meaning People’s Republic of China.) Order 195 granted the Steering Committee on National Information Infrastructure, part of the Ministry of Information Industry, primary regulatory responsibility for China’s internet, which includes determining and coordinating important issues of international interconnections.

:: ''Primary telecoms regulator: Steering Committee on National Information Infrastructure''

In the internet server provision sector, Order 195 divides China’s Internet networks into two categories:
# interconnecting networks and
# access networks.

====== ''Interconnecting networks'' ======
: Interconnecting networks are directly linked to the global internet through international leased lines and must have the approval of the State Council in order to operate. These interconnecting networks assume heavy and important responsibilities of internet regulation, including responsibility for online content blocking and filtering.
: In this area, only four licences have been granted - CERNet and CSTNet and ChinaNet and ChinaGBN. These four interconnecting networks are tied closely to government agencies. ChinaNet is operated by China Telecom, which falls under control of the Ministry of Information Industry (MIIT).

====== ''Access networks'' ======
: The Chinese access networks are the equivalent of internet service providers (ISPs), providing access and content services but no direct global interconnection. An access network provider has to be licenced by and gain global access through one of the four interconnecting networks. ISPs are key to filtering the huge number of sensitive words on the blacklist. In such circumstances, Chinese ISPs are more political than commercial.

: In summary, the provision of internet to consumers resembles:

:: Global internet ➡ Interconnecting network ➡ Access Network ➡ Consumer

==== Telecommunications Regulations ====
The Telecommunications Regulations, first issued in 2000 and then revised in 2016, covers licensing, fee collection, interconnectivity, operation and regulation of telecoms services in mainland China. The Classified Catalogue of Telecommunications Services, effective from 1 March 2016, sets out the specific and categories of services that are regulated under the telecommunications licensing regime. These regulations provides general regulations on domestic telecommunication services, including the licensing of telecommunication services, the provision of telecommunication services, the construction of telecommunications facilities and telecommunications security.

The aim of these regulations are to regulate the order of the telecommunications market, safeguard the legitimate rights and interests of telecommunications subscribers and operators, ensure the safety of telecommunications networks and information, and to promote the sound development of telecommunication industry (article 1). The regulations are addressed to anyone that engage in telecommunications activities or telecommunications-related activities (article 2). Article 4 provides that the supervision and regulation of the telecommunications industry shall be based on the principles of separation of government administration from enterprise management, elimination of monopoly, encouragement of competition and innovation, as well as principle of openness, fairness and impartiality. Under article 5, telecommunications operators shall provide telecommunication subscribers with services that are fast, accurate, secure, convenient and reasonably-priced.

The Telecommunications Regulation is mainly comprised of two substantial chapters for the purpose of promoting competition.

====== ''Licencing scheme'' ======
: As far as market entry is concerned, a two-layer authorisation mechanism is established based firstly on services and secondly on geographic coverage. In terms of services, Category I of basic telecom services and satellite facilities (Category II of basic telecom services) are exclusively licensed by the Ministry of Industry and Information Technology (MIIT), and are so far only awarded to the three SOEs. With regard to other telecom services, intra-provincial operation licenses are administered by provincial-level telecom authorities while inter-provincial ones are authorised by the MIIT.

====== ''Cybersecurity Law'' ======
: The Cybersecurity Law (CSL) establishes the overarching security framework relevant to internet traffic in China, including the governing of internet infrastructure (Art 2 CSL). To safeguard data sovereignty, the CSL imposes data localisation requirements on critical information infrastructure operators. Other relevant obligations in the CSL are:

:: * Article 9: Network operators shall, when conducting business operations and providing services abide by laws and administrative regulations, respect social morality, observe business ethics, operate in good faith, perform their obligations to safeguard cybersecurity, accept supervision by the government and the public, and undertake social responsibilities.
:: * Article 12: The State shall protect the rights of citizens, legal persons and other organisations to use networks in accordance with the law, promote improved network access, provide better network services, provide the public with secure and convenient network services, and guarantee the lawful, orderly and free circulation of network-based information.

