Technology Governance Wiki - User contributions [en]

Module 5: Artificial Intelligence

2025-11-26T19:50:51Z

NadineWalsh: /* Challenges & Case Law */

== Text and data mining ==
According to [https://eur-lex.europa.eu/eli/dir/2019/790/oj Directive (EU) 2019/790], "‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations". The Directive further provides a framework for the use of such techniques.
=== European Union ===
==== The Relationship between the CDSM Directive and AI Act ====
When considering the compatibility between the CDSM Directive and the AI Act, Regulation [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (EU) 2024/1689, Art. 53.1] provides a broad reference to the CDSM Directive: Providers of general-purpose AI models are required “to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790”. Additional obligations (Art.53.1(d)) outline the requirement to “draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model”. It is the responsibility of the AI Office to provide a template to ensure that providers follow the guidance and are exhaustive in the information made available.
 
Where the [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act refers to TDM is in Rec. 104 and 105], which is in reliance of the CDSM Directive. Here it is stated that general-purpose AI models remain, despite a number of  exceptions from obligations and requirements, obliged to produce a summary about the content used for model training. A reference to the withholding of rights over works by the rightsholder, only in cases not related to scientific research is outlined in the AIA’s recitals and cautions providers of general-purpose AI models to obtain authorisation from rightsholders if such works were to be included in TDM.
 

==== Questions of Scope and Enforceability ====
The concern is that the current provisions seem less stringent or tight in light of the fact that in order to train and develop large language models, such as Chat GPT, the input is required to come from a large variety of sources. Sources, such as books, essays, website, and even chatbot messages and social media posts may contain copyrighted materials. Under what conditions the use of these materials is considered legal, is one of the current dilemmas in the training of large language models, which form the basis of general AI use. Although it is the responsibility of the development company to ensure that copyright violations do not take place in the training and development of general-purpose AI models, Lucchi emphasises that this is a[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf field of the law, which is “multifaceted and dynamic” and which “necessitates meticulous examinations on a per-case basis”] - i.e. when are ‘fair-use’ or ‘legal exceptions’ relevant.
 
A recent [https://www.europarl.europa.eu/thinktank/en/document/IUST_STU(2025)774095 study report on generative AI and copyright], which was requested by the JURI Committee, addresses inconsistent implementation of how rights are to be reserved in a machine-readable way. This is creating difficulties for developers with regards to the aspect and ways of how the data they use is lawful. From the perspective of training and developing AI models, input and output are extrinsically interlinked and the line between both is “extremely permeable”. The growing concern, which is gaining popular airtime currently, is the fact that existing frameworks may not be sufficient to address the inherent complexities of generative AI systems, as these have or are developing the capabilities to “[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf directly compete or even dwarf original works]”.

==== Challenges & Case Law ====
In an [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ open letter], published on 30th July by the European Writers’ Council, a coalition of rightsholders emphasised that the “the damage to and unfair competition with the cultural and creative sectors can be seen each day”. [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ The coalition] requested stronger safeguards for the cultural and creative sectors. By rejecting the view that the Code of Practise provides a fair and workable balance on the use of training material access for and by GenAI models, it issued a plea to the European Parliament and member states to challenge the[https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ “unsatisfactory process of the exercise”] as this practise is seen to further weaken the situation of the creative and cultural sectors across Europe.
The first case [https://curia.europa.eu/juris/showPdf.jsf?docid=300681&doclang=EN (C-250/25)]of this kind, was lodged with the Court of Justice of the European Union (CJEU) in April 2025. The applicant, Like Company, a Hungarian publishing and news organisation, is alleging that Google Ireland Limited has accessed news reports and press releases. Like Company’s revenue is derived from advertising provided on its news portals, where news content of a journalistic nature is published. 
 
The referring Hungarian court is requesting a ruling whether the accessing and training Google’s AI Chatbot Gemini has infringed the applicant’s rights under EU legislation. When asked directly, “the chatbot operated by the defendant is capable of providing a response that displays the content of a protected press publication”. “The applicant asked the referring court to find that the defendant had infringed the applicant’s rights under the relevant national and EU legislation, by reproducing through electronic means the applicant’s press publications, in order to make them available to the public.

=== Brazil ===

==== Introduction ====

Brazil is currently in the process of implementing a national strategy on AI, a process which Brazil began in 2020. The strategy is holistic and considers many different aspects where Brazil is working on legislation, regulation, and AI governance with an eye to ethical use of AI and alignment with international approaches to AI. Brazil’s AI policy also puts a focus on education, workforce & training, research, development and innovation, how AI can be applied in “productive sectors” of the economy and in public bodies, and public security. The overall policy is founded on a goal of stimulating research, innovation and development of AI solutions while maintaining conscious and ethical use of AI. This national strategy is captured in policy documents, including the Brazilian Artificial Intelligence Strategy ([https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/arquivosinteligenciaartificial/ebia-summary_brazilian_4-979_2021.pdf EBIA]), as well as the National Strategy for Intellectual Property ([https://www.gov.br/inpi/pt-br/central-de-conteudo/noticias/cerimonia-marca-50-anos-do-inpi-e-lancamento-da-estrategia-nacional-de-propriedade-intelectual/EstratgiaNacionaldePropriedadeIntelectual.pdf ENPI]) and the National Policy of Innovation.

Pursuant to the Brazilian Artificial Intelligence Strategy, Brazil is working on specific legislation for AI. An initial draft AI Act was introduced in Brazil’s lower legislative chamber (the Chamber of Deputies) in 2020 (PL 21/2020), and was subsequently sent to the upper chamber (the Senate). The Senate convened a committee of experts to hold public hearings and collect public comments, the Comissão de Juristas responsável por subsidiar elaboração de substitutivo sobre inteligência artificial no Brasil ([https://legis.senado.leg.br/atividade/comissoes/comissao/2504/ source]). Other relevant draft laws were also pending in the Senate, so the Senate issued an order to combine, restructure and improve the text of these proposed laws pending input from the Committee. The Committee held meetings in 2022 and issued a final report in December 2022 with proposed changes to text. According to a press release from August 2024, the Senate is still reviewing draft AI legislation. A new draft text incorporating the recommended language from the committee of experts has been assigned bill number PL 2338/23, and it is this bill that appears to be moving forward in the Senate. The Chamber of Deputies’ original draft text PL 21/2020 has not moved forward; several other draft laws that relate to AI are also pending in the Senate. The Senate now has another commission debating the draft AI Act, which is continuing to meet regularly ([https://legis.senado.leg.br/atividade/comissoes/comissao/2629/ source]). Thus, it appears Brazil is getting closer to finalizing the draft legislation.

==== Text and Data Mining in Brazil ====

With the AI legislation in Brazil not yet finalized, from a copyright perspective, Brazil law currently does not authorize text and data mining (TDM) without permission of the copyright holder. Although Brazil’s copyright act, Law No. 9.610 of February 19, 1998 (Law on Copyright and Neighboring Rights), does include some exceptions to the exclusive rights of a copyright holder, none of these exceptions (in Articles 46, 47, and 48 of ) address text and data mining. [source: https://www.wipo.int/wipolex/en/legislation/details/514]. Thus, the work that Brazil’s Senate is doing on the draft AI will be important to regulate text and data mining activities when the law is finalized and approved.

The most recent and active draft AI Act in Brazil, PL 2338/23, includes the following definition of text and data mining:

\Art. 4. For the purposes of this Law, the following definitions are adopted:

[…] VIII – text and data mining: process of extracting and analyzing large amounts of data or partial or full excerpts of textual content, from which patterns and correlations are extracted that will generate relevant information for the development or use of artificial intelligence systems.

The draft law would regulate text and data mining as follows:

Art. 42. The automated use of works, such as extraction, reproduction, storage and transformation, in data and text mining processes in artificial intelligence systems, in activities carried out by research organizations and institutions, journalism and museums, archives and libraries, does not constitute an offense to copyright, provided that:
I – it does not have as its objective the simple reproduction, exhibition or dissemination of the original work itself;
II – the use occurs to the extent necessary for the objective to be achieved;
III – it does not unjustifiably harm the economic interests of the owners; and
IV – it does not compete with the normal exploitation of the works.

§ 1. Any reproductions of works for data mining activities will be kept under strict security conditions, and only for the time necessary to carry out the activity or for the specific purpose of verifying the results of scientific research.

§ 2. The provisions of the caput shall apply to the activity of data and text mining for other analytical activities in artificial intelligence systems, provided that the conditions of the items of the caput and § 1 are met, provided that the activities do not communicate the work to the public and that access to the works has been legitimate.
§ 3. The activity of text and data mining involving personal data shall be subject to the provisions of Law No. 13,709, of August 14, 2018 (General Personal Data Protection Law) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]).

As noted above, this is only a draft legislation, and this could change as the draft bill is debated further in Brazil’s congress.

The draft TDM definition and exception are notable in being fairly aligned with other jurisdictions such as the European Union. Brazil’s draft definition of TDM goes so far as to stipulate that “large amounts of data or partial or full excerpts of textual content” will be permitted to be mined, which suggests even in this definition the intent to provide an exception from the existing copyright regime. The definition also limits this use to the purpose of “development or use of artificial intelligence systems.” Arguably, this language ensures that the exception will be limited to the AI field. The inclusion of TDM when AI systems are in “use” is an interesting addition, since it suggests that TDM might be permissible not only for the training stage, but also when AI is deployed.

Like other jurisdictions such as the EU, Brazil’s draft TDM exception at Article 42 provides for use of works by research organizations and cultural institutions, namely, museums, archives, and libraries. However, it also notably allows an exception for journalism, along with the scientific and cultural uses. It is also notable that draft Article 42 includes a requirement that any use of the TDM exception “does not unjustifiably harm the economic interests of the owners” or compete with or replace the original works. Like the EU, subsection (42)(1) requires security conditions and limits the time for keeping the works.

Draft section 42(2) appears to provide a broader TDM exception that is not limited to scientific research, journalism, or cultural institutions, with additional requirements that entities using 42(2) must also not communicate the work to the public and must have had legitimate access to the works in the first place. This would seem to suggest that scraping is not allowed under draft section 42(2), but possibly is allowed for scientific research, journalistic purposes, or cultural purposes. Notably, this draft broad TDM exception in 42(2) does not include any kind of mechanism for rights holders who do not wish their works to be used in TDM activities to opt-out.

Finally, draft subsection 42(3) states that Brazil’s general data privacy law does apply to TDM activities. Thus, if this proposed language becomes law, entities using the TDM exception will still have to consider data privacy.

=== China ===
We have not identified a definition of ‘text and data mining’ in Chinese legislation or policy, so we have relied on the definition from Directive (EU) 2019/790:
''‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations. ''
This definition exists with a European Union (EU) law regarding exceptions and limitations of copyright for text and data mining. Consequently, to consider the Chinese position regarding text and data mining, we turn first to frame the copyright regime in China. 

==== Copyright Law of the People’s Republic of China (CLC) ====
Copyright Law of the People’s Republic of China in an administrative regulation enacted in 1951 and last revised in 2021. The Copyright Law aims to protect the copyright of authors in their literacy, artistic and scientific works and the copyright-related rights and interests, of encouraging the creation and dissemination of works which could contribute to the construction of socialist spiritual and material civilization, and of promoting the development and prosperity of the socialist culture and science. 
It applies to:
*works of chinese citizens, legal entities or other organizations, whether published or not
*work of a foreign or stateless person which is eligible to enjoy copyright 
**under an agreement concluded between the country to which the foreign belongs and China 
**international agreement
*works of foreign or stateless persons first published in the territory of China

==== Fair Use Doctrine ====
China is a civil law country which adheres to early continental European traditions, following the concept of the European droit d’auteur system. The structure of China’s copyright exception model can be considered as a closed list rather than an open-ended one (e.g U.S).
Specifically, Article 22 of the Chinese Copyright Law, the so-called fair use clause, lists 13 situations in which the use of copyright material constitutes permitted fair use, but it is difficult to categorize the use of copyright materials for AI training within these scenarios. Nevertheless, the [http://lawinfochina.com/display.aspx?id=9280&lib=law Chinese Supreme People’s Court judicial policy document] offers some flexibility in applying the fair use doctrine under special circumstances. It states that: 
''‘Under special circumstances as necessary for promoting technological innovation and business development, a use of works may be determined as reasonable after consideration of the nature and purposes of use, the nature of works used, the quantity and quality of the part of works used, impacts of use on potential markets or values, and other factors, provided that such use neither contravenes the normal use of the works nor results in unreasonable damage to the lawful interests of the author.’ ''
Additionally, the [https://www.wipo.int/wipolex/en/legislation/details/13428 Regulations for the Implementation of the CLC] (RICL) provides an in-depth examination of Article 22 CLC. According to Article 21 RICL ‘the exploitation of a published work which may be exploited without permission from the copyright owner in accordance with the relevant provisions of the Copyright Law shall not impair the normal exploitation of the work concerned, nor unreasonably prejudice the legitimate interests of the copyright owner. Thus, this two-step test serves as a complement to the listed exceptions in Article 22 CLC: the extent of exempted uses should not violate the two step test of Article 21 RICL. 
With the law being last revised in 2021, text and data mining is not specifically referenced as an exception to copyright. Nevertheless, a few of the listed exceptions may concern text or data mining used for AI training.
'''Fair use exceptions'''
Article 22(1) CLC provides that ‘use of a published work for the purposes of the user’s own private study, research or self-entertainment’ can be exempted. However, this example will not offer much safeguards as most AI users are corporations and the research they carry out cannot be deemed as private. 
Article 22(6) CLC provides that ‘translation, adaptation, compilation, playing, or reproduction in a small quantity of copies, of a published work for use by teachers or scientific researchers, in classroom teaching or scientific research of schools, provided that the translation or reproduction shall not be published or distributed’ can be exempted and may cover text and data mining. Still, the term ‘schools’ excludes commercial educational institutions and the commercial activities conducted by non-commercial institutions. Moreover, even if research institutions such as public universities may be covered by this exception, it is also required that the reproduction of published work shall be kept in ‘small quantity’. Thus, it is not a welcomed limitation for text and data mining that may require huge amounts of copyright data. 
Finally,  it could be a reasonably arguable position that Article 22, paragraph 7 may empower the State to engage in text and data mining, provided the State:
*mentions the name of the author and the title of the work; for example, in a list referencing all the works that were subject to the mining; and 
*the mining is by a State organ fulfilling official duties.  

{|
|-
| Article 22, paragraph 7, paraphrased: 
A work may be exploited without permission from, and without payment of remuneration to, the copyright owner, if the name of the author and the title of the work are mentioned and the other rights enjoyed by the copyright owner by virtue of this Law are not prejudiced, in the circumstance of a State organ using a published work, within proper scope, for the purpose of fulfilling its official duties.
|}

==== Amendments to the Law ====
===== Regulation for Generative Artificial Intelligence Services =====
On April 11th 2023, the Cyberspace Administration of China released a draft of the [https://www.china-briefing.com/news/how-to-interpret-chinas-first-effort-to-regulate-generative-ai-measures/ Regulation for Generative Artificial Intelligence Services], in force since August 2023. It includes 21 measures encompassing a wide array of subjects pertaining to the development and provision of Generative AI services. 
The regulation applies to ‘only applicable to services accessible to the general public within China’. It excludes from its scope AI services developed and utilized by enterprises, research and academics, research and academics institutions, and other public entities ([https://www.cac.gov.cn/2023-04/11/c_1682854275475410.htm Article 2]). Generative AI technologies are defined as models and related technologies that can generate contents in the form of texts, pictures, audios and videos (Article 22). 
<h5 class="mwt-heading" >Requirements for training data (article 7-8)</h5>
The Generative AI Measures require service provides to source data and foundation models from legitimate sources, respect the intellectual property rights of users, and process personal information with appropriate consent or legal basis under Chinese Laws. Providers must enhance the quality of training data, striving for ‘authenticity, accuracy, objectivity, and diversity’(article 7). Thus, the Regulation places significant emphasis on safeguarding personal data and information by imposing on providers the obligation to protect the input information of users and usage records during the service provision process. During the development phase, providers must establish ‘clear, specific and practical’ labeling rules for the training data. Conducting quality assessment of data labeling and sample verification to ensure accuracy of labeled content is also required (article 8). Additionally, illegal retention of input information that can be used to infer user identities, creation of user profiles based on input information usage, and disclosure of user input information to third parties are prohibited (Article 11). 

===== AI security governance framework =====
On 10 September 2024, the State Council of China [https://english.www.gov.cn/news/202409/10/content_WS66df9f30c6d0868f4e8eac91.html published] an AI security governance framework, to come into effect on 1 January 2025. The [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf Framework] was put together by China's National Technical Committee 260 on Cybersecurity and seeks to promote responsible AI innovation. Although this framework is not a piece of legislation, compliance is [https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ suggested] to be mandatory. 
[https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ Onetrust] identifies key areas of the framework as: 
*Risk management and transparency 
*Ethical responsibilities
*Accountability mechanisms
*Cross-border data, security, and privacy considerations

 Relevant for consideration of copyright and text and data mining exceptions are: 
*requirements for data integrity, 
*recordkeeping obligations for data sources, 
*systems that comply with China’s Data Security Law and Personal Information Protection Law 

 The Safety Guidelines of the Framework are significant and wide reaching. The relevant guidelines for training AI models apply to developers. Developers of AI models [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf should] (see 6.1): 
<div>

{| style="height: 130px;"
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*uphold a people-centered approach 
| style="height: 51px; width: 454px;" |
*strengthen data security and personal information protection
|- style="height: 28px;"
| style="height: 28px; width: 512px;" |
*adhere to the principle of AI for good
| style="height: 28px; width: 454px;" |
*respect intellectual property and copyright
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*follow science and technology ethics in key stages such as requirement analysis, project initiation, model design and development, and training data selection and use
| style="height: 51px; width: 454px;" |
*ensure that data sources are clear and acquisition methods are compliant
|}
</div>
This framework also has a national security flavour, and seeks to ensure AI develops without bias or discriminatory results.  

==== Hong Kong Amendment of Copyright Ordinance ====
[https://techinsights.linklaters.com/post/102jf9o/hong-kong-proposes-new-copyright-exception-for-text-and-data-mining-to-facilitate The Hong Kong government] recently launched a two-month public [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf consultation] aimed at enhancing the Copyright Ordinance to address the challenges brought by AI technology. To maintain a balance of interests between copyright owners and users, the Copyright Ordinance contains a number of copyright exceptions that permit reasonable use of copyright works under specific circumstances. However, each exception is confined to certain situations and purposes and subject to their respective conditions and there is no specific copyright exception for text and data mining. 
The consultation focuses on four areas: 
*copyright protection of AI generated work
*copyright infringement liability for AI generated works 
*introduction to specific copyright exception for text and data mining activities 
*other issues e.g deepfakes The proposal defines [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf text and data mining] as ‘automated techniques to extract and conduct computational analysis of extensive collection of text, images, data and other types of information for generating valuable insights, patterns, trends and correlations that would likely be unattainable through manual efforts alone’.

==== Case law  ====
===== Beijing Internet Court grants Copyright to AI-Generated Image =====
The [https://globallitigationnews.bakermckenzie.com/2024/05/08/china-a-landmark-court-ruling-on-copyright-protection-for-ai-generated-works/ first case] to address whether AI-generated work
:a) are protectable by copyright and
:b) who owns the copyright
was decided before the Beijing Internet Court in November 2023.'''Facts'''
The plaintiff, Mr. Li, used Stable Diffusion (an artificial intelligence) to generate the image involved in the case and published it on the Xiaohongshu (Little Red Book) platform; the defendant, a blogger on Baijiahao, used the image generated by the plaintiff’s AI to accompany the article, and the plaintiff sued. 
'''Judgement'''
First, the Court considered the meaning of ‘works’ under the Copyright Law of China, which provides that works must be original and reflect intellectual achievement. In terms of intellectual achievement, the Court noted that the plaintiff did not merely use existing pictures returned by search engines or rearranged pre-designed elements when creating the picture. Instead, the plaintiff designed how the woman should look in the picture and entered the relevant prompts. The plaintiff then inputted detailed prompts such as ‘japan idol’, ‘cool pose’, ‘viewing at camera’ and ‘film grain’, and then further adjusted the prompts based on the preliminary images generated by Stable Diffusion. According to the court, these actions demonstrates the plaintiff's intellectual input. 
Regarding the concept of originality, the court notes that this means that the work should be independently completed by the author and that should reflect the author’s subjective expression. In the context of AI-generated images, originality should be assessed on a case-by-case basis. In this case, the plaintiff designed the different elements of the image by inputting and fine-tuning the prompts and adjusting the parameters, which ultimately demonstrates the plaintiff's original judgment. Thus, the Court held that the picture is protected by copyright as an original work. It recognized the picture as a ‘work of fine arts’ under Article 3 CLC. 
Secondly, on the matter of copyright ownership, [https://english.bjinternetcourt.gov.cn/2023-12/28/c_688.htm the Court held] that Copyright Law provides that copyright shall be owned by the author of the work and an AI model cannot be an author because it is not a natural or legal person. Moreover, the designer of Stable Diffusion only created the AI model, it was not involved in the intellectual input leading to the creation of the picture and the licensing agreements states that the designer of Stable Diffusion does not claim rights in any output content. 

===== Pending Case to address whether AI Training constitute Copyright Infringement =====
In China, the [https://www.managingip.com/article/2dnu9r92bmzrcdrw84ykg/sponsored-content/training-ai-models-and-copyright-challenges-chinese-and-eu-insights first case] to address whether AI training constitutes copyright infringement is pending before the Beijing Internet Court.
The case was brought by four Chinese illustrators against the developers of Trik AI, a generative AI painting app released by the famous Chinese lifestyle platform Xiaohongshu, with a particular strength in generating traditional Chinese-style paintings. The illustrators claimed, among others, that Xiaohongshu’s use of their work to train its AI model constituted an infringement of their reproduction rights. Xiaohongshu, on the other hand, contends that using the plaintiffs’ works for AI training should be considered "fair use" under Article 24 of the Chinese Copyright Law. A judgment in this case has not yet been issued.
From a technical perspective, establishing copyright infringement in China depends on whether the AI model has made a ‘temporary’ or ‘permanent’ reproduction of a copyrighted work during the training process. Under the Chinese Copyright Law, the general rule is that it is only when a permanent copy is made that copyright infringement occurs.

=== India ===
[https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry] has stated that India’s existing regime of intellectual property rights (IPR) and copyright is sufficient to protect both rights holders of AI-generated works, and rights holders of content that may be used by Generative AI (e.g., training data). Consequently, the Ministry states there is no reason nor need to develop an additional regime specifically regulating AI and related innovations. As a result, there is no specific regulation to discuss relating to training data and scraping, also known as text and data mining (TDM), for AI training purposes. This paper thus focuses on aspects of the current regulatory regime that are relevant to the question of AI training data, and discusses potential limitations and criticisms of the reliance on the current regime. 

 Important to note is that India also lacks regulation regarding AI generally, not just lacking regulation regarding TDM either generally or for the purposes of AI training. Despite this, the government has addressed the growing challenge of AI through publishing the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence] which highlights numerous legal and societal challenges arising from AI. This Strategy does not explicitly mention copyright or legal issues arising from TDM, but highlights privacy problems that may be relevant for TDM for training as part of the AI lifecycle.
 [https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry brings attention] to a few specific aspects of the current IPR regime. Exclusive economic rights of a copyright owner are provided by the Copyright Act 1957. For generative AI to make use of copyrighted material under this act, the use must be covered under fair dealing exceptions in Section 52 of the Copyright Act 1957. Additionally, India’s personal data regulatory framework may be a relevant consideration for TDM.

==== The Copyright Act 1957 ====
 [https://www.copyright.gov.in/Documents/Copyrightrules1957.pdf The Copyright Act 1957] is India’s main regulatory instrument regarding intellectual property and copyright. Section 13 of the Copyright Act 1957 highlights which works are provided copyright protections, which include (1) original literary, dramatic, musical and artistic works, (2) cinematographic films, and (3) sound recordings. Section 14 expounds on actions that are prohibited to take against copyrighted works. Most relevant is the mention of the prohibitions of “the storing of [the copyrighted work] in any medium by electronic or other means” (emphasis added). This is applicable for the cases of a literary, dramatic, or musical work, a computer programme, an artistic work, and cinematographic films, covering all types of works mentioned in the Copyright Act 1957.
===== Infringement of Copyright and Fair Dealing Exceptions =====
 Chapter XI Copyright Act 1957 addresses infringements of copyright. Section 51 outlines when copyright will be deemed infringed, which includes when anything is done which is the exclusive right of the copyright holder (Section 51(a)(i)), and other distributions of the copyrighted work, including when it is “to such an extent to affect prejudicially the owner of the copyright” (Section 51(b)(ii)).

 Section 52 outlines when certain acts are not considered an infringement of copyright, commonly known as fair dealing exceptions. Section 52(a)  excludes from infringement “a fair dealing with any work, not being a computer programme,” for the purposes of either “(i) private or personal use; including research; (ii) criticism or review [...]; [and] (iii) the reporting of current events and current affairs.” An accompanying explanation states that the storing of any copyrighted work in an electronic medium for the aforementioned purposes shall not constitute an infringement. Section 52(aa) (sic) excludes from infringements the certain actions towards copyrighted computer programmes, such as when a lawful possessor of a copy makes copies of the programme for certain purposes (Section aa(i)-(ii) (ab), (ac), (ad), …). Section 52 is expansive and outlines numerous other exceptions.

===== Application of the CRA 1957 to TDM =====
Generally, the Copyright Act 1957 is vague. The fair dealing exceptions in Section 52 are strict and lack any specific reference to TDM or more generally to the use of copyrighted information to develop a product as such. The Copyright Act 1957 does reference electronic storage and recent technological changes such as, for example, listing the circumvention of “an effective technological measure applied for the purpose of protecting any of the rights conferred by this Act” (Section 65A) as an offence. However, such mentions are limited and still revolve around the (illegal) act of creating a copy of a copyrighted work. Much of the Copyright Act 1957 is focused on the illegal replication of works.
The Copyright Act’s particular focus has resulted in scholarly opinion that the Act would actually not prohibit TDM despite a lack of explicit fair dealing exception. Dr. Arul George Scaria, Co-Director of the [https://ciipc.org/ Centre for Innovation, Intellectual Property, and Competition (CIIPC) at National Law University in Delhi], has argued for the legality of TDM under Indian copyright law. He [https://spicyip.com/2019/08/should-indian-copyright-law-prevent-text-and-data-mining.html argues that Indian copyright law] only protects the expression of ideas, not facts or ideas themselves. So, when a researcher, for example, uses a copyrighted article in the course of TDM, this should be considered a non-expressive use of the work outside of copyright protection. He goes so far as to argue that it is thus “morally and legally impermissible to allow publishers to use End User Licence Agreements or other contractual tools to restrict researchers from using articles for TDM.” 
Additionally, Dr. Scaria emphasises that India’s copyright regime privileges not only the rights of the creators or copyright holders, but also the users of such works. He references the[https://indiankanoon.org/doc/135895592/ Delhi University Photocopy Shop (Single Bench)] decision, wherein Justice Endlaw states that the rights of persons in Section 52, the fair dealing exception, should not be interpreted narrowly or strictly. The rights given to users should be interpreted on par with those given to creators. Lastly, Dr. Scaria argues that India’s fair dealing regime can provide the flexibility to apply to newer technological developments such as TDM. Whilst Dr. Scaria makes a compelling argument, part of that compelling argument derives from his discussion of TDM as done by researchers, rather than addressing, for example, the use of TDM to train AI for ultimately commercial purposes.
Another case did address TDM for another use, by the state. Whilst this does not explicitly address the use of TDM to train AI, it still provides perspective on how TDM might be understood in the context of India’s regulatory framework. The Supreme Court of India, in the case of [https://indiankanoon.org/doc/127517806/ Justice K.S. Puttaswamy (Retired) vs Union of India and Ors.], recognised TDM’s importance for the state. The Court held that “[TDM] with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the state to insist on the collection of authentic data.” However, this case addressed TDM primarily from a privacy law perspective, rather than copyright; consequently, there still is no litigation that addresses the TDM in a copyright context. This raises further concerns considering the lack of explicit inclusion of a TDM fair dealing exception in Section 52 of the Copyright Act 1957.
As a result, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html likely means of justifying TDM is through Section 52(1)(a) ]which allows for private and personal use of copyrighted works, including for research. This provision is nuanced, wherein the making of copyrighted works publicly available to facilitate private and personal use such as by public libraries could be justified. However, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html Calcutta High Court in 2013] stated that “commercial exploitation” does not fall under “private or personal use,” a position reaffirmed by the Bombay High Court in 2018. Thus, it seems that the main way in which TDM could be justified under India’s copyright regulation is through arguing that TDM does not infringe on the expression of the idea or data, and thus copyright does not apply, as argued by Dr. Scaria.
==== Database protection ====
 A newer form of intellectual property rights relates to database protection, which may be relevant when it comes to TDM. India does not have an explicit database right in its intellectual property right regime, but it has recently been subsumed into its copyright regulatory framework. [https://link.springer.com/chapter/10.1007/978-981-10-3984-3_10 The Delhi High Court in Himalaya Drug Company v Sumit] ruled that compilations of databases could be considered literary works and consequently covered by the Copyright Act 1957. This would mean use of compilations of databases in TDM contexts would have to fall under fair dealing exceptions in Section 52 of the Copyright Act 1957. 
==== Personal data mining ====
 Another problematic aspect of data mining is the use of [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf personal data]. The source of data used for data mining can be essential, and if the data obtained is not public knowledge or obtained consensually, Indian personal protection legislation might apply. Companies and organizations that do not obtain personal data with permission or [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf discriminate] against individuals based on age, sex, gender, race, or religion are not going to be compliant with local or transnational laws. Specifically in India, data mining in such circumstances is regulated by the [https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf Information Technology Act], 2000 (IT Act) (e.g Article 43A which outlines rules on unauthorized access, sensitive personal data, and information, as well as compensation for failure to protect data), and the [https://www.google.com/url?q=https://www.meity.gov.in/writereaddata/files/Digital%2520Personal%2520Data%2520Protection%2520Act%25202023.pdf&sa=D&source=docs&ust=1732737698777765&usg=AOvVaw0wY-MZ1iAH8P634ZfD2-Vf Personal Data Protection Bill, 2019 (PDP Bill)]. However, some scholars discuss that the production of Privacy Preserving Data Mining Techniques[https://www.researchgate.net/profile/Ahmad-Ahmad-79/publication/375343129_Psychological_Burden_of_Caregivers_of_Children_with_Cancer_at_AL-Amal_Hospital_in_Baghdad_City/links/65476ca9b86a1d521bb8fe8a/Psychological-Burden-of-Caregivers-of-Children-with-Cancer-at-AL-Amal-Hospital-in-Baghdad-City.pdf#page=410 could circumvent] regulation from data protection regulation. This approach is somewhat reflected in the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence], wherein the Indian government recommends investing in privacy-preserving AI research methods to reduce the “risks of data exploitation and personal identification (from an anonymisation dataset).”

=== United States ===
==== Text and data mining in the US ====
'''Introduction TDM'''Text- and data mining is a process used to develop AI models. Data is fed into a model and algorithms are applied to the data. The term TDM is not defined in US Law, but rather as "machine and human- based inputs” under Title 15 Commerce and Trade. Another reference can be found under Machine Learning, which mentions "the ability to automatically learn and improve on the basis of data or experience. 
'''US definition AI'''The legal definition of AI originates from the National Artificial Intelligence Initiative Act of 2020, which regulates public bodies' use of AI:
"a machine based system that can, for a given set of human-defined objectives, make predictions,  recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems  use machine- and human-based inputs to perceive real and virtual environments; abstract such  perceptions into models through analysis in an automated manner; and use model inference to  formulate options for information or action.”,
The legal question is: do any restrictions apply to the use of input such as publicly available text or data in digital form for the purpose of training AI models?
To the extent that the input may be protected by copyright, the Copyright Act of 1976 is applicable.
To the extent that the input may be pertaining to data created by human behavior, other acts or constitutional rights may apply.
To the extent that the use of the data may be unfair or harmful to competition or consumer rights, FTC regulations may apply.

==== U.S. Constitution ====
Patent and Copyright Clause
(a.k.a. Patent Clause, the Copyright Clause, and the Progress Clause)
The Congress shall have Power ...to promote the Progress of Science and useful Arts, by securing for limited Tımes to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

==== Federal Law ====
===== The Copyright Act of 1976 =====
The United States copyright law is contained in the United States Code, chapters 1 through 8 and 10 through 12 of Title 17. The Copyright Act of 1976, which provides the basic framework for the current copyright law.
The authority has been granted to the US Copyright Office since 1870. 
To the extent that “human-based input’ and data can be a product of human work, it may be protected under the constitutional clause which grants an exclusive right to the Author or Inventor.
Copyright protection is granted to original works of authorship that are fixed in a tangible medium of expression . The author of the work generally holds copyright ownership generally, a right which she may transfer or license their rights to others. 
Essential to the copyright protection in the US is the fair use doctrine, which allows for several exemptions for which limited use of copyrighted material is allowed without the author’s permission. 
Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work.
The legal discussion regarding TDM in the US is evolving essentially around the application of the exceptions under the legal doctrine of fair use.
Following the Executive Order  Executive Order 13859 announcing the American Artificial Intelligence Initiative, the United States Patent and Trademark Office (USPTO) released a report titled “Public Views on Artificial Intelligence and Intellectual Property Policy.” The report consults a wide variety of stakeholder views on the impact of artificial intelligence (AI) across the intellectual property (IP) landscape, including patent, trademark, copyright, and trade secret policy, as well as developing issues about database protection. 
In this report, the USPTO stated:‘ “The ingestion of copyrighted works for purposes of machine learning will almost by definition involve the reproduction of entire works or substantial portions thereof. Accordingly, whether this constitutes copyright infringement will generally be determined by considering the applicability of the fair use doctrine, an exception set forth in section 107 of the Copyright Act, 17 U.S.C. § 107. Fair use is applied on a case-by-case basis, requiring courts to weigh several statutory factors, and is highly fact-dependent.’  § 102).’
The report included the results of a poll among a broad array of public and private stakeholders. The report  showed that the existing legal framework lacks instruments to tackle the challenges of AI. While the majority found the existing U.S. intellectual property laws calibrated correctly to address the evolution of AI (copyright, trademarks, trade secrets, and data fields), some suggested a need for new classes of IP rights. Overall, many agreed that existing commercial law principles (e.g., contract law) might adequately fill any gaps left by IP law in the wake of advances in AI .

===== COPIED ACT bill proposal =====
July 11th 2024 the bipartisan bill was introduced in Congress.
Content Origin Protection and Integrity from Edited and Deepfaked Media Act of 2024
The bill proposal addresses the new IP issues with respect to content by requiring transparency and content provenance information in an aim to protect artistic content.
The intention to establish NIST standards for provenance information seems to open the possibility for remuneration for rights-holders. This would be aligned with the intent of the constitutional right in the Patent and Copyright Clause.

==== Recent US Court cases regarding TDM ====
NEW YORK TIMES v. OPEN AI INC (2023)
The New York Times claimed that OpenAI and Microsoft, as creators of highly profitable generative AI models, did not give credit or remuneration to the New York Times despite relying on their works. The New York Times further alleges that this conduct not only infringes on their intellectual property rights but could also threaten their business model of providing news coverage, analysis and commentary on current events.
AUTHORS GUILD v. OPEN AI INC (2024)
17 authors argue that OpenAI should have first obtained their permission to use their copyrighted works and now seek a permanent injunction against OpenAI to prevent these alleged harms from reoccurring. The Authors Guild is also seeking damages for the lost opportunity to licence their works and asserts that OpenAI and Microsoft forced them into a position where they unknowingly aided their own market replacement. 

==== Policy ====
Two executive orders have been released pertaining to the use of AI by public bodies.
Executive Order 14110 of October 30, 2023 Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence mentions data as understood in 1.1.
Regarding availability of data for training the Executive Order states:
(b) …This effort requires investments in AI-related education, training, development, research, and capacity, while simultaneously tackling novel intellectual property (IP) questions and other problems to protect inventors and creators.
(e) … The Federal Government will enforce existing consumer  protection laws and principles and enact appropriate safeguards against fraud, unintended bias,  discrimination, infringements on privacy, and other harms from AI. Such protections are especially important in critical fields like healthcare, financial services, education,  housing, law, and transportation, where mistakes by or misuse of AI could harm patients, cost  consumers or small businesses, or jeopardize safety or rights. At the same time, my Administration will  promote responsible uses of AI that protect consumers, raise the quality of goods and services, lower  their prices, or expand selection and availability.
(f) Americans’ privacy and civil liberties must be protected as AI continues advancing. Artificial Intelligence is making it easier to extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires. Artificial Intelligence’s capabilities in these areas can increase the risk that personal data could be exploited and exposed. To combat this risk, the Federal Government will ensure that the collection, use, and retention of data is lawful, is secure, and mitigates privacy and confidentiality risks. Agencies shall use available policy and technical tools, including privacy-enhancing technologies (PETs) where appropriate, to protect privacy and to combat the broader legal and societal risks—including the chilling of First Amendment rights—that result from the improper collection and use of people’s data. 
The Executive Order stipulates the need for  “tackling novel intellectual property (IP) question”, “enforce protection laws and principles”and “enact safeguards against harms from AI” as “AI is making it easier to extract …on sensitive information about people’s identities, locations, habits and desires.” The Executive order acknowledges the need for new policies to not only protects copyrights-holders in the context of AI, but also citizens as their behavioral data are being used to train AI-models.

==== Enforcement ====
As stated in section 1.1., human-based data may be a broad term, the use of which may violate several laws and regulations.. A certain responsibility  to protect competition in the interest of consumers lies with the FTC. In the case of AI, it may be difficult to assess whether infringement of violations take place.
A special enforcement resolution  was issued by the FTC in November 2023,  “ directing use of compulsory process in a non-public investigation of products and services that use or are produced using artificial intelligence or that purport to detect the use of artificial intelligence”. The specific action enables the FTC to start investigations of possible use of AI in violation with Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 to detect unfair, deceptive, anticompetitive,  collusive, coercive, predatory, exploitative, or exclusionary acts or practices in or affecting commerce relating to products and services that use or are produced using artificial intelligence, including but not limited to, machine-based systems that can, for a given set of defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments, or that purport to use or detect the use of artificial intelligence.
The proposed bill COPIED act may be instrumental in enabling the AI market to become more transparent, for rights-holders to receive remuneration based on standardized provenance mechanisms.

=== South Africa ===

Module 5: Artificial Intelligence

2025-11-26T19:49:34Z

NadineWalsh: /* Questions of Scope and Enforceability */

== Text and data mining ==
According to [https://eur-lex.europa.eu/eli/dir/2019/790/oj Directive (EU) 2019/790], "‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations". The Directive further provides a framework for the use of such techniques.
=== European Union ===
==== The Relationship between the CDSM Directive and AI Act ====
When considering the compatibility between the CDSM Directive and the AI Act, Regulation [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (EU) 2024/1689, Art. 53.1] provides a broad reference to the CDSM Directive: Providers of general-purpose AI models are required “to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790”. Additional obligations (Art.53.1(d)) outline the requirement to “draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model”. It is the responsibility of the AI Office to provide a template to ensure that providers follow the guidance and are exhaustive in the information made available.
 
Where the [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act refers to TDM is in Rec. 104 and 105], which is in reliance of the CDSM Directive. Here it is stated that general-purpose AI models remain, despite a number of  exceptions from obligations and requirements, obliged to produce a summary about the content used for model training. A reference to the withholding of rights over works by the rightsholder, only in cases not related to scientific research is outlined in the AIA’s recitals and cautions providers of general-purpose AI models to obtain authorisation from rightsholders if such works were to be included in TDM.
 

==== Questions of Scope and Enforceability ====
The concern is that the current provisions seem less stringent or tight in light of the fact that in order to train and develop large language models, such as Chat GPT, the input is required to come from a large variety of sources. Sources, such as books, essays, website, and even chatbot messages and social media posts may contain copyrighted materials. Under what conditions the use of these materials is considered legal, is one of the current dilemmas in the training of large language models, which form the basis of general AI use. Although it is the responsibility of the development company to ensure that copyright violations do not take place in the training and development of general-purpose AI models, Lucchi emphasises that this is a[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf field of the law, which is “multifaceted and dynamic” and which “necessitates meticulous examinations on a per-case basis”] - i.e. when are ‘fair-use’ or ‘legal exceptions’ relevant.
 