: It is unclear what is meant by reference to ‘social morality’ and ‘business ethics’, but that we view this through the prism of Chinese international relations and our understanding of societal values - essentially connecting these ideas to community, state-first control of information. This is not translatable to European norms associated with fundamental rights and the single internal market.

==== Other related legislation ====
Other related legislation includes:
* State Council - Regulations on Security Protection of Computer Information Systems, Administrative Measures for Internet Information Services
* The national intelligence law
* Ministry of Public Security - Administrative Measures for Prevention and Treatment of Computer Viruses
* Ministry of Public Security and five other ministries - Administrative Measures for Hierarchical Protection of Information Security
* NPC Standing Committee - Law on Guarding State Secrets

==== Sources ====

The above information is based on our consideration of the Telecommunications Regulations, Cybersecurity Law and the following secondary sources:
* Hu, Henry L. “The Political Economy of Governing ISPs in China: Perspectives of Net Neutrality and Vertical Integration.” The China Quarterly, Volume no. 207 (2011) 523–40. Available here: http://www.jstor.org/stable/41305255
* Pranavnayar 'The Legality of China’s Great Firewall: How Does the International Law Fare' Metacept 6 June 2021 <https://metacept.com/the-legality-of-chinas-great-firewall-how-does-the-international-law-fare/
* Christine M. Stover, ‘Network Neutrality: A Thematic Analysis of Policy Perspectives Across the Globe’ [2010] Global Media Journal Volume 3(1) pp. 75-86
* Bernd Holzenagel, Xu Junqi and Thomas Hart, ‘Regulating Telecommunications in the EU and China: What Lessons to be Learned?’ Arbeitsberichte Zum Informations-, Telekommunikations- Und Medienrecht Volume 16 [2009]
* Martyn Taylor, ‘Reforming China’s telecommunications law: lessons from the Australian experience’, International Journal of Communications Law and Policy Issue 7 [Winter 2002/2003]
* Becky P Y Loo, ‘Telecommunications reforms in China: Towards an analytical framework’ Telecommunications Policy 28 [2004] pp 679-714
* Report from US Embassy Beijing [2024] Available at: https://irp.fas.org/world/china/netreg.htm
* Zixiang Alex Tan, ‘Regulating China’s Internet: convergence toward a coherent regulatory regime’ Telecommunications Policy Volume 23, Issues 3-4, [1999] pp. 261-276
* Grace Wang, ‘Telecoms regulations in China’ Lexology [2022] Available at: https://www.lexology.com/library/detail.aspx?g=c8e8fd3d-4989-4db0-8887-45fd7a86f1a5
* Liyang Hou, ‘When competition law meets telecom regulation: the Chinese context’ Computer Law and Security Review 31(5) [2015]

=== India ===

The Indian regulatory framework currently features a strong commitment to net neutrality and a ban on zero rating. The development of this framework, however, cannot be understood without due attention paid to the legislative players in India and the context of the proliferation of zero rating services in 2015. Consequently, this section outlines the regulatory authorities responsible for telecommunications regulation in India, the resulting regulatory framework relating to net neutrality and zero-rating, and further challenges to net neutrality and food for thought.
India has a Department of Telecommunications (DoT) which is responsible for setting out its telecommunications policy. Under section 3 of the Telecom Regulatory Authority of India Act by the DoT, the Telecom Regulatory Authority of India (TRAI) was established as a statutory body of the DoT.

===== Zero rating: Facebook's "Free Basics Ban" =====

The debate on net neutrality followed primarily from the debate on the zero rating due to the proliferation of zero rating packages in 2015, the most notorious of which included Facebook’s “Free Basics” service and Airtel’s zero rating platform for app developers. In India, only around 50% of the population purchased data plans for their smartphones, and out of those who used it, it was shown that the average data package used was around 80MB per month in 2015. Therefore, due to the small data packages, zero rating was an attractive and reliable service.
The problem arose with the introduction of Facebook's zero rating model with Internet Access Providers, which included a service called Internet.org, which despite its misleading name offered exclusively Facebook services free of charge under the “Free Basics” model. Internet.org was meant to be an open platform that gives Indian developers additional services offered for free, used by those users who could not afford traditional internet access. Nevertheless, only partner websites and applications would be able to be included, ultimately going against the principles of net neutrality.
As a result of the misleading and untransparent, in 2016, TRAI published the “Prohibition of Discriminatory Tariffs for Data Services Regulations, 2016” which prohibited zero rating. Article 3 of the aforementioned regulation outlines this prohibition, whilst Article 4 stipulates a potential derogation for providing emergency services “or at times of grave public emergency.” However, the telecom provider must notify this reduced tariff to TRAI and the authority’s decision on its compliance with the Discriminatory Tariffs Regulation is final.