A recent [https://www.europarl.europa.eu/thinktank/en/document/IUST_STU(2025)774095 study report on generative AI and copyright], which was requested by the JURI Committee, addresses inconsistent implementation of how rights are to be reserved in a machine-readable way. This is creating difficulties for developers with regards to the aspect and ways of how the data they use is lawful. From the perspective of training and developing AI models, input and output are extrinsically interlinked and the line between both is “extremely permeable”. The growing concern, which is gaining popular airtime currently, is the fact that existing frameworks may not be sufficient to address the inherent complexities of generative AI systems, as these have or are developing the capabilities to “[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf directly compete or even dwarf original works]”.

==== '''Challenges & Case Law''' ====
In an [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ open letter], published on 30th July by the European Writers’ Council, a coalition of rightsholders emphasised that the “the damage to and unfair competition with the cultural and creative sectors can be seen each day”. [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ The coalition] requested stronger safeguards for the cultural and creative sectors. By rejecting the view that the Code of Practise provides a fair and workable balance on the use of training material access for and by GenAI models, it issued a plea to the European Parliament and member states to challenge the[https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ “unsatisfactory process of the exercise”] as this practise is seen to further weaken the situation of the creative and cultural sectors across Europe.
The first case [https://curia.europa.eu/juris/showPdf.jsf?docid=300681&doclang=EN (C-250/25)]of this kind, was lodged with the Court of Justice of the European Union (CJEU) in April 2025. The applicant, Like Company, a Hungarian publishing and news organisation, is alleging that Google Ireland Limited has accessed news reports and press releases. Like Company’s revenue is derived from advertising provided on its news portals, where news content of a journalistic nature is published. 
 
The referring Hungarian court is requesting a ruling whether the accessing and training Google’s AI Chatbot Gemini has infringed the applicant’s rights under EU legislation. When asked directly, “the chatbot operated by the defendant is capable of providing a response that displays the content of a protected press publication”. “The applicant asked the referring court to find that the defendant had infringed the applicant’s rights under the relevant national and EU legislation, by reproducing through electronic means the applicant’s press publications, in order to make them available to the public.

=== Brazil ===

==== Introduction ====

Brazil is currently in the process of implementing a national strategy on AI, a process which Brazil began in 2020. The strategy is holistic and considers many different aspects where Brazil is working on legislation, regulation, and AI governance with an eye to ethical use of AI and alignment with international approaches to AI. Brazil’s AI policy also puts a focus on education, workforce & training, research, development and innovation, how AI can be applied in “productive sectors” of the economy and in public bodies, and public security. The overall policy is founded on a goal of stimulating research, innovation and development of AI solutions while maintaining conscious and ethical use of AI. This national strategy is captured in policy documents, including the Brazilian Artificial Intelligence Strategy ([https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/arquivosinteligenciaartificial/ebia-summary_brazilian_4-979_2021.pdf EBIA]), as well as the National Strategy for Intellectual Property ([https://www.gov.br/inpi/pt-br/central-de-conteudo/noticias/cerimonia-marca-50-anos-do-inpi-e-lancamento-da-estrategia-nacional-de-propriedade-intelectual/EstratgiaNacionaldePropriedadeIntelectual.pdf ENPI]) and the National Policy of Innovation.

Pursuant to the Brazilian Artificial Intelligence Strategy, Brazil is working on specific legislation for AI. An initial draft AI Act was introduced in Brazil’s lower legislative chamber (the Chamber of Deputies) in 2020 (PL 21/2020), and was subsequently sent to the upper chamber (the Senate). The Senate convened a committee of experts to hold public hearings and collect public comments, the Comissão de Juristas responsável por subsidiar elaboração de substitutivo sobre inteligência artificial no Brasil ([https://legis.senado.leg.br/atividade/comissoes/comissao/2504/ source]). Other relevant draft laws were also pending in the Senate, so the Senate issued an order to combine, restructure and improve the text of these proposed laws pending input from the Committee. The Committee held meetings in 2022 and issued a final report in December 2022 with proposed changes to text. According to a press release from August 2024, the Senate is still reviewing draft AI legislation. A new draft text incorporating the recommended language from the committee of experts has been assigned bill number PL 2338/23, and it is this bill that appears to be moving forward in the Senate. The Chamber of Deputies’ original draft text PL 21/2020 has not moved forward; several other draft laws that relate to AI are also pending in the Senate. The Senate now has another commission debating the draft AI Act, which is continuing to meet regularly ([https://legis.senado.leg.br/atividade/comissoes/comissao/2629/ source]). Thus, it appears Brazil is getting closer to finalizing the draft legislation.

==== Text and Data Mining in Brazil ====

With the AI legislation in Brazil not yet finalized, from a copyright perspective, Brazil law currently does not authorize text and data mining (TDM) without permission of the copyright holder. Although Brazil’s copyright act, Law No. 9.610 of February 19, 1998 (Law on Copyright and Neighboring Rights), does include some exceptions to the exclusive rights of a copyright holder, none of these exceptions (in Articles 46, 47, and 48 of ) address text and data mining. [source: https://www.wipo.int/wipolex/en/legislation/details/514]. Thus, the work that Brazil’s Senate is doing on the draft AI will be important to regulate text and data mining activities when the law is finalized and approved.

The most recent and active draft AI Act in Brazil, PL 2338/23, includes the following definition of text and data mining:

\Art. 4. For the purposes of this Law, the following definitions are adopted:

[…] VIII – text and data mining: process of extracting and analyzing large amounts of data or partial or full excerpts of textual content, from which patterns and correlations are extracted that will generate relevant information for the development or use of artificial intelligence systems.

The draft law would regulate text and data mining as follows:

Art. 42. The automated use of works, such as extraction, reproduction, storage and transformation, in data and text mining processes in artificial intelligence systems, in activities carried out by research organizations and institutions, journalism and museums, archives and libraries, does not constitute an offense to copyright, provided that:
I – it does not have as its objective the simple reproduction, exhibition or dissemination of the original work itself;
II – the use occurs to the extent necessary for the objective to be achieved;
III – it does not unjustifiably harm the economic interests of the owners; and
IV – it does not compete with the normal exploitation of the works.

§ 1. Any reproductions of works for data mining activities will be kept under strict security conditions, and only for the time necessary to carry out the activity or for the specific purpose of verifying the results of scientific research.

§ 2. The provisions of the caput shall apply to the activity of data and text mining for other analytical activities in artificial intelligence systems, provided that the conditions of the items of the caput and § 1 are met, provided that the activities do not communicate the work to the public and that access to the works has been legitimate.
§ 3. The activity of text and data mining involving personal data shall be subject to the provisions of Law No. 13,709, of August 14, 2018 (General Personal Data Protection Law) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]).

As noted above, this is only a draft legislation, and this could change as the draft bill is debated further in Brazil’s congress.

The draft TDM definition and exception are notable in being fairly aligned with other jurisdictions such as the European Union. Brazil’s draft definition of TDM goes so far as to stipulate that “large amounts of data or partial or full excerpts of textual content” will be permitted to be mined, which suggests even in this definition the intent to provide an exception from the existing copyright regime. The definition also limits this use to the purpose of “development or use of artificial intelligence systems.” Arguably, this language ensures that the exception will be limited to the AI field. The inclusion of TDM when AI systems are in “use” is an interesting addition, since it suggests that TDM might be permissible not only for the training stage, but also when AI is deployed.

Like other jurisdictions such as the EU, Brazil’s draft TDM exception at Article 42 provides for use of works by research organizations and cultural institutions, namely, museums, archives, and libraries. However, it also notably allows an exception for journalism, along with the scientific and cultural uses. It is also notable that draft Article 42 includes a requirement that any use of the TDM exception “does not unjustifiably harm the economic interests of the owners” or compete with or replace the original works. Like the EU, subsection (42)(1) requires security conditions and limits the time for keeping the works.

Draft section 42(2) appears to provide a broader TDM exception that is not limited to scientific research, journalism, or cultural institutions, with additional requirements that entities using 42(2) must also not communicate the work to the public and must have had legitimate access to the works in the first place. This would seem to suggest that scraping is not allowed under draft section 42(2), but possibly is allowed for scientific research, journalistic purposes, or cultural purposes. Notably, this draft broad TDM exception in 42(2) does not include any kind of mechanism for rights holders who do not wish their works to be used in TDM activities to opt-out.

Finally, draft subsection 42(3) states that Brazil’s general data privacy law does apply to TDM activities. Thus, if this proposed language becomes law, entities using the TDM exception will still have to consider data privacy.

=== China ===
We have not identified a definition of ‘text and data mining’ in Chinese legislation or policy, so we have relied on the definition from Directive (EU) 2019/790:
''‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations. ''
This definition exists with a European Union (EU) law regarding exceptions and limitations of copyright for text and data mining. Consequently, to consider the Chinese position regarding text and data mining, we turn first to frame the copyright regime in China. 

==== Copyright Law of the People’s Republic of China (CLC) ====
Copyright Law of the People’s Republic of China in an administrative regulation enacted in 1951 and last revised in 2021. The Copyright Law aims to protect the copyright of authors in their literacy, artistic and scientific works and the copyright-related rights and interests, of encouraging the creation and dissemination of works which could contribute to the construction of socialist spiritual and material civilization, and of promoting the development and prosperity of the socialist culture and science. 
It applies to:
*works of chinese citizens, legal entities or other organizations, whether published or not
*work of a foreign or stateless person which is eligible to enjoy copyright 
**under an agreement concluded between the country to which the foreign belongs and China 
**international agreement
*works of foreign or stateless persons first published in the territory of China

==== Fair Use Doctrine ====
China is a civil law country which adheres to early continental European traditions, following the concept of the European droit d’auteur system. The structure of China’s copyright exception model can be considered as a closed list rather than an open-ended one (e.g U.S).
Specifically, Article 22 of the Chinese Copyright Law, the so-called fair use clause, lists 13 situations in which the use of copyright material constitutes permitted fair use, but it is difficult to categorize the use of copyright materials for AI training within these scenarios. Nevertheless, the [http://lawinfochina.com/display.aspx?id=9280&lib=law Chinese Supreme People’s Court judicial policy document] offers some flexibility in applying the fair use doctrine under special circumstances. It states that: 
''‘Under special circumstances as necessary for promoting technological innovation and business development, a use of works may be determined as reasonable after consideration of the nature and purposes of use, the nature of works used, the quantity and quality of the part of works used, impacts of use on potential markets or values, and other factors, provided that such use neither contravenes the normal use of the works nor results in unreasonable damage to the lawful interests of the author.’ ''
Additionally, the [https://www.wipo.int/wipolex/en/legislation/details/13428 Regulations for the Implementation of the CLC] (RICL) provides an in-depth examination of Article 22 CLC. According to Article 21 RICL ‘the exploitation of a published work which may be exploited without permission from the copyright owner in accordance with the relevant provisions of the Copyright Law shall not impair the normal exploitation of the work concerned, nor unreasonably prejudice the legitimate interests of the copyright owner. Thus, this two-step test serves as a complement to the listed exceptions in Article 22 CLC: the extent of exempted uses should not violate the two step test of Article 21 RICL. 
With the law being last revised in 2021, text and data mining is not specifically referenced as an exception to copyright. Nevertheless, a few of the listed exceptions may concern text or data mining used for AI training.
'''Fair use exceptions'''
Article 22(1) CLC provides that ‘use of a published work for the purposes of the user’s own private study, research or self-entertainment’ can be exempted. However, this example will not offer much safeguards as most AI users are corporations and the research they carry out cannot be deemed as private. 
Article 22(6) CLC provides that ‘translation, adaptation, compilation, playing, or reproduction in a small quantity of copies, of a published work for use by teachers or scientific researchers, in classroom teaching or scientific research of schools, provided that the translation or reproduction shall not be published or distributed’ can be exempted and may cover text and data mining. Still, the term ‘schools’ excludes commercial educational institutions and the commercial activities conducted by non-commercial institutions. Moreover, even if research institutions such as public universities may be covered by this exception, it is also required that the reproduction of published work shall be kept in ‘small quantity’. Thus, it is not a welcomed limitation for text and data mining that may require huge amounts of copyright data. 
Finally,  it could be a reasonably arguable position that Article 22, paragraph 7 may empower the State to engage in text and data mining, provided the State:
*mentions the name of the author and the title of the work; for example, in a list referencing all the works that were subject to the mining; and 
*the mining is by a State organ fulfilling official duties.  

{|
|-
| Article 22, paragraph 7, paraphrased: 
A work may be exploited without permission from, and without payment of remuneration to, the copyright owner, if the name of the author and the title of the work are mentioned and the other rights enjoyed by the copyright owner by virtue of this Law are not prejudiced, in the circumstance of a State organ using a published work, within proper scope, for the purpose of fulfilling its official duties.
|}

==== Amendments to the Law ====
===== Regulation for Generative Artificial Intelligence Services =====
On April 11th 2023, the Cyberspace Administration of China released a draft of the [https://www.china-briefing.com/news/how-to-interpret-chinas-first-effort-to-regulate-generative-ai-measures/ Regulation for Generative Artificial Intelligence Services], in force since August 2023. It includes 21 measures encompassing a wide array of subjects pertaining to the development and provision of Generative AI services. 
The regulation applies to ‘only applicable to services accessible to the general public within China’. It excludes from its scope AI services developed and utilized by enterprises, research and academics, research and academics institutions, and other public entities ([https://www.cac.gov.cn/2023-04/11/c_1682854275475410.htm Article 2]). Generative AI technologies are defined as models and related technologies that can generate contents in the form of texts, pictures, audios and videos (Article 22). 
<h5 class="mwt-heading" >Requirements for training data (article 7-8)</h5>
The Generative AI Measures require service provides to source data and foundation models from legitimate sources, respect the intellectual property rights of users, and process personal information with appropriate consent or legal basis under Chinese Laws. Providers must enhance the quality of training data, striving for ‘authenticity, accuracy, objectivity, and diversity’(article 7). Thus, the Regulation places significant emphasis on safeguarding personal data and information by imposing on providers the obligation to protect the input information of users and usage records during the service provision process. During the development phase, providers must establish ‘clear, specific and practical’ labeling rules for the training data. Conducting quality assessment of data labeling and sample verification to ensure accuracy of labeled content is also required (article 8). Additionally, illegal retention of input information that can be used to infer user identities, creation of user profiles based on input information usage, and disclosure of user input information to third parties are prohibited (Article 11). 

===== AI security governance framework =====
On 10 September 2024, the State Council of China [https://english.www.gov.cn/news/202409/10/content_WS66df9f30c6d0868f4e8eac91.html published] an AI security governance framework, to come into effect on 1 January 2025. The [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf Framework] was put together by China's National Technical Committee 260 on Cybersecurity and seeks to promote responsible AI innovation. Although this framework is not a piece of legislation, compliance is [https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ suggested] to be mandatory. 
[https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ Onetrust] identifies key areas of the framework as: 
*Risk management and transparency 
*Ethical responsibilities
*Accountability mechanisms
*Cross-border data, security, and privacy considerations

 Relevant for consideration of copyright and text and data mining exceptions are: 
*requirements for data integrity, 
*recordkeeping obligations for data sources, 
*systems that comply with China’s Data Security Law and Personal Information Protection Law 

 The Safety Guidelines of the Framework are significant and wide reaching. The relevant guidelines for training AI models apply to developers. Developers of AI models [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf should] (see 6.1): 
<div>

{| style="height: 130px;"
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*uphold a people-centered approach 
| style="height: 51px; width: 454px;" |
*strengthen data security and personal information protection
|- style="height: 28px;"
| style="height: 28px; width: 512px;" |
*adhere to the principle of AI for good
| style="height: 28px; width: 454px;" |
*respect intellectual property and copyright
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*follow science and technology ethics in key stages such as requirement analysis, project initiation, model design and development, and training data selection and use
| style="height: 51px; width: 454px;" |
*ensure that data sources are clear and acquisition methods are compliant
|}
</div>
This framework also has a national security flavour, and seeks to ensure AI develops without bias or discriminatory results.  

==== Hong Kong Amendment of Copyright Ordinance ====
[https://techinsights.linklaters.com/post/102jf9o/hong-kong-proposes-new-copyright-exception-for-text-and-data-mining-to-facilitate The Hong Kong government] recently launched a two-month public [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf consultation] aimed at enhancing the Copyright Ordinance to address the challenges brought by AI technology. To maintain a balance of interests between copyright owners and users, the Copyright Ordinance contains a number of copyright exceptions that permit reasonable use of copyright works under specific circumstances. However, each exception is confined to certain situations and purposes and subject to their respective conditions and there is no specific copyright exception for text and data mining. 
The consultation focuses on four areas: 
*copyright protection of AI generated work
*copyright infringement liability for AI generated works 
*introduction to specific copyright exception for text and data mining activities 
*other issues e.g deepfakes The proposal defines [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf text and data mining] as ‘automated techniques to extract and conduct computational analysis of extensive collection of text, images, data and other types of information for generating valuable insights, patterns, trends and correlations that would likely be unattainable through manual efforts alone’.

==== Case law  ====
===== Beijing Internet Court grants Copyright to AI-Generated Image =====
The [https://globallitigationnews.bakermckenzie.com/2024/05/08/china-a-landmark-court-ruling-on-copyright-protection-for-ai-generated-works/ first case] to address whether AI-generated work
:a) are protectable by copyright and
:b) who owns the copyright
was decided before the Beijing Internet Court in November 2023.'''Facts'''
The plaintiff, Mr. Li, used Stable Diffusion (an artificial intelligence) to generate the image involved in the case and published it on the Xiaohongshu (Little Red Book) platform; the defendant, a blogger on Baijiahao, used the image generated by the plaintiff’s AI to accompany the article, and the plaintiff sued. 
'''Judgement'''
First, the Court considered the meaning of ‘works’ under the Copyright Law of China, which provides that works must be original and reflect intellectual achievement. In terms of intellectual achievement, the Court noted that the plaintiff did not merely use existing pictures returned by search engines or rearranged pre-designed elements when creating the picture. Instead, the plaintiff designed how the woman should look in the picture and entered the relevant prompts. The plaintiff then inputted detailed prompts such as ‘japan idol’, ‘cool pose’, ‘viewing at camera’ and ‘film grain’, and then further adjusted the prompts based on the preliminary images generated by Stable Diffusion. According to the court, these actions demonstrates the plaintiff's intellectual input. 
Regarding the concept of originality, the court notes that this means that the work should be independently completed by the author and that should reflect the author’s subjective expression. In the context of AI-generated images, originality should be assessed on a case-by-case basis. In this case, the plaintiff designed the different elements of the image by inputting and fine-tuning the prompts and adjusting the parameters, which ultimately demonstrates the plaintiff's original judgment. Thus, the Court held that the picture is protected by copyright as an original work. It recognized the picture as a ‘work of fine arts’ under Article 3 CLC. 
Secondly, on the matter of copyright ownership, [https://english.bjinternetcourt.gov.cn/2023-12/28/c_688.htm the Court held] that Copyright Law provides that copyright shall be owned by the author of the work and an AI model cannot be an author because it is not a natural or legal person. Moreover, the designer of Stable Diffusion only created the AI model, it was not involved in the intellectual input leading to the creation of the picture and the licensing agreements states that the designer of Stable Diffusion does not claim rights in any output content. 

===== Pending Case to address whether AI Training constitute Copyright Infringement =====
In China, the [https://www.managingip.com/article/2dnu9r92bmzrcdrw84ykg/sponsored-content/training-ai-models-and-copyright-challenges-chinese-and-eu-insights first case] to address whether AI training constitutes copyright infringement is pending before the Beijing Internet Court.
The case was brought by four Chinese illustrators against the developers of Trik AI, a generative AI painting app released by the famous Chinese lifestyle platform Xiaohongshu, with a particular strength in generating traditional Chinese-style paintings. The illustrators claimed, among others, that Xiaohongshu’s use of their work to train its AI model constituted an infringement of their reproduction rights. Xiaohongshu, on the other hand, contends that using the plaintiffs’ works for AI training should be considered "fair use" under Article 24 of the Chinese Copyright Law. A judgment in this case has not yet been issued.
From a technical perspective, establishing copyright infringement in China depends on whether the AI model has made a ‘temporary’ or ‘permanent’ reproduction of a copyrighted work during the training process. Under the Chinese Copyright Law, the general rule is that it is only when a permanent copy is made that copyright infringement occurs.

=== India ===
[https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry] has stated that India’s existing regime of intellectual property rights (IPR) and copyright is sufficient to protect both rights holders of AI-generated works, and rights holders of content that may be used by Generative AI (e.g., training data). Consequently, the Ministry states there is no reason nor need to develop an additional regime specifically regulating AI and related innovations. As a result, there is no specific regulation to discuss relating to training data and scraping, also known as text and data mining (TDM), for AI training purposes. This paper thus focuses on aspects of the current regulatory regime that are relevant to the question of AI training data, and discusses potential limitations and criticisms of the reliance on the current regime. 

 Important to note is that India also lacks regulation regarding AI generally, not just lacking regulation regarding TDM either generally or for the purposes of AI training. Despite this, the government has addressed the growing challenge of AI through publishing the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence] which highlights numerous legal and societal challenges arising from AI. This Strategy does not explicitly mention copyright or legal issues arising from TDM, but highlights privacy problems that may be relevant for TDM for training as part of the AI lifecycle.
 [https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry brings attention] to a few specific aspects of the current IPR regime. Exclusive economic rights of a copyright owner are provided by the Copyright Act 1957. For generative AI to make use of copyrighted material under this act, the use must be covered under fair dealing exceptions in Section 52 of the Copyright Act 1957. Additionally, India’s personal data regulatory framework may be a relevant consideration for TDM.

==== The Copyright Act 1957 ====
 [https://www.copyright.gov.in/Documents/Copyrightrules1957.pdf The Copyright Act 1957] is India’s main regulatory instrument regarding intellectual property and copyright. Section 13 of the Copyright Act 1957 highlights which works are provided copyright protections, which include (1) original literary, dramatic, musical and artistic works, (2) cinematographic films, and (3) sound recordings. Section 14 expounds on actions that are prohibited to take against copyrighted works. Most relevant is the mention of the prohibitions of “the storing of [the copyrighted work] in any medium by electronic or other means” (emphasis added). This is applicable for the cases of a literary, dramatic, or musical work, a computer programme, an artistic work, and cinematographic films, covering all types of works mentioned in the Copyright Act 1957.
===== Infringement of Copyright and Fair Dealing Exceptions =====
 Chapter XI Copyright Act 1957 addresses infringements of copyright. Section 51 outlines when copyright will be deemed infringed, which includes when anything is done which is the exclusive right of the copyright holder (Section 51(a)(i)), and other distributions of the copyrighted work, including when it is “to such an extent to affect prejudicially the owner of the copyright” (Section 51(b)(ii)).

 Section 52 outlines when certain acts are not considered an infringement of copyright, commonly known as fair dealing exceptions. Section 52(a)  excludes from infringement “a fair dealing with any work, not being a computer programme,” for the purposes of either “(i) private or personal use; including research; (ii) criticism or review [...]; [and] (iii) the reporting of current events and current affairs.” An accompanying explanation states that the storing of any copyrighted work in an electronic medium for the aforementioned purposes shall not constitute an infringement. Section 52(aa) (sic) excludes from infringements the certain actions towards copyrighted computer programmes, such as when a lawful possessor of a copy makes copies of the programme for certain purposes (Section aa(i)-(ii) (ab), (ac), (ad), …). Section 52 is expansive and outlines numerous other exceptions.

===== Application of the CRA 1957 to TDM =====
Generally, the Copyright Act 1957 is vague. The fair dealing exceptions in Section 52 are strict and lack any specific reference to TDM or more generally to the use of copyrighted information to develop a product as such. The Copyright Act 1957 does reference electronic storage and recent technological changes such as, for example, listing the circumvention of “an effective technological measure applied for the purpose of protecting any of the rights conferred by this Act” (Section 65A) as an offence. However, such mentions are limited and still revolve around the (illegal) act of creating a copy of a copyrighted work. Much of the Copyright Act 1957 is focused on the illegal replication of works.
The Copyright Act’s particular focus has resulted in scholarly opinion that the Act would actually not prohibit TDM despite a lack of explicit fair dealing exception. Dr. Arul George Scaria, Co-Director of the [https://ciipc.org/ Centre for Innovation, Intellectual Property, and Competition (CIIPC) at National Law University in Delhi], has argued for the legality of TDM under Indian copyright law. He [https://spicyip.com/2019/08/should-indian-copyright-law-prevent-text-and-data-mining.html argues that Indian copyright law] only protects the expression of ideas, not facts or ideas themselves. So, when a researcher, for example, uses a copyrighted article in the course of TDM, this should be considered a non-expressive use of the work outside of copyright protection. He goes so far as to argue that it is thus “morally and legally impermissible to allow publishers to use End User Licence Agreements or other contractual tools to restrict researchers from using articles for TDM.” 
Additionally, Dr. Scaria emphasises that India’s copyright regime privileges not only the rights of the creators or copyright holders, but also the users of such works. He references the[https://indiankanoon.org/doc/135895592/ Delhi University Photocopy Shop (Single Bench)] decision, wherein Justice Endlaw states that the rights of persons in Section 52, the fair dealing exception, should not be interpreted narrowly or strictly. The rights given to users should be interpreted on par with those given to creators. Lastly, Dr. Scaria argues that India’s fair dealing regime can provide the flexibility to apply to newer technological developments such as TDM. Whilst Dr. Scaria makes a compelling argument, part of that compelling argument derives from his discussion of TDM as done by researchers, rather than addressing, for example, the use of TDM to train AI for ultimately commercial purposes.
Another case did address TDM for another use, by the state. Whilst this does not explicitly address the use of TDM to train AI, it still provides perspective on how TDM might be understood in the context of India’s regulatory framework. The Supreme Court of India, in the case of [https://indiankanoon.org/doc/127517806/ Justice K.S. Puttaswamy (Retired) vs Union of India and Ors.], recognised TDM’s importance for the state. The Court held that “[TDM] with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the state to insist on the collection of authentic data.” However, this case addressed TDM primarily from a privacy law perspective, rather than copyright; consequently, there still is no litigation that addresses the TDM in a copyright context. This raises further concerns considering the lack of explicit inclusion of a TDM fair dealing exception in Section 52 of the Copyright Act 1957.
As a result, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html likely means of justifying TDM is through Section 52(1)(a) ]which allows for private and personal use of copyrighted works, including for research. This provision is nuanced, wherein the making of copyrighted works publicly available to facilitate private and personal use such as by public libraries could be justified. However, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html Calcutta High Court in 2013] stated that “commercial exploitation” does not fall under “private or personal use,” a position reaffirmed by the Bombay High Court in 2018. Thus, it seems that the main way in which TDM could be justified under India’s copyright regulation is through arguing that TDM does not infringe on the expression of the idea or data, and thus copyright does not apply, as argued by Dr. Scaria.
==== Database protection ====
 A newer form of intellectual property rights relates to database protection, which may be relevant when it comes to TDM. India does not have an explicit database right in its intellectual property right regime, but it has recently been subsumed into its copyright regulatory framework. [https://link.springer.com/chapter/10.1007/978-981-10-3984-3_10 The Delhi High Court in Himalaya Drug Company v Sumit] ruled that compilations of databases could be considered literary works and consequently covered by the Copyright Act 1957. This would mean use of compilations of databases in TDM contexts would have to fall under fair dealing exceptions in Section 52 of the Copyright Act 1957. 
==== Personal data mining ====
 Another problematic aspect of data mining is the use of [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf personal data]. The source of data used for data mining can be essential, and if the data obtained is not public knowledge or obtained consensually, Indian personal protection legislation might apply. Companies and organizations that do not obtain personal data with permission or [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf discriminate] against individuals based on age, sex, gender, race, or religion are not going to be compliant with local or transnational laws. Specifically in India, data mining in such circumstances is regulated by the [https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf Information Technology Act], 2000 (IT Act) (e.g Article 43A which outlines rules on unauthorized access, sensitive personal data, and information, as well as compensation for failure to protect data), and the [https://www.google.com/url?q=https://www.meity.gov.in/writereaddata/files/Digital%2520Personal%2520Data%2520Protection%2520Act%25202023.pdf&sa=D&source=docs&ust=1732737698777765&usg=AOvVaw0wY-MZ1iAH8P634ZfD2-Vf Personal Data Protection Bill, 2019 (PDP Bill)]. However, some scholars discuss that the production of Privacy Preserving Data Mining Techniques[https://www.researchgate.net/profile/Ahmad-Ahmad-79/publication/375343129_Psychological_Burden_of_Caregivers_of_Children_with_Cancer_at_AL-Amal_Hospital_in_Baghdad_City/links/65476ca9b86a1d521bb8fe8a/Psychological-Burden-of-Caregivers-of-Children-with-Cancer-at-AL-Amal-Hospital-in-Baghdad-City.pdf#page=410 could circumvent] regulation from data protection regulation. This approach is somewhat reflected in the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence], wherein the Indian government recommends investing in privacy-preserving AI research methods to reduce the “risks of data exploitation and personal identification (from an anonymisation dataset).”

=== United States ===
==== Text and data mining in the US ====
'''Introduction TDM'''Text- and data mining is a process used to develop AI models. Data is fed into a model and algorithms are applied to the data. The term TDM is not defined in US Law, but rather as "machine and human- based inputs” under Title 15 Commerce and Trade. Another reference can be found under Machine Learning, which mentions "the ability to automatically learn and improve on the basis of data or experience. 
'''US definition AI'''The legal definition of AI originates from the National Artificial Intelligence Initiative Act of 2020, which regulates public bodies' use of AI:
"a machine based system that can, for a given set of human-defined objectives, make predictions,  recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems  use machine- and human-based inputs to perceive real and virtual environments; abstract such  perceptions into models through analysis in an automated manner; and use model inference to  formulate options for information or action.”,
The legal question is: do any restrictions apply to the use of input such as publicly available text or data in digital form for the purpose of training AI models?
To the extent that the input may be protected by copyright, the Copyright Act of 1976 is applicable.
To the extent that the input may be pertaining to data created by human behavior, other acts or constitutional rights may apply.
To the extent that the use of the data may be unfair or harmful to competition or consumer rights, FTC regulations may apply.

==== U.S. Constitution ====
Patent and Copyright Clause
(a.k.a. Patent Clause, the Copyright Clause, and the Progress Clause)
The Congress shall have Power ...to promote the Progress of Science and useful Arts, by securing for limited Tımes to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

==== Federal Law ====
===== The Copyright Act of 1976 =====
The United States copyright law is contained in the United States Code, chapters 1 through 8 and 10 through 12 of Title 17. The Copyright Act of 1976, which provides the basic framework for the current copyright law.
The authority has been granted to the US Copyright Office since 1870. 
To the extent that “human-based input’ and data can be a product of human work, it may be protected under the constitutional clause which grants an exclusive right to the Author or Inventor.
Copyright protection is granted to original works of authorship that are fixed in a tangible medium of expression . The author of the work generally holds copyright ownership generally, a right which she may transfer or license their rights to others. 
Essential to the copyright protection in the US is the fair use doctrine, which allows for several exemptions for which limited use of copyrighted material is allowed without the author’s permission. 
Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work.
The legal discussion regarding TDM in the US is evolving essentially around the application of the exceptions under the legal doctrine of fair use.
Following the Executive Order  Executive Order 13859 announcing the American Artificial Intelligence Initiative, the United States Patent and Trademark Office (USPTO) released a report titled “Public Views on Artificial Intelligence and Intellectual Property Policy.” The report consults a wide variety of stakeholder views on the impact of artificial intelligence (AI) across the intellectual property (IP) landscape, including patent, trademark, copyright, and trade secret policy, as well as developing issues about database protection. 
In this report, the USPTO stated:‘ “The ingestion of copyrighted works for purposes of machine learning will almost by definition involve the reproduction of entire works or substantial portions thereof. Accordingly, whether this constitutes copyright infringement will generally be determined by considering the applicability of the fair use doctrine, an exception set forth in section 107 of the Copyright Act, 17 U.S.C. § 107. Fair use is applied on a case-by-case basis, requiring courts to weigh several statutory factors, and is highly fact-dependent.’  § 102).’
The report included the results of a poll among a broad array of public and private stakeholders. The report  showed that the existing legal framework lacks instruments to tackle the challenges of AI. While the majority found the existing U.S. intellectual property laws calibrated correctly to address the evolution of AI (copyright, trademarks, trade secrets, and data fields), some suggested a need for new classes of IP rights. Overall, many agreed that existing commercial law principles (e.g., contract law) might adequately fill any gaps left by IP law in the wake of advances in AI .

===== COPIED ACT bill proposal =====
July 11th 2024 the bipartisan bill was introduced in Congress.
Content Origin Protection and Integrity from Edited and Deepfaked Media Act of 2024
The bill proposal addresses the new IP issues with respect to content by requiring transparency and content provenance information in an aim to protect artistic content.
The intention to establish NIST standards for provenance information seems to open the possibility for remuneration for rights-holders. This would be aligned with the intent of the constitutional right in the Patent and Copyright Clause.

==== Recent US Court cases regarding TDM ====
NEW YORK TIMES v. OPEN AI INC (2023)
The New York Times claimed that OpenAI and Microsoft, as creators of highly profitable generative AI models, did not give credit or remuneration to the New York Times despite relying on their works. The New York Times further alleges that this conduct not only infringes on their intellectual property rights but could also threaten their business model of providing news coverage, analysis and commentary on current events.
AUTHORS GUILD v. OPEN AI INC (2024)
17 authors argue that OpenAI should have first obtained their permission to use their copyrighted works and now seek a permanent injunction against OpenAI to prevent these alleged harms from reoccurring. The Authors Guild is also seeking damages for the lost opportunity to licence their works and asserts that OpenAI and Microsoft forced them into a position where they unknowingly aided their own market replacement. 

==== Policy ====
Two executive orders have been released pertaining to the use of AI by public bodies.
Executive Order 14110 of October 30, 2023 Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence mentions data as understood in 1.1.
Regarding availability of data for training the Executive Order states:
(b) …This effort requires investments in AI-related education, training, development, research, and capacity, while simultaneously tackling novel intellectual property (IP) questions and other problems to protect inventors and creators.
(e) … The Federal Government will enforce existing consumer  protection laws and principles and enact appropriate safeguards against fraud, unintended bias,  discrimination, infringements on privacy, and other harms from AI. Such protections are especially important in critical fields like healthcare, financial services, education,  housing, law, and transportation, where mistakes by or misuse of AI could harm patients, cost  consumers or small businesses, or jeopardize safety or rights. At the same time, my Administration will  promote responsible uses of AI that protect consumers, raise the quality of goods and services, lower  their prices, or expand selection and availability.
(f) Americans’ privacy and civil liberties must be protected as AI continues advancing. Artificial Intelligence is making it easier to extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires. Artificial Intelligence’s capabilities in these areas can increase the risk that personal data could be exploited and exposed. To combat this risk, the Federal Government will ensure that the collection, use, and retention of data is lawful, is secure, and mitigates privacy and confidentiality risks. Agencies shall use available policy and technical tools, including privacy-enhancing technologies (PETs) where appropriate, to protect privacy and to combat the broader legal and societal risks—including the chilling of First Amendment rights—that result from the improper collection and use of people’s data. 
The Executive Order stipulates the need for  “tackling novel intellectual property (IP) question”, “enforce protection laws and principles”and “enact safeguards against harms from AI” as “AI is making it easier to extract …on sensitive information about people’s identities, locations, habits and desires.” The Executive order acknowledges the need for new policies to not only protects copyrights-holders in the context of AI, but also citizens as their behavioral data are being used to train AI-models.

==== Enforcement ====
As stated in section 1.1., human-based data may be a broad term, the use of which may violate several laws and regulations.. A certain responsibility  to protect competition in the interest of consumers lies with the FTC. In the case of AI, it may be difficult to assess whether infringement of violations take place.
A special enforcement resolution  was issued by the FTC in November 2023,  “ directing use of compulsory process in a non-public investigation of products and services that use or are produced using artificial intelligence or that purport to detect the use of artificial intelligence”. The specific action enables the FTC to start investigations of possible use of AI in violation with Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 to detect unfair, deceptive, anticompetitive,  collusive, coercive, predatory, exploitative, or exclusionary acts or practices in or affecting commerce relating to products and services that use or are produced using artificial intelligence, including but not limited to, machine-based systems that can, for a given set of defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments, or that purport to use or detect the use of artificial intelligence.
The proposed bill COPIED act may be instrumental in enabling the AI market to become more transparent, for rights-holders to receive remuneration based on standardized provenance mechanisms.

=== South Africa ===

Module 5: Artificial Intelligence

2025-11-26T19:49:04Z

NadineWalsh: /* The Relationship between the CDSM Directive and AI Act */

== Text and data mining ==
According to [https://eur-lex.europa.eu/eli/dir/2019/790/oj Directive (EU) 2019/790], "‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations". The Directive further provides a framework for the use of such techniques.
=== European Union ===
==== The Relationship between the CDSM Directive and AI Act ====
When considering the compatibility between the CDSM Directive and the AI Act, Regulation [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (EU) 2024/1689, Art. 53.1] provides a broad reference to the CDSM Directive: Providers of general-purpose AI models are required “to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790”. Additional obligations (Art.53.1(d)) outline the requirement to “draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model”. It is the responsibility of the AI Office to provide a template to ensure that providers follow the guidance and are exhaustive in the information made available.
 
Where the [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act refers to TDM is in Rec. 104 and 105], which is in reliance of the CDSM Directive. Here it is stated that general-purpose AI models remain, despite a number of  exceptions from obligations and requirements, obliged to produce a summary about the content used for model training. A reference to the withholding of rights over works by the rightsholder, only in cases not related to scientific research is outlined in the AIA’s recitals and cautions providers of general-purpose AI models to obtain authorisation from rightsholders if such works were to be included in TDM.
 

==== '''Questions of Scope and Enforceability''' ====
The concern is that the current provisions seem less stringent or tight in light of the fact that in order to train and develop large language models, such as Chat GPT, the input is required to come from a large variety of sources. Sources, such as books, essays, website, and even chatbot messages and social media posts may contain copyrighted materials. Under what conditions the use of these materials is considered legal, is one of the current dilemmas in the training of large language models, which form the basis of general AI use. Although it is the responsibility of the development company to ensure that copyright violations do not take place in the training and development of general-purpose AI models, Lucchi emphasises that this is a[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf field of the law, which is “multifaceted and dynamic” and which “necessitates meticulous examinations on a per-case basis”] - i.e. when are ‘fair-use’ or ‘legal exceptions’ relevant.
 
A recent [https://www.europarl.europa.eu/thinktank/en/document/IUST_STU(2025)774095 study report on generative AI and copyright], which was requested by the JURI Committee, addresses inconsistent implementation of how rights are to be reserved in a machine-readable way. This is creating difficulties for developers with regards to the aspect and ways of how the data they use is lawful. From the perspective of training and developing AI models, input and output are extrinsically interlinked and the line between both is “extremely permeable”. The growing concern, which is gaining popular airtime currently, is the fact that existing frameworks may not be sufficient to address the inherent complexities of generative AI systems, as these have or are developing the capabilities to “[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf directly compete or even dwarf original works]”.

==== '''Challenges & Case Law''' ====
In an [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ open letter], published on 30th July by the European Writers’ Council, a coalition of rightsholders emphasised that the “the damage to and unfair competition with the cultural and creative sectors can be seen each day”. [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ The coalition] requested stronger safeguards for the cultural and creative sectors. By rejecting the view that the Code of Practise provides a fair and workable balance on the use of training material access for and by GenAI models, it issued a plea to the European Parliament and member states to challenge the[https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ “unsatisfactory process of the exercise”] as this practise is seen to further weaken the situation of the creative and cultural sectors across Europe.
The first case [https://curia.europa.eu/juris/showPdf.jsf?docid=300681&doclang=EN (C-250/25)]of this kind, was lodged with the Court of Justice of the European Union (CJEU) in April 2025. The applicant, Like Company, a Hungarian publishing and news organisation, is alleging that Google Ireland Limited has accessed news reports and press releases. Like Company’s revenue is derived from advertising provided on its news portals, where news content of a journalistic nature is published. 
 