===== Net neutrality =====

The ban on zero rating was followed up with an overarching debate on net neutrality. Both TRAI and a Committee under the DoT consequently released papers advocating for the adoption of net neutrality principles throughout telecommunication legislation. As a result, the DoT signed off on TRAI’s recommendation to wholly support net neutrality principles and amended numerous parts of its core telecommunication legislation to integrate such principles. In 2018, the DoT amended the “Unified License for Telecom Service Providers (TSPs) and Unified License (Virtual Network Operators) and Unified Access License Agreement to incorporate the principles of non-discriminatory treatment of content.” In 2019, further amendments occurred regarding the Internet Service Provider License for Regulatory Framework. Some exemptions are present regarding the principles of non-discriminatory treatment of content and/or traffic for when “quality of service is essential,” such as in the cases of autonomous vehicles.
Despite these net neutrality principles, there remains the problem of the Indian government’s ability to legally order ISPs to block access to certain content, either for its own purposes or due to court orders. Whilst India’s net neutrality principles do not presuppose such government requests as violations per se, the problem lies in the perceived clash between the legislative provisions. For example, such government orders would be permissible as long as the measures adopted by the ISP are “proportionate, transient, and transparent;” however, the rules regarding the blocking of content stipulate a legal requirement to maintain the confidentiality of blocking requests and subsequent actions.

==== Opposition to net neutrality ====

Additionally, some scholars critique India’s strict approach to net neutrality due to the rapid developments in the internet space. For example, “complexities such as vertical partnerships between [internet service providers (ISPs)] and [content and application providers],” content delivery networks, and the deployment of 5G show the limits of India’s ex-ante net neutrality approach. As a result, further ex-post enforcement may be necessary to bolster net neutrality in India.

In sum, India’s regulatory framework started with a ban on zero rating as a result of controversy arising from the proliferation of zero rating with services such as Facebook’s “Free Basics.” This later erupted in a political debate on whether India should, as a result, commit fully to net neutrality, which was ultimately answered in the positive when the DoT implemented TRAI’s recommendations throughout India’s various telecommunications regulations. However, criticisms remain about the limited exceptions to net neutrality rules, and the Indian government’s eager censorship through blocking requests to ISPs may still pose threats to a free internet in India.

==== Sources ====

* The Telecom Regulatory Authority of India Act [1997] 199724 <https://www.indiacode.nic.in/handle/123456789/1929>.

* Jon Russel, ‘Under Fire In India, Facebook’s Internet.org Launches In Indonesia’ (TechCrunch, 2015) <https://techcrunch.com/2015/04/20/internet-dot-org-indonesia/>.

* Parmy Olson, ‘This App Is Cashing in on Giving the World Free Data’ (Forbes, 29 July 2015) <https://www.forbes.com/sites/parmyolson/2015/07/29/jana-mobile-data-facebook-internet-org/>, cited in Luca Belli, ‘Net Neutrality Reloaded: Zero Rating, Specialised Service, Ad Blocking and Traffic Management’ (2016) Annual Report of the UN IGF Dynamic Coalition on Net Neutrality.

* Lok Sabha Secretariat, ‘Net Neutrality: India's Position,’ (Parliament Library And Reference, Research, Documentation And Information Service, 2016) Reference note No.6/RN/Ref./February/2016.

* Prohibition of Discriminatory Tariffs for Data Services Regulations [2016] <https://trai.gov.in/sites/default/files/Regulation_Data_Service.pdf>.

* Ministry of Communications, ‘Net Neutrality in India’ (Press Release 1884064, 2022) <https://pib.gov.in/PressReleasePage.aspx?PRID=1884064>.