The referring Hungarian court is requesting a ruling whether the accessing and training Google’s AI Chatbot Gemini has infringed the applicant’s rights under EU legislation. When asked directly, “the chatbot operated by the defendant is capable of providing a response that displays the content of a protected press publication”. “The applicant asked the referring court to find that the defendant had infringed the applicant’s rights under the relevant national and EU legislation, by reproducing through electronic means the applicant’s press publications, in order to make them available to the public.

=== Brazil ===

==== Introduction ====

Brazil is currently in the process of implementing a national strategy on AI, a process which Brazil began in 2020. The strategy is holistic and considers many different aspects where Brazil is working on legislation, regulation, and AI governance with an eye to ethical use of AI and alignment with international approaches to AI. Brazil’s AI policy also puts a focus on education, workforce & training, research, development and innovation, how AI can be applied in “productive sectors” of the economy and in public bodies, and public security. The overall policy is founded on a goal of stimulating research, innovation and development of AI solutions while maintaining conscious and ethical use of AI. This national strategy is captured in policy documents, including the Brazilian Artificial Intelligence Strategy ([https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/arquivosinteligenciaartificial/ebia-summary_brazilian_4-979_2021.pdf EBIA]), as well as the National Strategy for Intellectual Property ([https://www.gov.br/inpi/pt-br/central-de-conteudo/noticias/cerimonia-marca-50-anos-do-inpi-e-lancamento-da-estrategia-nacional-de-propriedade-intelectual/EstratgiaNacionaldePropriedadeIntelectual.pdf ENPI]) and the National Policy of Innovation.

Pursuant to the Brazilian Artificial Intelligence Strategy, Brazil is working on specific legislation for AI. An initial draft AI Act was introduced in Brazil’s lower legislative chamber (the Chamber of Deputies) in 2020 (PL 21/2020), and was subsequently sent to the upper chamber (the Senate). The Senate convened a committee of experts to hold public hearings and collect public comments, the Comissão de Juristas responsável por subsidiar elaboração de substitutivo sobre inteligência artificial no Brasil ([https://legis.senado.leg.br/atividade/comissoes/comissao/2504/ source]). Other relevant draft laws were also pending in the Senate, so the Senate issued an order to combine, restructure and improve the text of these proposed laws pending input from the Committee. The Committee held meetings in 2022 and issued a final report in December 2022 with proposed changes to text. According to a press release from August 2024, the Senate is still reviewing draft AI legislation. A new draft text incorporating the recommended language from the committee of experts has been assigned bill number PL 2338/23, and it is this bill that appears to be moving forward in the Senate. The Chamber of Deputies’ original draft text PL 21/2020 has not moved forward; several other draft laws that relate to AI are also pending in the Senate. The Senate now has another commission debating the draft AI Act, which is continuing to meet regularly ([https://legis.senado.leg.br/atividade/comissoes/comissao/2629/ source]). Thus, it appears Brazil is getting closer to finalizing the draft legislation.

==== Text and Data Mining in Brazil ====

With the AI legislation in Brazil not yet finalized, from a copyright perspective, Brazil law currently does not authorize text and data mining (TDM) without permission of the copyright holder. Although Brazil’s copyright act, Law No. 9.610 of February 19, 1998 (Law on Copyright and Neighboring Rights), does include some exceptions to the exclusive rights of a copyright holder, none of these exceptions (in Articles 46, 47, and 48 of ) address text and data mining. [source: https://www.wipo.int/wipolex/en/legislation/details/514]. Thus, the work that Brazil’s Senate is doing on the draft AI will be important to regulate text and data mining activities when the law is finalized and approved.

The most recent and active draft AI Act in Brazil, PL 2338/23, includes the following definition of text and data mining:

\Art. 4. For the purposes of this Law, the following definitions are adopted:

[…] VIII – text and data mining: process of extracting and analyzing large amounts of data or partial or full excerpts of textual content, from which patterns and correlations are extracted that will generate relevant information for the development or use of artificial intelligence systems.

The draft law would regulate text and data mining as follows:

Art. 42. The automated use of works, such as extraction, reproduction, storage and transformation, in data and text mining processes in artificial intelligence systems, in activities carried out by research organizations and institutions, journalism and museums, archives and libraries, does not constitute an offense to copyright, provided that:
I – it does not have as its objective the simple reproduction, exhibition or dissemination of the original work itself;
II – the use occurs to the extent necessary for the objective to be achieved;
III – it does not unjustifiably harm the economic interests of the owners; and
IV – it does not compete with the normal exploitation of the works.

§ 1. Any reproductions of works for data mining activities will be kept under strict security conditions, and only for the time necessary to carry out the activity or for the specific purpose of verifying the results of scientific research.

§ 2. The provisions of the caput shall apply to the activity of data and text mining for other analytical activities in artificial intelligence systems, provided that the conditions of the items of the caput and § 1 are met, provided that the activities do not communicate the work to the public and that access to the works has been legitimate.
§ 3. The activity of text and data mining involving personal data shall be subject to the provisions of Law No. 13,709, of August 14, 2018 (General Personal Data Protection Law) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]).

As noted above, this is only a draft legislation, and this could change as the draft bill is debated further in Brazil’s congress.

The draft TDM definition and exception are notable in being fairly aligned with other jurisdictions such as the European Union. Brazil’s draft definition of TDM goes so far as to stipulate that “large amounts of data or partial or full excerpts of textual content” will be permitted to be mined, which suggests even in this definition the intent to provide an exception from the existing copyright regime. The definition also limits this use to the purpose of “development or use of artificial intelligence systems.” Arguably, this language ensures that the exception will be limited to the AI field. The inclusion of TDM when AI systems are in “use” is an interesting addition, since it suggests that TDM might be permissible not only for the training stage, but also when AI is deployed.

Like other jurisdictions such as the EU, Brazil’s draft TDM exception at Article 42 provides for use of works by research organizations and cultural institutions, namely, museums, archives, and libraries. However, it also notably allows an exception for journalism, along with the scientific and cultural uses. It is also notable that draft Article 42 includes a requirement that any use of the TDM exception “does not unjustifiably harm the economic interests of the owners” or compete with or replace the original works. Like the EU, subsection (42)(1) requires security conditions and limits the time for keeping the works.

Draft section 42(2) appears to provide a broader TDM exception that is not limited to scientific research, journalism, or cultural institutions, with additional requirements that entities using 42(2) must also not communicate the work to the public and must have had legitimate access to the works in the first place. This would seem to suggest that scraping is not allowed under draft section 42(2), but possibly is allowed for scientific research, journalistic purposes, or cultural purposes. Notably, this draft broad TDM exception in 42(2) does not include any kind of mechanism for rights holders who do not wish their works to be used in TDM activities to opt-out.

Finally, draft subsection 42(3) states that Brazil’s general data privacy law does apply to TDM activities. Thus, if this proposed language becomes law, entities using the TDM exception will still have to consider data privacy.

=== China ===
We have not identified a definition of ‘text and data mining’ in Chinese legislation or policy, so we have relied on the definition from Directive (EU) 2019/790:
''‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations. ''
This definition exists with a European Union (EU) law regarding exceptions and limitations of copyright for text and data mining. Consequently, to consider the Chinese position regarding text and data mining, we turn first to frame the copyright regime in China. 

==== Copyright Law of the People’s Republic of China (CLC) ====
Copyright Law of the People’s Republic of China in an administrative regulation enacted in 1951 and last revised in 2021. The Copyright Law aims to protect the copyright of authors in their literacy, artistic and scientific works and the copyright-related rights and interests, of encouraging the creation and dissemination of works which could contribute to the construction of socialist spiritual and material civilization, and of promoting the development and prosperity of the socialist culture and science. 
It applies to:
*works of chinese citizens, legal entities or other organizations, whether published or not
*work of a foreign or stateless person which is eligible to enjoy copyright 
**under an agreement concluded between the country to which the foreign belongs and China 
**international agreement
*works of foreign or stateless persons first published in the territory of China

==== Fair Use Doctrine ====
China is a civil law country which adheres to early continental European traditions, following the concept of the European droit d’auteur system. The structure of China’s copyright exception model can be considered as a closed list rather than an open-ended one (e.g U.S).
Specifically, Article 22 of the Chinese Copyright Law, the so-called fair use clause, lists 13 situations in which the use of copyright material constitutes permitted fair use, but it is difficult to categorize the use of copyright materials for AI training within these scenarios. Nevertheless, the [http://lawinfochina.com/display.aspx?id=9280&lib=law Chinese Supreme People’s Court judicial policy document] offers some flexibility in applying the fair use doctrine under special circumstances. It states that: 
''‘Under special circumstances as necessary for promoting technological innovation and business development, a use of works may be determined as reasonable after consideration of the nature and purposes of use, the nature of works used, the quantity and quality of the part of works used, impacts of use on potential markets or values, and other factors, provided that such use neither contravenes the normal use of the works nor results in unreasonable damage to the lawful interests of the author.’ ''
Additionally, the [https://www.wipo.int/wipolex/en/legislation/details/13428 Regulations for the Implementation of the CLC] (RICL) provides an in-depth examination of Article 22 CLC. According to Article 21 RICL ‘the exploitation of a published work which may be exploited without permission from the copyright owner in accordance with the relevant provisions of the Copyright Law shall not impair the normal exploitation of the work concerned, nor unreasonably prejudice the legitimate interests of the copyright owner. Thus, this two-step test serves as a complement to the listed exceptions in Article 22 CLC: the extent of exempted uses should not violate the two step test of Article 21 RICL. 
With the law being last revised in 2021, text and data mining is not specifically referenced as an exception to copyright. Nevertheless, a few of the listed exceptions may concern text or data mining used for AI training.
'''Fair use exceptions'''
Article 22(1) CLC provides that ‘use of a published work for the purposes of the user’s own private study, research or self-entertainment’ can be exempted. However, this example will not offer much safeguards as most AI users are corporations and the research they carry out cannot be deemed as private. 
Article 22(6) CLC provides that ‘translation, adaptation, compilation, playing, or reproduction in a small quantity of copies, of a published work for use by teachers or scientific researchers, in classroom teaching or scientific research of schools, provided that the translation or reproduction shall not be published or distributed’ can be exempted and may cover text and data mining. Still, the term ‘schools’ excludes commercial educational institutions and the commercial activities conducted by non-commercial institutions. Moreover, even if research institutions such as public universities may be covered by this exception, it is also required that the reproduction of published work shall be kept in ‘small quantity’. Thus, it is not a welcomed limitation for text and data mining that may require huge amounts of copyright data. 
Finally,  it could be a reasonably arguable position that Article 22, paragraph 7 may empower the State to engage in text and data mining, provided the State:
*mentions the name of the author and the title of the work; for example, in a list referencing all the works that were subject to the mining; and 
*the mining is by a State organ fulfilling official duties.  

{|
|-
| Article 22, paragraph 7, paraphrased: 
A work may be exploited without permission from, and without payment of remuneration to, the copyright owner, if the name of the author and the title of the work are mentioned and the other rights enjoyed by the copyright owner by virtue of this Law are not prejudiced, in the circumstance of a State organ using a published work, within proper scope, for the purpose of fulfilling its official duties.
|}

==== Amendments to the Law ====
===== Regulation for Generative Artificial Intelligence Services =====
On April 11th 2023, the Cyberspace Administration of China released a draft of the [https://www.china-briefing.com/news/how-to-interpret-chinas-first-effort-to-regulate-generative-ai-measures/ Regulation for Generative Artificial Intelligence Services], in force since August 2023. It includes 21 measures encompassing a wide array of subjects pertaining to the development and provision of Generative AI services. 
The regulation applies to ‘only applicable to services accessible to the general public within China’. It excludes from its scope AI services developed and utilized by enterprises, research and academics, research and academics institutions, and other public entities ([https://www.cac.gov.cn/2023-04/11/c_1682854275475410.htm Article 2]). Generative AI technologies are defined as models and related technologies that can generate contents in the form of texts, pictures, audios and videos (Article 22). 
<h5 class="mwt-heading" >Requirements for training data (article 7-8)</h5>
The Generative AI Measures require service provides to source data and foundation models from legitimate sources, respect the intellectual property rights of users, and process personal information with appropriate consent or legal basis under Chinese Laws. Providers must enhance the quality of training data, striving for ‘authenticity, accuracy, objectivity, and diversity’(article 7). Thus, the Regulation places significant emphasis on safeguarding personal data and information by imposing on providers the obligation to protect the input information of users and usage records during the service provision process. During the development phase, providers must establish ‘clear, specific and practical’ labeling rules for the training data. Conducting quality assessment of data labeling and sample verification to ensure accuracy of labeled content is also required (article 8). Additionally, illegal retention of input information that can be used to infer user identities, creation of user profiles based on input information usage, and disclosure of user input information to third parties are prohibited (Article 11). 

===== AI security governance framework =====
On 10 September 2024, the State Council of China [https://english.www.gov.cn/news/202409/10/content_WS66df9f30c6d0868f4e8eac91.html published] an AI security governance framework, to come into effect on 1 January 2025. The [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf Framework] was put together by China's National Technical Committee 260 on Cybersecurity and seeks to promote responsible AI innovation. Although this framework is not a piece of legislation, compliance is [https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ suggested] to be mandatory. 
[https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ Onetrust] identifies key areas of the framework as: 
*Risk management and transparency 
*Ethical responsibilities
*Accountability mechanisms
*Cross-border data, security, and privacy considerations

 Relevant for consideration of copyright and text and data mining exceptions are: 
*requirements for data integrity, 
*recordkeeping obligations for data sources, 
*systems that comply with China’s Data Security Law and Personal Information Protection Law 

 The Safety Guidelines of the Framework are significant and wide reaching. The relevant guidelines for training AI models apply to developers. Developers of AI models [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf should] (see 6.1): 
<div>

{| style="height: 130px;"
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*uphold a people-centered approach 
| style="height: 51px; width: 454px;" |
*strengthen data security and personal information protection
|- style="height: 28px;"
| style="height: 28px; width: 512px;" |
*adhere to the principle of AI for good
| style="height: 28px; width: 454px;" |
*respect intellectual property and copyright
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*follow science and technology ethics in key stages such as requirement analysis, project initiation, model design and development, and training data selection and use
| style="height: 51px; width: 454px;" |
*ensure that data sources are clear and acquisition methods are compliant
|}
</div>
This framework also has a national security flavour, and seeks to ensure AI develops without bias or discriminatory results.  

==== Hong Kong Amendment of Copyright Ordinance ====
[https://techinsights.linklaters.com/post/102jf9o/hong-kong-proposes-new-copyright-exception-for-text-and-data-mining-to-facilitate The Hong Kong government] recently launched a two-month public [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf consultation] aimed at enhancing the Copyright Ordinance to address the challenges brought by AI technology. To maintain a balance of interests between copyright owners and users, the Copyright Ordinance contains a number of copyright exceptions that permit reasonable use of copyright works under specific circumstances. However, each exception is confined to certain situations and purposes and subject to their respective conditions and there is no specific copyright exception for text and data mining. 
The consultation focuses on four areas: 
*copyright protection of AI generated work
*copyright infringement liability for AI generated works 
*introduction to specific copyright exception for text and data mining activities 
*other issues e.g deepfakes The proposal defines [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf text and data mining] as ‘automated techniques to extract and conduct computational analysis of extensive collection of text, images, data and other types of information for generating valuable insights, patterns, trends and correlations that would likely be unattainable through manual efforts alone’.

==== Case law  ====
===== Beijing Internet Court grants Copyright to AI-Generated Image =====
The [https://globallitigationnews.bakermckenzie.com/2024/05/08/china-a-landmark-court-ruling-on-copyright-protection-for-ai-generated-works/ first case] to address whether AI-generated work
:a) are protectable by copyright and
:b) who owns the copyright
was decided before the Beijing Internet Court in November 2023.'''Facts'''
The plaintiff, Mr. Li, used Stable Diffusion (an artificial intelligence) to generate the image involved in the case and published it on the Xiaohongshu (Little Red Book) platform; the defendant, a blogger on Baijiahao, used the image generated by the plaintiff’s AI to accompany the article, and the plaintiff sued. 
'''Judgement'''
First, the Court considered the meaning of ‘works’ under the Copyright Law of China, which provides that works must be original and reflect intellectual achievement. In terms of intellectual achievement, the Court noted that the plaintiff did not merely use existing pictures returned by search engines or rearranged pre-designed elements when creating the picture. Instead, the plaintiff designed how the woman should look in the picture and entered the relevant prompts. The plaintiff then inputted detailed prompts such as ‘japan idol’, ‘cool pose’, ‘viewing at camera’ and ‘film grain’, and then further adjusted the prompts based on the preliminary images generated by Stable Diffusion. According to the court, these actions demonstrates the plaintiff's intellectual input. 
Regarding the concept of originality, the court notes that this means that the work should be independently completed by the author and that should reflect the author’s subjective expression. In the context of AI-generated images, originality should be assessed on a case-by-case basis. In this case, the plaintiff designed the different elements of the image by inputting and fine-tuning the prompts and adjusting the parameters, which ultimately demonstrates the plaintiff's original judgment. Thus, the Court held that the picture is protected by copyright as an original work. It recognized the picture as a ‘work of fine arts’ under Article 3 CLC. 
Secondly, on the matter of copyright ownership, [https://english.bjinternetcourt.gov.cn/2023-12/28/c_688.htm the Court held] that Copyright Law provides that copyright shall be owned by the author of the work and an AI model cannot be an author because it is not a natural or legal person. Moreover, the designer of Stable Diffusion only created the AI model, it was not involved in the intellectual input leading to the creation of the picture and the licensing agreements states that the designer of Stable Diffusion does not claim rights in any output content. 

===== Pending Case to address whether AI Training constitute Copyright Infringement =====
In China, the [https://www.managingip.com/article/2dnu9r92bmzrcdrw84ykg/sponsored-content/training-ai-models-and-copyright-challenges-chinese-and-eu-insights first case] to address whether AI training constitutes copyright infringement is pending before the Beijing Internet Court.
The case was brought by four Chinese illustrators against the developers of Trik AI, a generative AI painting app released by the famous Chinese lifestyle platform Xiaohongshu, with a particular strength in generating traditional Chinese-style paintings. The illustrators claimed, among others, that Xiaohongshu’s use of their work to train its AI model constituted an infringement of their reproduction rights. Xiaohongshu, on the other hand, contends that using the plaintiffs’ works for AI training should be considered "fair use" under Article 24 of the Chinese Copyright Law. A judgment in this case has not yet been issued.
From a technical perspective, establishing copyright infringement in China depends on whether the AI model has made a ‘temporary’ or ‘permanent’ reproduction of a copyrighted work during the training process. Under the Chinese Copyright Law, the general rule is that it is only when a permanent copy is made that copyright infringement occurs.

=== India ===
[https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry] has stated that India’s existing regime of intellectual property rights (IPR) and copyright is sufficient to protect both rights holders of AI-generated works, and rights holders of content that may be used by Generative AI (e.g., training data). Consequently, the Ministry states there is no reason nor need to develop an additional regime specifically regulating AI and related innovations. As a result, there is no specific regulation to discuss relating to training data and scraping, also known as text and data mining (TDM), for AI training purposes. This paper thus focuses on aspects of the current regulatory regime that are relevant to the question of AI training data, and discusses potential limitations and criticisms of the reliance on the current regime. 

 Important to note is that India also lacks regulation regarding AI generally, not just lacking regulation regarding TDM either generally or for the purposes of AI training. Despite this, the government has addressed the growing challenge of AI through publishing the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence] which highlights numerous legal and societal challenges arising from AI. This Strategy does not explicitly mention copyright or legal issues arising from TDM, but highlights privacy problems that may be relevant for TDM for training as part of the AI lifecycle.
 [https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry brings attention] to a few specific aspects of the current IPR regime. Exclusive economic rights of a copyright owner are provided by the Copyright Act 1957. For generative AI to make use of copyrighted material under this act, the use must be covered under fair dealing exceptions in Section 52 of the Copyright Act 1957. Additionally, India’s personal data regulatory framework may be a relevant consideration for TDM.

==== The Copyright Act 1957 ====
 [https://www.copyright.gov.in/Documents/Copyrightrules1957.pdf The Copyright Act 1957] is India’s main regulatory instrument regarding intellectual property and copyright. Section 13 of the Copyright Act 1957 highlights which works are provided copyright protections, which include (1) original literary, dramatic, musical and artistic works, (2) cinematographic films, and (3) sound recordings. Section 14 expounds on actions that are prohibited to take against copyrighted works. Most relevant is the mention of the prohibitions of “the storing of [the copyrighted work] in any medium by electronic or other means” (emphasis added). This is applicable for the cases of a literary, dramatic, or musical work, a computer programme, an artistic work, and cinematographic films, covering all types of works mentioned in the Copyright Act 1957.
===== Infringement of Copyright and Fair Dealing Exceptions =====
 Chapter XI Copyright Act 1957 addresses infringements of copyright. Section 51 outlines when copyright will be deemed infringed, which includes when anything is done which is the exclusive right of the copyright holder (Section 51(a)(i)), and other distributions of the copyrighted work, including when it is “to such an extent to affect prejudicially the owner of the copyright” (Section 51(b)(ii)).

 Section 52 outlines when certain acts are not considered an infringement of copyright, commonly known as fair dealing exceptions. Section 52(a)  excludes from infringement “a fair dealing with any work, not being a computer programme,” for the purposes of either “(i) private or personal use; including research; (ii) criticism or review [...]; [and] (iii) the reporting of current events and current affairs.” An accompanying explanation states that the storing of any copyrighted work in an electronic medium for the aforementioned purposes shall not constitute an infringement. Section 52(aa) (sic) excludes from infringements the certain actions towards copyrighted computer programmes, such as when a lawful possessor of a copy makes copies of the programme for certain purposes (Section aa(i)-(ii) (ab), (ac), (ad), …). Section 52 is expansive and outlines numerous other exceptions.

===== Application of the CRA 1957 to TDM =====
Generally, the Copyright Act 1957 is vague. The fair dealing exceptions in Section 52 are strict and lack any specific reference to TDM or more generally to the use of copyrighted information to develop a product as such. The Copyright Act 1957 does reference electronic storage and recent technological changes such as, for example, listing the circumvention of “an effective technological measure applied for the purpose of protecting any of the rights conferred by this Act” (Section 65A) as an offence. However, such mentions are limited and still revolve around the (illegal) act of creating a copy of a copyrighted work. Much of the Copyright Act 1957 is focused on the illegal replication of works.
The Copyright Act’s particular focus has resulted in scholarly opinion that the Act would actually not prohibit TDM despite a lack of explicit fair dealing exception. Dr. Arul George Scaria, Co-Director of the [https://ciipc.org/ Centre for Innovation, Intellectual Property, and Competition (CIIPC) at National Law University in Delhi], has argued for the legality of TDM under Indian copyright law. He [https://spicyip.com/2019/08/should-indian-copyright-law-prevent-text-and-data-mining.html argues that Indian copyright law] only protects the expression of ideas, not facts or ideas themselves. So, when a researcher, for example, uses a copyrighted article in the course of TDM, this should be considered a non-expressive use of the work outside of copyright protection. He goes so far as to argue that it is thus “morally and legally impermissible to allow publishers to use End User Licence Agreements or other contractual tools to restrict researchers from using articles for TDM.” 
Additionally, Dr. Scaria emphasises that India’s copyright regime privileges not only the rights of the creators or copyright holders, but also the users of such works. He references the[https://indiankanoon.org/doc/135895592/ Delhi University Photocopy Shop (Single Bench)] decision, wherein Justice Endlaw states that the rights of persons in Section 52, the fair dealing exception, should not be interpreted narrowly or strictly. The rights given to users should be interpreted on par with those given to creators. Lastly, Dr. Scaria argues that India’s fair dealing regime can provide the flexibility to apply to newer technological developments such as TDM. Whilst Dr. Scaria makes a compelling argument, part of that compelling argument derives from his discussion of TDM as done by researchers, rather than addressing, for example, the use of TDM to train AI for ultimately commercial purposes.
Another case did address TDM for another use, by the state. Whilst this does not explicitly address the use of TDM to train AI, it still provides perspective on how TDM might be understood in the context of India’s regulatory framework. The Supreme Court of India, in the case of [https://indiankanoon.org/doc/127517806/ Justice K.S. Puttaswamy (Retired) vs Union of India and Ors.], recognised TDM’s importance for the state. The Court held that “[TDM] with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the state to insist on the collection of authentic data.” However, this case addressed TDM primarily from a privacy law perspective, rather than copyright; consequently, there still is no litigation that addresses the TDM in a copyright context. This raises further concerns considering the lack of explicit inclusion of a TDM fair dealing exception in Section 52 of the Copyright Act 1957.
As a result, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html likely means of justifying TDM is through Section 52(1)(a) ]which allows for private and personal use of copyrighted works, including for research. This provision is nuanced, wherein the making of copyrighted works publicly available to facilitate private and personal use such as by public libraries could be justified. However, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html Calcutta High Court in 2013] stated that “commercial exploitation” does not fall under “private or personal use,” a position reaffirmed by the Bombay High Court in 2018. Thus, it seems that the main way in which TDM could be justified under India’s copyright regulation is through arguing that TDM does not infringe on the expression of the idea or data, and thus copyright does not apply, as argued by Dr. Scaria.
==== Database protection ====
 A newer form of intellectual property rights relates to database protection, which may be relevant when it comes to TDM. India does not have an explicit database right in its intellectual property right regime, but it has recently been subsumed into its copyright regulatory framework. [https://link.springer.com/chapter/10.1007/978-981-10-3984-3_10 The Delhi High Court in Himalaya Drug Company v Sumit] ruled that compilations of databases could be considered literary works and consequently covered by the Copyright Act 1957. This would mean use of compilations of databases in TDM contexts would have to fall under fair dealing exceptions in Section 52 of the Copyright Act 1957. 
==== Personal data mining ====
 Another problematic aspect of data mining is the use of [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf personal data]. The source of data used for data mining can be essential, and if the data obtained is not public knowledge or obtained consensually, Indian personal protection legislation might apply. Companies and organizations that do not obtain personal data with permission or [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf discriminate] against individuals based on age, sex, gender, race, or religion are not going to be compliant with local or transnational laws. Specifically in India, data mining in such circumstances is regulated by the [https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf Information Technology Act], 2000 (IT Act) (e.g Article 43A which outlines rules on unauthorized access, sensitive personal data, and information, as well as compensation for failure to protect data), and the [https://www.google.com/url?q=https://www.meity.gov.in/writereaddata/files/Digital%2520Personal%2520Data%2520Protection%2520Act%25202023.pdf&sa=D&source=docs&ust=1732737698777765&usg=AOvVaw0wY-MZ1iAH8P634ZfD2-Vf Personal Data Protection Bill, 2019 (PDP Bill)]. However, some scholars discuss that the production of Privacy Preserving Data Mining Techniques[https://www.researchgate.net/profile/Ahmad-Ahmad-79/publication/375343129_Psychological_Burden_of_Caregivers_of_Children_with_Cancer_at_AL-Amal_Hospital_in_Baghdad_City/links/65476ca9b86a1d521bb8fe8a/Psychological-Burden-of-Caregivers-of-Children-with-Cancer-at-AL-Amal-Hospital-in-Baghdad-City.pdf#page=410 could circumvent] regulation from data protection regulation. This approach is somewhat reflected in the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence], wherein the Indian government recommends investing in privacy-preserving AI research methods to reduce the “risks of data exploitation and personal identification (from an anonymisation dataset).”

=== United States ===
==== Text and data mining in the US ====
'''Introduction TDM'''Text- and data mining is a process used to develop AI models. Data is fed into a model and algorithms are applied to the data. The term TDM is not defined in US Law, but rather as "machine and human- based inputs” under Title 15 Commerce and Trade. Another reference can be found under Machine Learning, which mentions "the ability to automatically learn and improve on the basis of data or experience. 
'''US definition AI'''The legal definition of AI originates from the National Artificial Intelligence Initiative Act of 2020, which regulates public bodies' use of AI:
"a machine based system that can, for a given set of human-defined objectives, make predictions,  recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems  use machine- and human-based inputs to perceive real and virtual environments; abstract such  perceptions into models through analysis in an automated manner; and use model inference to  formulate options for information or action.”,
The legal question is: do any restrictions apply to the use of input such as publicly available text or data in digital form for the purpose of training AI models?
To the extent that the input may be protected by copyright, the Copyright Act of 1976 is applicable.
To the extent that the input may be pertaining to data created by human behavior, other acts or constitutional rights may apply.
To the extent that the use of the data may be unfair or harmful to competition or consumer rights, FTC regulations may apply.

==== U.S. Constitution ====
Patent and Copyright Clause
(a.k.a. Patent Clause, the Copyright Clause, and the Progress Clause)
The Congress shall have Power ...to promote the Progress of Science and useful Arts, by securing for limited Tımes to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

==== Federal Law ====
===== The Copyright Act of 1976 =====
The United States copyright law is contained in the United States Code, chapters 1 through 8 and 10 through 12 of Title 17. The Copyright Act of 1976, which provides the basic framework for the current copyright law.
The authority has been granted to the US Copyright Office since 1870. 
To the extent that “human-based input’ and data can be a product of human work, it may be protected under the constitutional clause which grants an exclusive right to the Author or Inventor.
Copyright protection is granted to original works of authorship that are fixed in a tangible medium of expression . The author of the work generally holds copyright ownership generally, a right which she may transfer or license their rights to others. 
Essential to the copyright protection in the US is the fair use doctrine, which allows for several exemptions for which limited use of copyrighted material is allowed without the author’s permission. 
Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work.
The legal discussion regarding TDM in the US is evolving essentially around the application of the exceptions under the legal doctrine of fair use.
Following the Executive Order  Executive Order 13859 announcing the American Artificial Intelligence Initiative, the United States Patent and Trademark Office (USPTO) released a report titled “Public Views on Artificial Intelligence and Intellectual Property Policy.” The report consults a wide variety of stakeholder views on the impact of artificial intelligence (AI) across the intellectual property (IP) landscape, including patent, trademark, copyright, and trade secret policy, as well as developing issues about database protection. 
In this report, the USPTO stated:‘ “The ingestion of copyrighted works for purposes of machine learning will almost by definition involve the reproduction of entire works or substantial portions thereof. Accordingly, whether this constitutes copyright infringement will generally be determined by considering the applicability of the fair use doctrine, an exception set forth in section 107 of the Copyright Act, 17 U.S.C. § 107. Fair use is applied on a case-by-case basis, requiring courts to weigh several statutory factors, and is highly fact-dependent.’  § 102).’
The report included the results of a poll among a broad array of public and private stakeholders. The report  showed that the existing legal framework lacks instruments to tackle the challenges of AI. While the majority found the existing U.S. intellectual property laws calibrated correctly to address the evolution of AI (copyright, trademarks, trade secrets, and data fields), some suggested a need for new classes of IP rights. Overall, many agreed that existing commercial law principles (e.g., contract law) might adequately fill any gaps left by IP law in the wake of advances in AI .

===== COPIED ACT bill proposal =====
July 11th 2024 the bipartisan bill was introduced in Congress.
Content Origin Protection and Integrity from Edited and Deepfaked Media Act of 2024
The bill proposal addresses the new IP issues with respect to content by requiring transparency and content provenance information in an aim to protect artistic content.
The intention to establish NIST standards for provenance information seems to open the possibility for remuneration for rights-holders. This would be aligned with the intent of the constitutional right in the Patent and Copyright Clause.

==== Recent US Court cases regarding TDM ====
NEW YORK TIMES v. OPEN AI INC (2023)
The New York Times claimed that OpenAI and Microsoft, as creators of highly profitable generative AI models, did not give credit or remuneration to the New York Times despite relying on their works. The New York Times further alleges that this conduct not only infringes on their intellectual property rights but could also threaten their business model of providing news coverage, analysis and commentary on current events.
AUTHORS GUILD v. OPEN AI INC (2024)
17 authors argue that OpenAI should have first obtained their permission to use their copyrighted works and now seek a permanent injunction against OpenAI to prevent these alleged harms from reoccurring. The Authors Guild is also seeking damages for the lost opportunity to licence their works and asserts that OpenAI and Microsoft forced them into a position where they unknowingly aided their own market replacement. 

==== Policy ====
Two executive orders have been released pertaining to the use of AI by public bodies.
Executive Order 14110 of October 30, 2023 Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence mentions data as understood in 1.1.
Regarding availability of data for training the Executive Order states:
(b) …This effort requires investments in AI-related education, training, development, research, and capacity, while simultaneously tackling novel intellectual property (IP) questions and other problems to protect inventors and creators.
(e) … The Federal Government will enforce existing consumer  protection laws and principles and enact appropriate safeguards against fraud, unintended bias,  discrimination, infringements on privacy, and other harms from AI. Such protections are especially important in critical fields like healthcare, financial services, education,  housing, law, and transportation, where mistakes by or misuse of AI could harm patients, cost  consumers or small businesses, or jeopardize safety or rights. At the same time, my Administration will  promote responsible uses of AI that protect consumers, raise the quality of goods and services, lower  their prices, or expand selection and availability.
(f) Americans’ privacy and civil liberties must be protected as AI continues advancing. Artificial Intelligence is making it easier to extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires. Artificial Intelligence’s capabilities in these areas can increase the risk that personal data could be exploited and exposed. To combat this risk, the Federal Government will ensure that the collection, use, and retention of data is lawful, is secure, and mitigates privacy and confidentiality risks. Agencies shall use available policy and technical tools, including privacy-enhancing technologies (PETs) where appropriate, to protect privacy and to combat the broader legal and societal risks—including the chilling of First Amendment rights—that result from the improper collection and use of people’s data. 
The Executive Order stipulates the need for  “tackling novel intellectual property (IP) question”, “enforce protection laws and principles”and “enact safeguards against harms from AI” as “AI is making it easier to extract …on sensitive information about people’s identities, locations, habits and desires.” The Executive order acknowledges the need for new policies to not only protects copyrights-holders in the context of AI, but also citizens as their behavioral data are being used to train AI-models.

==== Enforcement ====
As stated in section 1.1., human-based data may be a broad term, the use of which may violate several laws and regulations.. A certain responsibility  to protect competition in the interest of consumers lies with the FTC. In the case of AI, it may be difficult to assess whether infringement of violations take place.
A special enforcement resolution  was issued by the FTC in November 2023,  “ directing use of compulsory process in a non-public investigation of products and services that use or are produced using artificial intelligence or that purport to detect the use of artificial intelligence”. The specific action enables the FTC to start investigations of possible use of AI in violation with Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 to detect unfair, deceptive, anticompetitive,  collusive, coercive, predatory, exploitative, or exclusionary acts or practices in or affecting commerce relating to products and services that use or are produced using artificial intelligence, including but not limited to, machine-based systems that can, for a given set of defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments, or that purport to use or detect the use of artificial intelligence.
The proposed bill COPIED act may be instrumental in enabling the AI market to become more transparent, for rights-holders to receive remuneration based on standardized provenance mechanisms.

=== South Africa ===

Module 5: Artificial Intelligence

2025-11-26T19:48:40Z

NadineWalsh: /* European Union */

== Text and data mining ==
According to [https://eur-lex.europa.eu/eli/dir/2019/790/oj Directive (EU) 2019/790], "‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations". The Directive further provides a framework for the use of such techniques.
=== European Union ===
==== '''The Relationship between the CDSM Directive and AI Act''' ====
When considering the compatibility between the CDSM Directive and the AI Act, Regulation [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (EU) 2024/1689, Art. 53.1] provides a broad reference to the CDSM Directive: Providers of general-purpose AI models are required “to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790”. Additional obligations (Art.53.1(d)) outline the requirement to “draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model”. It is the responsibility of the AI Office to provide a template to ensure that providers follow the guidance and are exhaustive in the information made available.
 
Where the [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act refers to TDM is in Rec. 104 and 105], which is in reliance of the CDSM Directive. Here it is stated that general-purpose AI models remain, despite a number of  exceptions from obligations and requirements, obliged to produce a summary about the content used for model training. A reference to the withholding of rights over works by the rightsholder, only in cases not related to scientific research is outlined in the AIA’s recitals and cautions providers of general-purpose AI models to obtain authorisation from rightsholders if such works were to be included in TDM.
 

==== '''Questions of Scope and Enforceability''' ====
The concern is that the current provisions seem less stringent or tight in light of the fact that in order to train and develop large language models, such as Chat GPT, the input is required to come from a large variety of sources. Sources, such as books, essays, website, and even chatbot messages and social media posts may contain copyrighted materials. Under what conditions the use of these materials is considered legal, is one of the current dilemmas in the training of large language models, which form the basis of general AI use. Although it is the responsibility of the development company to ensure that copyright violations do not take place in the training and development of general-purpose AI models, Lucchi emphasises that this is a[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf field of the law, which is “multifaceted and dynamic” and which “necessitates meticulous examinations on a per-case basis”] - i.e. when are ‘fair-use’ or ‘legal exceptions’ relevant.
 
A recent [https://www.europarl.europa.eu/thinktank/en/document/IUST_STU(2025)774095 study report on generative AI and copyright], which was requested by the JURI Committee, addresses inconsistent implementation of how rights are to be reserved in a machine-readable way. This is creating difficulties for developers with regards to the aspect and ways of how the data they use is lawful. From the perspective of training and developing AI models, input and output are extrinsically interlinked and the line between both is “extremely permeable”. The growing concern, which is gaining popular airtime currently, is the fact that existing frameworks may not be sufficient to address the inherent complexities of generative AI systems, as these have or are developing the capabilities to “[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf directly compete or even dwarf original works]”.

==== '''Challenges & Case Law''' ====
In an [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ open letter], published on 30th July by the European Writers’ Council, a coalition of rightsholders emphasised that the “the damage to and unfair competition with the cultural and creative sectors can be seen each day”. [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ The coalition] requested stronger safeguards for the cultural and creative sectors. By rejecting the view that the Code of Practise provides a fair and workable balance on the use of training material access for and by GenAI models, it issued a plea to the European Parliament and member states to challenge the[https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ “unsatisfactory process of the exercise”] as this practise is seen to further weaken the situation of the creative and cultural sectors across Europe.
The first case [https://curia.europa.eu/juris/showPdf.jsf?docid=300681&doclang=EN (C-250/25)]of this kind, was lodged with the Court of Justice of the European Union (CJEU) in April 2025. The applicant, Like Company, a Hungarian publishing and news organisation, is alleging that Google Ireland Limited has accessed news reports and press releases. Like Company’s revenue is derived from advertising provided on its news portals, where news content of a journalistic nature is published. 
 
The referring Hungarian court is requesting a ruling whether the accessing and training Google’s AI Chatbot Gemini has infringed the applicant’s rights under EU legislation. When asked directly, “the chatbot operated by the defendant is capable of providing a response that displays the content of a protected press publication”. “The applicant asked the referring court to find that the defendant had infringed the applicant’s rights under the relevant national and EU legislation, by reproducing through electronic means the applicant’s press publications, in order to make them available to the public.

=== Brazil ===

==== Introduction ====

Brazil is currently in the process of implementing a national strategy on AI, a process which Brazil began in 2020. The strategy is holistic and considers many different aspects where Brazil is working on legislation, regulation, and AI governance with an eye to ethical use of AI and alignment with international approaches to AI. Brazil’s AI policy also puts a focus on education, workforce & training, research, development and innovation, how AI can be applied in “productive sectors” of the economy and in public bodies, and public security. The overall policy is founded on a goal of stimulating research, innovation and development of AI solutions while maintaining conscious and ethical use of AI. This national strategy is captured in policy documents, including the Brazilian Artificial Intelligence Strategy ([https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/arquivosinteligenciaartificial/ebia-summary_brazilian_4-979_2021.pdf EBIA]), as well as the National Strategy for Intellectual Property ([https://www.gov.br/inpi/pt-br/central-de-conteudo/noticias/cerimonia-marca-50-anos-do-inpi-e-lancamento-da-estrategia-nacional-de-propriedade-intelectual/EstratgiaNacionaldePropriedadeIntelectual.pdf ENPI]) and the National Policy of Innovation.