* Shruti Dhapola, ‘Net Neutrality rules approved by government; Internet to remain free and open in India’ (The Indian Express, 2018)<https://indianexpress.com/article/technology/tech-news-technology/net-neutrality-rules-now-approved-by-telecom-commission-india-internet-timeline-5256139/>

* BBC, ‘India adopts 'world's strongest' net neutrality norms’ (BBC, 2018) <https://www.bbc.com/news/world-asia-india-44796436>.

* The Wire Staff, ‘India Approves New Net Neutrality Rules, Signs off on New Telecom Policy’ (The Wire, 2018) <https://thewire.in/tech/india-approves-new-net-neutrality-rules-signs-off-on-new-telecom-policy>.

* Smriti Parsheera, ‘Net neutrality in India: From rules to enforcement’ (Medianama, 2020) <https://www.medianama.com/2020/05/223-net-neutrality-india-rules-enforcement/>.

* Raghuvansh Seth, ‘Fleeting neutrality: The inadequacies of the ex-ante net neutrality regulations in India’ (2022) 23 Competition and Regulation in Network Industries 1.

=== United States ===
==== Federal Regulatory Framework ====
To the extent that Internet Service Providers (ISPs) are regulated by the United States (US) Congress, it is under the '''[https://en.wikipedia.org/wiki/Communications_Act_of_1934 Communications Act of 1934]''', as amended by the '''[https://en.wikipedia.org/wiki/Telecommunications_Act_of_1996 Telecommunications Act of 1996]'''.

Pursuant to Sec. 1, the purpose of this Act is to regulate
:‘interstate and foreign commerce in communication by wire and radio so as to make available, so far as possible, to all the people of the United States [...] a rapid, efficient, Nation-wide, and world-wide wire and radio communication service with adequate facilities at reasonable charges’.
Sec. 230(b) outlines the policy specifically with respect to the Internet. It is, inter alia, ‘to promote the continued development of’ and ‘to preserve the vibrant and competitive free market for’ the Internet.

Pursuant to Sec. 2(a), this Act applies ‘to all interstate and foreign communication by wire or radio[, and] transmission of energy by radio, [...] and to all persons engaged’ in such pursuits. It also applies ‘to all persons engaged [...] in providing [cable] service’.

To ensure the ‘effective execution of this policy’, Congress created the Federal Communications Commission (FCC) under the Communications Act of 1934.

Yet, the Commission’s authority to regulate the addressees of this Act depends crucially on whether they fall under Title I (‘information service’) or Title II (‘common carrier service’). Common carrier services are expressly prohibited from granting preferential treatment:
:‘It shall be unlawful for any common carrier to make any unjust or unreasonable discrimination in charges, practices, classifications, regulations, facilities, or services for or in connection with like communication service, directly or indirectly, by any means or device, or to make or give any undue or unreasonable preference or advantage to any particular person, class of persons, or locality, or to subject any particular person, class of persons, or locality to any undue or unreasonable prejudice or disadvantage.’
To ensure reasonable pricing rates and non-discriminatory practices, the Communications Act of 1932 grants the FCC broad regulatory authority under Title II. In contrast, Title I services remain mainly unregulated by the FCC.

However, the term ‘information service’, which is defined as ‘the offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making available information via telecommunications’ [sic!],3 and the term ‘common carrier service’, which is defined as a person ‘engaged as a common carrier for hire’, in any of the pursuits mentioned above,4 are ambiguous when it comes to ISPs.

So far, the FCC has been responsible for the interpretation of these terms, as affirmed by the Supreme Court in ''National Cable & Telecommunications Association v. Brand X Internet Services'' (2005).

As the Commission’s Commissioners are ‘appointed by the President, by and with the advice and consent of the Senate’,5 the Commission’s stance on the classification of ISPs and the corresponding regulatory regime has always depended on the administration in power. This has led to relatively frequent shifts in administrative practice in the past.