Pursuant to the Brazilian Artificial Intelligence Strategy, Brazil is working on specific legislation for AI. An initial draft AI Act was introduced in Brazil’s lower legislative chamber (the Chamber of Deputies) in 2020 (PL 21/2020), and was subsequently sent to the upper chamber (the Senate). The Senate convened a committee of experts to hold public hearings and collect public comments, the Comissão de Juristas responsável por subsidiar elaboração de substitutivo sobre inteligência artificial no Brasil ([https://legis.senado.leg.br/atividade/comissoes/comissao/2504/ source]). Other relevant draft laws were also pending in the Senate, so the Senate issued an order to combine, restructure and improve the text of these proposed laws pending input from the Committee. The Committee held meetings in 2022 and issued a final report in December 2022 with proposed changes to text. According to a press release from August 2024, the Senate is still reviewing draft AI legislation. A new draft text incorporating the recommended language from the committee of experts has been assigned bill number PL 2338/23, and it is this bill that appears to be moving forward in the Senate. The Chamber of Deputies’ original draft text PL 21/2020 has not moved forward; several other draft laws that relate to AI are also pending in the Senate. The Senate now has another commission debating the draft AI Act, which is continuing to meet regularly ([https://legis.senado.leg.br/atividade/comissoes/comissao/2629/ source]). Thus, it appears Brazil is getting closer to finalizing the draft legislation.

==== Text and Data Mining in Brazil ====

With the AI legislation in Brazil not yet finalized, from a copyright perspective, Brazil law currently does not authorize text and data mining (TDM) without permission of the copyright holder. Although Brazil’s copyright act, Law No. 9.610 of February 19, 1998 (Law on Copyright and Neighboring Rights), does include some exceptions to the exclusive rights of a copyright holder, none of these exceptions (in Articles 46, 47, and 48 of ) address text and data mining. [source: https://www.wipo.int/wipolex/en/legislation/details/514]. Thus, the work that Brazil’s Senate is doing on the draft AI will be important to regulate text and data mining activities when the law is finalized and approved.

The most recent and active draft AI Act in Brazil, PL 2338/23, includes the following definition of text and data mining:

\Art. 4. For the purposes of this Law, the following definitions are adopted:

[…] VIII – text and data mining: process of extracting and analyzing large amounts of data or partial or full excerpts of textual content, from which patterns and correlations are extracted that will generate relevant information for the development or use of artificial intelligence systems.

The draft law would regulate text and data mining as follows:

Art. 42. The automated use of works, such as extraction, reproduction, storage and transformation, in data and text mining processes in artificial intelligence systems, in activities carried out by research organizations and institutions, journalism and museums, archives and libraries, does not constitute an offense to copyright, provided that:
I – it does not have as its objective the simple reproduction, exhibition or dissemination of the original work itself;
II – the use occurs to the extent necessary for the objective to be achieved;
III – it does not unjustifiably harm the economic interests of the owners; and
IV – it does not compete with the normal exploitation of the works.

§ 1. Any reproductions of works for data mining activities will be kept under strict security conditions, and only for the time necessary to carry out the activity or for the specific purpose of verifying the results of scientific research.

§ 2. The provisions of the caput shall apply to the activity of data and text mining for other analytical activities in artificial intelligence systems, provided that the conditions of the items of the caput and § 1 are met, provided that the activities do not communicate the work to the public and that access to the works has been legitimate.
§ 3. The activity of text and data mining involving personal data shall be subject to the provisions of Law No. 13,709, of August 14, 2018 (General Personal Data Protection Law) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]).

As noted above, this is only a draft legislation, and this could change as the draft bill is debated further in Brazil’s congress.

The draft TDM definition and exception are notable in being fairly aligned with other jurisdictions such as the European Union. Brazil’s draft definition of TDM goes so far as to stipulate that “large amounts of data or partial or full excerpts of textual content” will be permitted to be mined, which suggests even in this definition the intent to provide an exception from the existing copyright regime. The definition also limits this use to the purpose of “development or use of artificial intelligence systems.” Arguably, this language ensures that the exception will be limited to the AI field. The inclusion of TDM when AI systems are in “use” is an interesting addition, since it suggests that TDM might be permissible not only for the training stage, but also when AI is deployed.

Like other jurisdictions such as the EU, Brazil’s draft TDM exception at Article 42 provides for use of works by research organizations and cultural institutions, namely, museums, archives, and libraries. However, it also notably allows an exception for journalism, along with the scientific and cultural uses. It is also notable that draft Article 42 includes a requirement that any use of the TDM exception “does not unjustifiably harm the economic interests of the owners” or compete with or replace the original works. Like the EU, subsection (42)(1) requires security conditions and limits the time for keeping the works.

Draft section 42(2) appears to provide a broader TDM exception that is not limited to scientific research, journalism, or cultural institutions, with additional requirements that entities using 42(2) must also not communicate the work to the public and must have had legitimate access to the works in the first place. This would seem to suggest that scraping is not allowed under draft section 42(2), but possibly is allowed for scientific research, journalistic purposes, or cultural purposes. Notably, this draft broad TDM exception in 42(2) does not include any kind of mechanism for rights holders who do not wish their works to be used in TDM activities to opt-out.

Finally, draft subsection 42(3) states that Brazil’s general data privacy law does apply to TDM activities. Thus, if this proposed language becomes law, entities using the TDM exception will still have to consider data privacy.

=== China ===
We have not identified a definition of ‘text and data mining’ in Chinese legislation or policy, so we have relied on the definition from Directive (EU) 2019/790:
''‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations. ''
This definition exists with a European Union (EU) law regarding exceptions and limitations of copyright for text and data mining. Consequently, to consider the Chinese position regarding text and data mining, we turn first to frame the copyright regime in China. 

==== Copyright Law of the People’s Republic of China (CLC) ====
Copyright Law of the People’s Republic of China in an administrative regulation enacted in 1951 and last revised in 2021. The Copyright Law aims to protect the copyright of authors in their literacy, artistic and scientific works and the copyright-related rights and interests, of encouraging the creation and dissemination of works which could contribute to the construction of socialist spiritual and material civilization, and of promoting the development and prosperity of the socialist culture and science. 
It applies to:
*works of chinese citizens, legal entities or other organizations, whether published or not
*work of a foreign or stateless person which is eligible to enjoy copyright 
**under an agreement concluded between the country to which the foreign belongs and China 
**international agreement
*works of foreign or stateless persons first published in the territory of China

==== Fair Use Doctrine ====
China is a civil law country which adheres to early continental European traditions, following the concept of the European droit d’auteur system. The structure of China’s copyright exception model can be considered as a closed list rather than an open-ended one (e.g U.S).
Specifically, Article 22 of the Chinese Copyright Law, the so-called fair use clause, lists 13 situations in which the use of copyright material constitutes permitted fair use, but it is difficult to categorize the use of copyright materials for AI training within these scenarios. Nevertheless, the [http://lawinfochina.com/display.aspx?id=9280&lib=law Chinese Supreme People’s Court judicial policy document] offers some flexibility in applying the fair use doctrine under special circumstances. It states that: 
''‘Under special circumstances as necessary for promoting technological innovation and business development, a use of works may be determined as reasonable after consideration of the nature and purposes of use, the nature of works used, the quantity and quality of the part of works used, impacts of use on potential markets or values, and other factors, provided that such use neither contravenes the normal use of the works nor results in unreasonable damage to the lawful interests of the author.’ ''
Additionally, the [https://www.wipo.int/wipolex/en/legislation/details/13428 Regulations for the Implementation of the CLC] (RICL) provides an in-depth examination of Article 22 CLC. According to Article 21 RICL ‘the exploitation of a published work which may be exploited without permission from the copyright owner in accordance with the relevant provisions of the Copyright Law shall not impair the normal exploitation of the work concerned, nor unreasonably prejudice the legitimate interests of the copyright owner. Thus, this two-step test serves as a complement to the listed exceptions in Article 22 CLC: the extent of exempted uses should not violate the two step test of Article 21 RICL. 
With the law being last revised in 2021, text and data mining is not specifically referenced as an exception to copyright. Nevertheless, a few of the listed exceptions may concern text or data mining used for AI training.
'''Fair use exceptions'''
Article 22(1) CLC provides that ‘use of a published work for the purposes of the user’s own private study, research or self-entertainment’ can be exempted. However, this example will not offer much safeguards as most AI users are corporations and the research they carry out cannot be deemed as private. 
Article 22(6) CLC provides that ‘translation, adaptation, compilation, playing, or reproduction in a small quantity of copies, of a published work for use by teachers or scientific researchers, in classroom teaching or scientific research of schools, provided that the translation or reproduction shall not be published or distributed’ can be exempted and may cover text and data mining. Still, the term ‘schools’ excludes commercial educational institutions and the commercial activities conducted by non-commercial institutions. Moreover, even if research institutions such as public universities may be covered by this exception, it is also required that the reproduction of published work shall be kept in ‘small quantity’. Thus, it is not a welcomed limitation for text and data mining that may require huge amounts of copyright data. 
Finally,  it could be a reasonably arguable position that Article 22, paragraph 7 may empower the State to engage in text and data mining, provided the State:
*mentions the name of the author and the title of the work; for example, in a list referencing all the works that were subject to the mining; and 
*the mining is by a State organ fulfilling official duties.  

{|
|-
| Article 22, paragraph 7, paraphrased: 
A work may be exploited without permission from, and without payment of remuneration to, the copyright owner, if the name of the author and the title of the work are mentioned and the other rights enjoyed by the copyright owner by virtue of this Law are not prejudiced, in the circumstance of a State organ using a published work, within proper scope, for the purpose of fulfilling its official duties.
|}

==== Amendments to the Law ====
===== Regulation for Generative Artificial Intelligence Services =====
On April 11th 2023, the Cyberspace Administration of China released a draft of the [https://www.china-briefing.com/news/how-to-interpret-chinas-first-effort-to-regulate-generative-ai-measures/ Regulation for Generative Artificial Intelligence Services], in force since August 2023. It includes 21 measures encompassing a wide array of subjects pertaining to the development and provision of Generative AI services. 
The regulation applies to ‘only applicable to services accessible to the general public within China’. It excludes from its scope AI services developed and utilized by enterprises, research and academics, research and academics institutions, and other public entities ([https://www.cac.gov.cn/2023-04/11/c_1682854275475410.htm Article 2]). Generative AI technologies are defined as models and related technologies that can generate contents in the form of texts, pictures, audios and videos (Article 22). 
<h5 class="mwt-heading" >Requirements for training data (article 7-8)</h5>
The Generative AI Measures require service provides to source data and foundation models from legitimate sources, respect the intellectual property rights of users, and process personal information with appropriate consent or legal basis under Chinese Laws. Providers must enhance the quality of training data, striving for ‘authenticity, accuracy, objectivity, and diversity’(article 7). Thus, the Regulation places significant emphasis on safeguarding personal data and information by imposing on providers the obligation to protect the input information of users and usage records during the service provision process. During the development phase, providers must establish ‘clear, specific and practical’ labeling rules for the training data. Conducting quality assessment of data labeling and sample verification to ensure accuracy of labeled content is also required (article 8). Additionally, illegal retention of input information that can be used to infer user identities, creation of user profiles based on input information usage, and disclosure of user input information to third parties are prohibited (Article 11). 

===== AI security governance framework =====
On 10 September 2024, the State Council of China [https://english.www.gov.cn/news/202409/10/content_WS66df9f30c6d0868f4e8eac91.html published] an AI security governance framework, to come into effect on 1 January 2025. The [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf Framework] was put together by China's National Technical Committee 260 on Cybersecurity and seeks to promote responsible AI innovation. Although this framework is not a piece of legislation, compliance is [https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ suggested] to be mandatory. 
[https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ Onetrust] identifies key areas of the framework as: 
*Risk management and transparency 
*Ethical responsibilities
*Accountability mechanisms
*Cross-border data, security, and privacy considerations

 Relevant for consideration of copyright and text and data mining exceptions are: 
*requirements for data integrity, 
*recordkeeping obligations for data sources, 
*systems that comply with China’s Data Security Law and Personal Information Protection Law 

 The Safety Guidelines of the Framework are significant and wide reaching. The relevant guidelines for training AI models apply to developers. Developers of AI models [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf should] (see 6.1): 
<div>

{| style="height: 130px;"
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*uphold a people-centered approach 
| style="height: 51px; width: 454px;" |
*strengthen data security and personal information protection
|- style="height: 28px;"
| style="height: 28px; width: 512px;" |
*adhere to the principle of AI for good
| style="height: 28px; width: 454px;" |
*respect intellectual property and copyright
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*follow science and technology ethics in key stages such as requirement analysis, project initiation, model design and development, and training data selection and use
| style="height: 51px; width: 454px;" |
*ensure that data sources are clear and acquisition methods are compliant
|}
</div>
This framework also has a national security flavour, and seeks to ensure AI develops without bias or discriminatory results.  

==== Hong Kong Amendment of Copyright Ordinance ====
[https://techinsights.linklaters.com/post/102jf9o/hong-kong-proposes-new-copyright-exception-for-text-and-data-mining-to-facilitate The Hong Kong government] recently launched a two-month public [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf consultation] aimed at enhancing the Copyright Ordinance to address the challenges brought by AI technology. To maintain a balance of interests between copyright owners and users, the Copyright Ordinance contains a number of copyright exceptions that permit reasonable use of copyright works under specific circumstances. However, each exception is confined to certain situations and purposes and subject to their respective conditions and there is no specific copyright exception for text and data mining. 
The consultation focuses on four areas: 
*copyright protection of AI generated work
*copyright infringement liability for AI generated works 
*introduction to specific copyright exception for text and data mining activities 
*other issues e.g deepfakes The proposal defines [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf text and data mining] as ‘automated techniques to extract and conduct computational analysis of extensive collection of text, images, data and other types of information for generating valuable insights, patterns, trends and correlations that would likely be unattainable through manual efforts alone’.

==== Case law  ====
===== Beijing Internet Court grants Copyright to AI-Generated Image =====
The [https://globallitigationnews.bakermckenzie.com/2024/05/08/china-a-landmark-court-ruling-on-copyright-protection-for-ai-generated-works/ first case] to address whether AI-generated work
:a) are protectable by copyright and
:b) who owns the copyright
was decided before the Beijing Internet Court in November 2023.'''Facts'''
The plaintiff, Mr. Li, used Stable Diffusion (an artificial intelligence) to generate the image involved in the case and published it on the Xiaohongshu (Little Red Book) platform; the defendant, a blogger on Baijiahao, used the image generated by the plaintiff’s AI to accompany the article, and the plaintiff sued. 
'''Judgement'''
First, the Court considered the meaning of ‘works’ under the Copyright Law of China, which provides that works must be original and reflect intellectual achievement. In terms of intellectual achievement, the Court noted that the plaintiff did not merely use existing pictures returned by search engines or rearranged pre-designed elements when creating the picture. Instead, the plaintiff designed how the woman should look in the picture and entered the relevant prompts. The plaintiff then inputted detailed prompts such as ‘japan idol’, ‘cool pose’, ‘viewing at camera’ and ‘film grain’, and then further adjusted the prompts based on the preliminary images generated by Stable Diffusion. According to the court, these actions demonstrates the plaintiff's intellectual input. 
Regarding the concept of originality, the court notes that this means that the work should be independently completed by the author and that should reflect the author’s subjective expression. In the context of AI-generated images, originality should be assessed on a case-by-case basis. In this case, the plaintiff designed the different elements of the image by inputting and fine-tuning the prompts and adjusting the parameters, which ultimately demonstrates the plaintiff's original judgment. Thus, the Court held that the picture is protected by copyright as an original work. It recognized the picture as a ‘work of fine arts’ under Article 3 CLC. 
Secondly, on the matter of copyright ownership, [https://english.bjinternetcourt.gov.cn/2023-12/28/c_688.htm the Court held] that Copyright Law provides that copyright shall be owned by the author of the work and an AI model cannot be an author because it is not a natural or legal person. Moreover, the designer of Stable Diffusion only created the AI model, it was not involved in the intellectual input leading to the creation of the picture and the licensing agreements states that the designer of Stable Diffusion does not claim rights in any output content. 

===== Pending Case to address whether AI Training constitute Copyright Infringement =====
In China, the [https://www.managingip.com/article/2dnu9r92bmzrcdrw84ykg/sponsored-content/training-ai-models-and-copyright-challenges-chinese-and-eu-insights first case] to address whether AI training constitutes copyright infringement is pending before the Beijing Internet Court.
The case was brought by four Chinese illustrators against the developers of Trik AI, a generative AI painting app released by the famous Chinese lifestyle platform Xiaohongshu, with a particular strength in generating traditional Chinese-style paintings. The illustrators claimed, among others, that Xiaohongshu’s use of their work to train its AI model constituted an infringement of their reproduction rights. Xiaohongshu, on the other hand, contends that using the plaintiffs’ works for AI training should be considered "fair use" under Article 24 of the Chinese Copyright Law. A judgment in this case has not yet been issued.
From a technical perspective, establishing copyright infringement in China depends on whether the AI model has made a ‘temporary’ or ‘permanent’ reproduction of a copyrighted work during the training process. Under the Chinese Copyright Law, the general rule is that it is only when a permanent copy is made that copyright infringement occurs.

=== India ===
[https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry] has stated that India’s existing regime of intellectual property rights (IPR) and copyright is sufficient to protect both rights holders of AI-generated works, and rights holders of content that may be used by Generative AI (e.g., training data). Consequently, the Ministry states there is no reason nor need to develop an additional regime specifically regulating AI and related innovations. As a result, there is no specific regulation to discuss relating to training data and scraping, also known as text and data mining (TDM), for AI training purposes. This paper thus focuses on aspects of the current regulatory regime that are relevant to the question of AI training data, and discusses potential limitations and criticisms of the reliance on the current regime. 

 Important to note is that India also lacks regulation regarding AI generally, not just lacking regulation regarding TDM either generally or for the purposes of AI training. Despite this, the government has addressed the growing challenge of AI through publishing the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence] which highlights numerous legal and societal challenges arising from AI. This Strategy does not explicitly mention copyright or legal issues arising from TDM, but highlights privacy problems that may be relevant for TDM for training as part of the AI lifecycle.
 [https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry brings attention] to a few specific aspects of the current IPR regime. Exclusive economic rights of a copyright owner are provided by the Copyright Act 1957. For generative AI to make use of copyrighted material under this act, the use must be covered under fair dealing exceptions in Section 52 of the Copyright Act 1957. Additionally, India’s personal data regulatory framework may be a relevant consideration for TDM.

==== The Copyright Act 1957 ====
 [https://www.copyright.gov.in/Documents/Copyrightrules1957.pdf The Copyright Act 1957] is India’s main regulatory instrument regarding intellectual property and copyright. Section 13 of the Copyright Act 1957 highlights which works are provided copyright protections, which include (1) original literary, dramatic, musical and artistic works, (2) cinematographic films, and (3) sound recordings. Section 14 expounds on actions that are prohibited to take against copyrighted works. Most relevant is the mention of the prohibitions of “the storing of [the copyrighted work] in any medium by electronic or other means” (emphasis added). This is applicable for the cases of a literary, dramatic, or musical work, a computer programme, an artistic work, and cinematographic films, covering all types of works mentioned in the Copyright Act 1957.
===== Infringement of Copyright and Fair Dealing Exceptions =====
 Chapter XI Copyright Act 1957 addresses infringements of copyright. Section 51 outlines when copyright will be deemed infringed, which includes when anything is done which is the exclusive right of the copyright holder (Section 51(a)(i)), and other distributions of the copyrighted work, including when it is “to such an extent to affect prejudicially the owner of the copyright” (Section 51(b)(ii)).

 Section 52 outlines when certain acts are not considered an infringement of copyright, commonly known as fair dealing exceptions. Section 52(a)  excludes from infringement “a fair dealing with any work, not being a computer programme,” for the purposes of either “(i) private or personal use; including research; (ii) criticism or review [...]; [and] (iii) the reporting of current events and current affairs.” An accompanying explanation states that the storing of any copyrighted work in an electronic medium for the aforementioned purposes shall not constitute an infringement. Section 52(aa) (sic) excludes from infringements the certain actions towards copyrighted computer programmes, such as when a lawful possessor of a copy makes copies of the programme for certain purposes (Section aa(i)-(ii) (ab), (ac), (ad), …). Section 52 is expansive and outlines numerous other exceptions.