During the Obama administration (2009-2017), the FCC classified ISPs as Title I services and introduced net neutrality principles in the '''[https://en.wikipedia.org/wiki/Federal_Communications_Commission_Open_Internet_Order_(2010) FCC Open Internet Order 2010]'''. However, the Court of Appeals for the District of Columbia Circuit in ''Comcast Corp. v. FCC'' (2010) and ''Verizon Communications Inc. v. FCC'' (2014) ruled that the FCC lacked the authority to enforce these principles on Title I services. Thus, the FCC reclassified ISPs under Title II in the '''[https://docs.fcc.gov/public/attachments/FCC-15-24A1.pdf FCC Open Internet Order 2015]''', enshrining net neutrality principles. This (first) reclassification was upheld by the Court of Appeals for the District of Columbia Circuit in ''United States Telecom Association v. FCC'' (2016).

Under the Trump administration (2017-2021), the FCC reversed course by reclassifying ISPs as Title I services again ('''[https://docs.fcc.gov/public/attachments/FCC-17-166A1_Rcd.pdf FCC Restoring Internet Freedom Order 2018]'''), effectively rolling back federal net neutrality regulations. This (second) reclassification was upheld by the Court of Appeals for the District of Columbia Circuit in ''Mozilla Corp. v. FC''C (2019).

In the Biden administration (2021-present), the FCC decided to restore net neutrality under Title II in the order on ‘Safeguarding and Securing the Open Internet; Restoring Internet Freedom’ (''''''[https://docs.fcc.gov/public/attachments/FCC-24-52A1.pdf FCC Net Neutrality Order 2024)] in April 2024.6 Then, in June 2024, providers under the National Cable & Telecommunications Association filed a lawsuit, challenging the FCC’s authority to reclassify ISPs – just after the Supreme Court in ''Loper Bright Enterprises v. Raimondo'' and ''Relentless, Inc. v. Department of Commerce'' (2024) overturned the ''Chevron'' deference established in ''Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc.'' (1984). ''Chevron'' deference directed courts to defer to an agency’s reasonable interpretation of ambiguous statutes – specifically, to agency interpretations of congressional statutes that are ‘silent or ambiguous with respect to the specific issue’ at hand –,7 and was central to previous cases like ''National Cable & Telecommunications Association v. Brand X Internet Services'' (2005). In lieu of ''Chevron'', the Supreme Court assigned the determination of congressional ambiguity to the federal courts, with executive agency expertise still to be considered under the weaker ''Skidmore'' deference established in ''Skidmore v. Swift & Co.'' (1944). Then, in August 2024, in a per curiam decision, the Court of Appeals for the Sixth Circuit granted a temporary injunction against the FCC’s 2024 Net Neutrality Order as well as a stay, extending an earlier temporary pause. In a concurring opinion, Chief Judge Sutton writes that the FCC’s flip-flopping on net neutrality between administrations makes it difficult to even apply the lower standard of ''Skidmore'' deference – thus, the ISPs challenging the latest iteration of the rule are likely to succeed on the merits. Citing ''Skidmore'', Sutton writes,
:‘an agency’s power to persuade turns on the thoroughness of its reasoning, its technical expertise, and its consistency with earlier and later pronouncements, especially those contemporaneous with the statute’s enactment. [...] The problem is, we do not know which group of experts to respect.’
Sutton adds,
:‘the consistency query makes matters worse. The Commission’s intention to reverse course for yet a fourth time suggests that its reasoning has more to do with changing presidential administrations than with arriving at the true and durable meaning of the law.’
This leaves the Communications Act of 1934, as amended by the Telecommunications Act of 1996, as the central regulatory framework at the federal level.

====State Regulatory Framework====
In response to the FCC’s 2018 Restoring Internet Freedom Order, which rolled back federal net neutrality rules, several states introduced their own legislation to maintain net neutrality. States like California, New York, and Vermont enacted laws prohibiting ISPs from practices such as blocking or throttling content. New York’s ConnectALL program, for instance, prioritises service providers that adhere to net neutrality principles. Additionally, states like Nevada and Minnesota passed laws focusing on ISP privacy and data protections.

The California '''Internet Consumer Protection and Network Neutrality Act of 2018''', which has been lauded as the ‘gold standard’ of net neutrality laws,8 was signed into law in 2018. With the repeal of the FCC’s 2015 Open Internet Order, California sought to restore similar principles at the state level. Although the US Department of Justice initially challenged the law, arguing that federal regulations preempted state rules, the courts ultimately upheld California’s right to enforce its own net neutrality protections.

The law includes several key provisions to ensure an open internet. First, it prohibits ISPs from blocking or throttling lawful internet traffic, ensuring that all users have equal access to content without interference. It also bans paid prioritisation, preventing ISPs from charging content providers for faster delivery speeds, thus maintaining a level playing field for all internet services, regardless of financial power.
Additionally, the law contains a broad prohibition against unreasonable interference, meaning ISPs cannot engage in practices that unfairly disadvantage or restrict access to lawful content and services. This provision serves as a general safeguard against ISP behaviour that might harm competition or limit consumer choice. Finally, the Act requires ISPs to disclose their network management practices transparently, ensuring consumers are informed about any restrictions that might affect their internet access.

====Focus On: Zero-Rating in the US====
With the 2015 Open Internet Order, the FCC addressed and thoroughly analysed the effects of zero-rating and similar practices on competition, consumer welfare and net neutrality. It acknowledged that zero-rating could potentially disrupt the market and encourage the use of restrictive data caps. However, it also noted that, depending on their specific structure, such offerings could provide benefits to consumers (e.g. increased choice and lower costs) and competition (e.g. more investments in broadband infrastructure). The FCC then established a standard under which zero-rating offers would be assessed. In particular, the FCC decided that it would have looked at and assessed such practices ‘under the no-unreasonable interference/disadvantage standard, based on the facts of each individual case, and take action as necessary’.9 As a result, in 2016 the FCC’s Wireless Bureau initiated investigations into whether the zero-rating practices of several wireless service providers were consistent with the 2015 Open Internet Order. For instance, among others, the FCC investigated AT&T for its ‘Data Free TV’ feature of its DIRECTV App, that allowed AT&T Mobility customers who App on a zero-rated basis. The FCC raised many concerns on competition and consumer protection basis, concluding that AT&T seemed to be acting in ways that harmed the open Internet.10

Nonetheless, following the 2016 elections and the changes in the membership of the FCC, the Wireless Bureau closed the investigations arguing that ‘free data plans have proven to be popular among consumers’ and that ‘they have also enhanced competition’.11 This shift in approach led to the repeal of the 2015 net neutrality rules in December 2017. Additionally, the FCC entered into a partnership with the FTC to monitor ISPs and noted that antitrust and consumer protection laws could handle specific cases of anti-competitive behaviour.

As mentioned in paragraph 2., in September 2018, California passed a net neutrality law, considered by many as the strictest in the United States. One section of the law addresses zero-rating specifically and prohibits individual apps from being zero-rated, but it allows for entire categories such as music or video to be zero-rated. Notwithstanding many opponents harshly critique the California law, the FCC has explicitly stated that it does not consider the regulation of zero-rating to be detrimental.12 This position allows states to experiment and develop their own strategies within the overarching federal framework. Such an approach promotes innovative solutions that can address regional needs and preferences, contributing to a dynamic environment for internet services and consumer protection.

In 2024, the FCC once again addressed the issue of zero-rating with its Net Neutrality Order highlighting several key concerns, including:
* the preferential treatment of certain products over others, particularly through paid agreement or affiliations;
* potential harm to the open internet, akin to the issues associated with paid prioritisation;
* undue advantage given to large providers;
* the creation of negative externalities that elevate costs across the market, stifling innovation and disrupting the virtuous cycle;
* the hindering of consumers’ ability to choose, access, and utilise broadband internet service or the internet content, applications, services or devices of their choice.
To address these potential risks, the FCC proposed to evaluate zero-rating programs under a multi-factor analysis within its general conduct standard, which allows for case-by-case assessments. Indeed, the FCC acknowledges that some zero-rating programs may offer potential benefits or are less likely to cause concerns such as, for instance, zero-rating products during low traffic hours or within the same category of products.

This flexible approach was intended to strike a balance between encouraging beneficial innovations and limiting practices that could distort the market or harm consumers. However, following the appeal brought by broadband providers against the FCC Net Neutrality Order 2024, as of today, there is no enforcement against zero-rating practices at a federal level and uncertainty prevails.

====References====
{{reflist}}