===== Application of the CRA 1957 to TDM =====
Generally, the Copyright Act 1957 is vague. The fair dealing exceptions in Section 52 are strict and lack any specific reference to TDM or more generally to the use of copyrighted information to develop a product as such. The Copyright Act 1957 does reference electronic storage and recent technological changes such as, for example, listing the circumvention of “an effective technological measure applied for the purpose of protecting any of the rights conferred by this Act” (Section 65A) as an offence. However, such mentions are limited and still revolve around the (illegal) act of creating a copy of a copyrighted work. Much of the Copyright Act 1957 is focused on the illegal replication of works.
The Copyright Act’s particular focus has resulted in scholarly opinion that the Act would actually not prohibit TDM despite a lack of explicit fair dealing exception. Dr. Arul George Scaria, Co-Director of the [https://ciipc.org/ Centre for Innovation, Intellectual Property, and Competition (CIIPC) at National Law University in Delhi], has argued for the legality of TDM under Indian copyright law. He [https://spicyip.com/2019/08/should-indian-copyright-law-prevent-text-and-data-mining.html argues that Indian copyright law] only protects the expression of ideas, not facts or ideas themselves. So, when a researcher, for example, uses a copyrighted article in the course of TDM, this should be considered a non-expressive use of the work outside of copyright protection. He goes so far as to argue that it is thus “morally and legally impermissible to allow publishers to use End User Licence Agreements or other contractual tools to restrict researchers from using articles for TDM.” 
Additionally, Dr. Scaria emphasises that India’s copyright regime privileges not only the rights of the creators or copyright holders, but also the users of such works. He references the[https://indiankanoon.org/doc/135895592/ Delhi University Photocopy Shop (Single Bench)] decision, wherein Justice Endlaw states that the rights of persons in Section 52, the fair dealing exception, should not be interpreted narrowly or strictly. The rights given to users should be interpreted on par with those given to creators. Lastly, Dr. Scaria argues that India’s fair dealing regime can provide the flexibility to apply to newer technological developments such as TDM. Whilst Dr. Scaria makes a compelling argument, part of that compelling argument derives from his discussion of TDM as done by researchers, rather than addressing, for example, the use of TDM to train AI for ultimately commercial purposes.
Another case did address TDM for another use, by the state. Whilst this does not explicitly address the use of TDM to train AI, it still provides perspective on how TDM might be understood in the context of India’s regulatory framework. The Supreme Court of India, in the case of [https://indiankanoon.org/doc/127517806/ Justice K.S. Puttaswamy (Retired) vs Union of India and Ors.], recognised TDM’s importance for the state. The Court held that “[TDM] with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the state to insist on the collection of authentic data.” However, this case addressed TDM primarily from a privacy law perspective, rather than copyright; consequently, there still is no litigation that addresses the TDM in a copyright context. This raises further concerns considering the lack of explicit inclusion of a TDM fair dealing exception in Section 52 of the Copyright Act 1957.
As a result, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html likely means of justifying TDM is through Section 52(1)(a) ]which allows for private and personal use of copyrighted works, including for research. This provision is nuanced, wherein the making of copyrighted works publicly available to facilitate private and personal use such as by public libraries could be justified. However, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html Calcutta High Court in 2013] stated that “commercial exploitation” does not fall under “private or personal use,” a position reaffirmed by the Bombay High Court in 2018. Thus, it seems that the main way in which TDM could be justified under India’s copyright regulation is through arguing that TDM does not infringe on the expression of the idea or data, and thus copyright does not apply, as argued by Dr. Scaria.
==== Database protection ====
 A newer form of intellectual property rights relates to database protection, which may be relevant when it comes to TDM. India does not have an explicit database right in its intellectual property right regime, but it has recently been subsumed into its copyright regulatory framework. [https://link.springer.com/chapter/10.1007/978-981-10-3984-3_10 The Delhi High Court in Himalaya Drug Company v Sumit] ruled that compilations of databases could be considered literary works and consequently covered by the Copyright Act 1957. This would mean use of compilations of databases in TDM contexts would have to fall under fair dealing exceptions in Section 52 of the Copyright Act 1957. 
==== Personal data mining ====
 Another problematic aspect of data mining is the use of [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf personal data]. The source of data used for data mining can be essential, and if the data obtained is not public knowledge or obtained consensually, Indian personal protection legislation might apply. Companies and organizations that do not obtain personal data with permission or [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf discriminate] against individuals based on age, sex, gender, race, or religion are not going to be compliant with local or transnational laws. Specifically in India, data mining in such circumstances is regulated by the [https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf Information Technology Act], 2000 (IT Act) (e.g Article 43A which outlines rules on unauthorized access, sensitive personal data, and information, as well as compensation for failure to protect data), and the [https://www.google.com/url?q=https://www.meity.gov.in/writereaddata/files/Digital%2520Personal%2520Data%2520Protection%2520Act%25202023.pdf&sa=D&source=docs&ust=1732737698777765&usg=AOvVaw0wY-MZ1iAH8P634ZfD2-Vf Personal Data Protection Bill, 2019 (PDP Bill)]. However, some scholars discuss that the production of Privacy Preserving Data Mining Techniques[https://www.researchgate.net/profile/Ahmad-Ahmad-79/publication/375343129_Psychological_Burden_of_Caregivers_of_Children_with_Cancer_at_AL-Amal_Hospital_in_Baghdad_City/links/65476ca9b86a1d521bb8fe8a/Psychological-Burden-of-Caregivers-of-Children-with-Cancer-at-AL-Amal-Hospital-in-Baghdad-City.pdf#page=410 could circumvent] regulation from data protection regulation. This approach is somewhat reflected in the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence], wherein the Indian government recommends investing in privacy-preserving AI research methods to reduce the “risks of data exploitation and personal identification (from an anonymisation dataset).”

=== United States ===
==== Text and data mining in the US ====
'''Introduction TDM'''Text- and data mining is a process used to develop AI models. Data is fed into a model and algorithms are applied to the data. The term TDM is not defined in US Law, but rather as "machine and human- based inputs” under Title 15 Commerce and Trade. Another reference can be found under Machine Learning, which mentions "the ability to automatically learn and improve on the basis of data or experience. 
'''US definition AI'''The legal definition of AI originates from the National Artificial Intelligence Initiative Act of 2020, which regulates public bodies' use of AI:
"a machine based system that can, for a given set of human-defined objectives, make predictions,  recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems  use machine- and human-based inputs to perceive real and virtual environments; abstract such  perceptions into models through analysis in an automated manner; and use model inference to  formulate options for information or action.”,
The legal question is: do any restrictions apply to the use of input such as publicly available text or data in digital form for the purpose of training AI models?
To the extent that the input may be protected by copyright, the Copyright Act of 1976 is applicable.
To the extent that the input may be pertaining to data created by human behavior, other acts or constitutional rights may apply.
To the extent that the use of the data may be unfair or harmful to competition or consumer rights, FTC regulations may apply.

==== U.S. Constitution ====
Patent and Copyright Clause
(a.k.a. Patent Clause, the Copyright Clause, and the Progress Clause)
The Congress shall have Power ...to promote the Progress of Science and useful Arts, by securing for limited Tımes to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

==== Federal Law ====
===== The Copyright Act of 1976 =====
The United States copyright law is contained in the United States Code, chapters 1 through 8 and 10 through 12 of Title 17. The Copyright Act of 1976, which provides the basic framework for the current copyright law.
The authority has been granted to the US Copyright Office since 1870. 
To the extent that “human-based input’ and data can be a product of human work, it may be protected under the constitutional clause which grants an exclusive right to the Author or Inventor.
Copyright protection is granted to original works of authorship that are fixed in a tangible medium of expression . The author of the work generally holds copyright ownership generally, a right which she may transfer or license their rights to others. 
Essential to the copyright protection in the US is the fair use doctrine, which allows for several exemptions for which limited use of copyrighted material is allowed without the author’s permission. 
Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work.
The legal discussion regarding TDM in the US is evolving essentially around the application of the exceptions under the legal doctrine of fair use.
Following the Executive Order  Executive Order 13859 announcing the American Artificial Intelligence Initiative, the United States Patent and Trademark Office (USPTO) released a report titled “Public Views on Artificial Intelligence and Intellectual Property Policy.” The report consults a wide variety of stakeholder views on the impact of artificial intelligence (AI) across the intellectual property (IP) landscape, including patent, trademark, copyright, and trade secret policy, as well as developing issues about database protection. 
In this report, the USPTO stated:‘ “The ingestion of copyrighted works for purposes of machine learning will almost by definition involve the reproduction of entire works or substantial portions thereof. Accordingly, whether this constitutes copyright infringement will generally be determined by considering the applicability of the fair use doctrine, an exception set forth in section 107 of the Copyright Act, 17 U.S.C. § 107. Fair use is applied on a case-by-case basis, requiring courts to weigh several statutory factors, and is highly fact-dependent.’  § 102).’
The report included the results of a poll among a broad array of public and private stakeholders. The report  showed that the existing legal framework lacks instruments to tackle the challenges of AI. While the majority found the existing U.S. intellectual property laws calibrated correctly to address the evolution of AI (copyright, trademarks, trade secrets, and data fields), some suggested a need for new classes of IP rights. Overall, many agreed that existing commercial law principles (e.g., contract law) might adequately fill any gaps left by IP law in the wake of advances in AI .

===== COPIED ACT bill proposal =====
July 11th 2024 the bipartisan bill was introduced in Congress.
Content Origin Protection and Integrity from Edited and Deepfaked Media Act of 2024
The bill proposal addresses the new IP issues with respect to content by requiring transparency and content provenance information in an aim to protect artistic content.
The intention to establish NIST standards for provenance information seems to open the possibility for remuneration for rights-holders. This would be aligned with the intent of the constitutional right in the Patent and Copyright Clause.

==== Recent US Court cases regarding TDM ====
NEW YORK TIMES v. OPEN AI INC (2023)
The New York Times claimed that OpenAI and Microsoft, as creators of highly profitable generative AI models, did not give credit or remuneration to the New York Times despite relying on their works. The New York Times further alleges that this conduct not only infringes on their intellectual property rights but could also threaten their business model of providing news coverage, analysis and commentary on current events.
AUTHORS GUILD v. OPEN AI INC (2024)
17 authors argue that OpenAI should have first obtained their permission to use their copyrighted works and now seek a permanent injunction against OpenAI to prevent these alleged harms from reoccurring. The Authors Guild is also seeking damages for the lost opportunity to licence their works and asserts that OpenAI and Microsoft forced them into a position where they unknowingly aided their own market replacement. 

==== Policy ====
Two executive orders have been released pertaining to the use of AI by public bodies.
Executive Order 14110 of October 30, 2023 Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence mentions data as understood in 1.1.
Regarding availability of data for training the Executive Order states:
(b) …This effort requires investments in AI-related education, training, development, research, and capacity, while simultaneously tackling novel intellectual property (IP) questions and other problems to protect inventors and creators.
(e) … The Federal Government will enforce existing consumer  protection laws and principles and enact appropriate safeguards against fraud, unintended bias,  discrimination, infringements on privacy, and other harms from AI. Such protections are especially important in critical fields like healthcare, financial services, education,  housing, law, and transportation, where mistakes by or misuse of AI could harm patients, cost  consumers or small businesses, or jeopardize safety or rights. At the same time, my Administration will  promote responsible uses of AI that protect consumers, raise the quality of goods and services, lower  their prices, or expand selection and availability.
(f) Americans’ privacy and civil liberties must be protected as AI continues advancing. Artificial Intelligence is making it easier to extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires. Artificial Intelligence’s capabilities in these areas can increase the risk that personal data could be exploited and exposed. To combat this risk, the Federal Government will ensure that the collection, use, and retention of data is lawful, is secure, and mitigates privacy and confidentiality risks. Agencies shall use available policy and technical tools, including privacy-enhancing technologies (PETs) where appropriate, to protect privacy and to combat the broader legal and societal risks—including the chilling of First Amendment rights—that result from the improper collection and use of people’s data. 
The Executive Order stipulates the need for  “tackling novel intellectual property (IP) question”, “enforce protection laws and principles”and “enact safeguards against harms from AI” as “AI is making it easier to extract …on sensitive information about people’s identities, locations, habits and desires.” The Executive order acknowledges the need for new policies to not only protects copyrights-holders in the context of AI, but also citizens as their behavioral data are being used to train AI-models.

==== Enforcement ====
As stated in section 1.1., human-based data may be a broad term, the use of which may violate several laws and regulations.. A certain responsibility  to protect competition in the interest of consumers lies with the FTC. In the case of AI, it may be difficult to assess whether infringement of violations take place.
A special enforcement resolution  was issued by the FTC in November 2023,  “ directing use of compulsory process in a non-public investigation of products and services that use or are produced using artificial intelligence or that purport to detect the use of artificial intelligence”. The specific action enables the FTC to start investigations of possible use of AI in violation with Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 to detect unfair, deceptive, anticompetitive,  collusive, coercive, predatory, exploitative, or exclusionary acts or practices in or affecting commerce relating to products and services that use or are produced using artificial intelligence, including but not limited to, machine-based systems that can, for a given set of defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments, or that purport to use or detect the use of artificial intelligence.
The proposed bill COPIED act may be instrumental in enabling the AI market to become more transparent, for rights-holders to receive remuneration based on standardized provenance mechanisms.

=== South Africa ===

Module 5: Artificial Intelligence

2025-11-26T19:47:35Z

NadineWalsh: /* European Union */

== Text and data mining ==
According to [https://eur-lex.europa.eu/eli/dir/2019/790/oj Directive (EU) 2019/790], "‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations". The Directive further provides a framework for the use of such techniques.
=== European Union ===
'''The Relationship between the CDSM Directive and AI Act'''When considering the compatibility between the CDSM Directive and the AI Act, Regulation [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (EU) 2024/1689, Art. 53.1] provides a broad reference to the CDSM Directive: Providers of general-purpose AI models are required “to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790”. Additional obligations (Art.53.1(d)) outline the requirement to “draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model”. It is the responsibility of the AI Office to provide a template to ensure that providers follow the guidance and are exhaustive in the information made available.
 
Where the [https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act refers to TDM is in Rec. 104 and 105], which is in reliance of the CDSM Directive. Here it is stated that general-purpose AI models remain, despite a number of  exceptions from obligations and requirements, obliged to produce a summary about the content used for model training. A reference to the withholding of rights over works by the rightsholder, only in cases not related to scientific research is outlined in the AIA’s recitals and cautions providers of general-purpose AI models to obtain authorisation from rightsholders if such works were to be included in TDM.
 
'''Questions of Scope and Enforceability'''The concern is that the current provisions seem less stringent or tight in light of the fact that in order to train and develop large language models, such as Chat GPT, the input is required to come from a large variety of sources. Sources, such as books, essays, website, and even chatbot messages and social media posts may contain copyrighted materials. Under what conditions the use of these materials is considered legal, is one of the current dilemmas in the training of large language models, which form the basis of general AI use. Although it is the responsibility of the development company to ensure that copyright violations do not take place in the training and development of general-purpose AI models, Lucchi emphasises that this is a[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf field of the law, which is “multifaceted and dynamic” and which “necessitates meticulous examinations on a per-case basis”] - i.e. when are ‘fair-use’ or ‘legal exceptions’ relevant.
 
A recent [https://www.europarl.europa.eu/thinktank/en/document/IUST_STU(2025)774095 study report on generative AI and copyright], which was requested by the JURI Committee, addresses inconsistent implementation of how rights are to be reserved in a machine-readable way. This is creating difficulties for developers with regards to the aspect and ways of how the data they use is lawful. From the perspective of training and developing AI models, input and output are extrinsically interlinked and the line between both is “extremely permeable”. The growing concern, which is gaining popular airtime currently, is the fact that existing frameworks may not be sufficient to address the inherent complexities of generative AI systems, as these have or are developing the capabilities to “[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf directly compete or even dwarf original works]”.
''''''

'''Challenges & Case Law'''In an [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ open letter], published on 30th July by the European Writers’ Council, a coalition of rightsholders emphasised that the “the damage to and unfair competition with the cultural and creative sectors can be seen each day”. [https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ The coalition] requested stronger safeguards for the cultural and creative sectors. By rejecting the view that the Code of Practise provides a fair and workable balance on the use of training material access for and by GenAI models, it issued a plea to the European Parliament and member states to challenge the[https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ “unsatisfactory process of the exercise”] as this practise is seen to further weaken the situation of the creative and cultural sectors across Europe.
The first case [https://curia.europa.eu/juris/showPdf.jsf?docid=300681&doclang=EN (C-250/25)]of this kind, was lodged with the Court of Justice of the European Union (CJEU) in April 2025. The applicant, Like Company, a Hungarian publishing and news organisation, is alleging that Google Ireland Limited has accessed news reports and press releases. Like Company’s revenue is derived from advertising provided on its news portals, where news content of a journalistic nature is published. 
 
The referring Hungarian court is requesting a ruling whether the accessing and training Google’s AI Chatbot Gemini has infringed the applicant’s rights under EU legislation. When asked directly, “the chatbot operated by the defendant is capable of providing a response that displays the content of a protected press publication”. “The applicant asked the referring court to find that the defendant had infringed the applicant’s rights under the relevant national and EU legislation, by reproducing through electronic means the applicant’s press publications, in order to make them available to the public.

=== Brazil ===

==== Introduction ====

Brazil is currently in the process of implementing a national strategy on AI, a process which Brazil began in 2020. The strategy is holistic and considers many different aspects where Brazil is working on legislation, regulation, and AI governance with an eye to ethical use of AI and alignment with international approaches to AI. Brazil’s AI policy also puts a focus on education, workforce & training, research, development and innovation, how AI can be applied in “productive sectors” of the economy and in public bodies, and public security. The overall policy is founded on a goal of stimulating research, innovation and development of AI solutions while maintaining conscious and ethical use of AI. This national strategy is captured in policy documents, including the Brazilian Artificial Intelligence Strategy ([https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/arquivosinteligenciaartificial/ebia-summary_brazilian_4-979_2021.pdf EBIA]), as well as the National Strategy for Intellectual Property ([https://www.gov.br/inpi/pt-br/central-de-conteudo/noticias/cerimonia-marca-50-anos-do-inpi-e-lancamento-da-estrategia-nacional-de-propriedade-intelectual/EstratgiaNacionaldePropriedadeIntelectual.pdf ENPI]) and the National Policy of Innovation.

Pursuant to the Brazilian Artificial Intelligence Strategy, Brazil is working on specific legislation for AI. An initial draft AI Act was introduced in Brazil’s lower legislative chamber (the Chamber of Deputies) in 2020 (PL 21/2020), and was subsequently sent to the upper chamber (the Senate). The Senate convened a committee of experts to hold public hearings and collect public comments, the Comissão de Juristas responsável por subsidiar elaboração de substitutivo sobre inteligência artificial no Brasil ([https://legis.senado.leg.br/atividade/comissoes/comissao/2504/ source]). Other relevant draft laws were also pending in the Senate, so the Senate issued an order to combine, restructure and improve the text of these proposed laws pending input from the Committee. The Committee held meetings in 2022 and issued a final report in December 2022 with proposed changes to text. According to a press release from August 2024, the Senate is still reviewing draft AI legislation. A new draft text incorporating the recommended language from the committee of experts has been assigned bill number PL 2338/23, and it is this bill that appears to be moving forward in the Senate. The Chamber of Deputies’ original draft text PL 21/2020 has not moved forward; several other draft laws that relate to AI are also pending in the Senate. The Senate now has another commission debating the draft AI Act, which is continuing to meet regularly ([https://legis.senado.leg.br/atividade/comissoes/comissao/2629/ source]). Thus, it appears Brazil is getting closer to finalizing the draft legislation.

==== Text and Data Mining in Brazil ====

With the AI legislation in Brazil not yet finalized, from a copyright perspective, Brazil law currently does not authorize text and data mining (TDM) without permission of the copyright holder. Although Brazil’s copyright act, Law No. 9.610 of February 19, 1998 (Law on Copyright and Neighboring Rights), does include some exceptions to the exclusive rights of a copyright holder, none of these exceptions (in Articles 46, 47, and 48 of ) address text and data mining. [source: https://www.wipo.int/wipolex/en/legislation/details/514]. Thus, the work that Brazil’s Senate is doing on the draft AI will be important to regulate text and data mining activities when the law is finalized and approved.

The most recent and active draft AI Act in Brazil, PL 2338/23, includes the following definition of text and data mining:

\Art. 4. For the purposes of this Law, the following definitions are adopted:

[…] VIII – text and data mining: process of extracting and analyzing large amounts of data or partial or full excerpts of textual content, from which patterns and correlations are extracted that will generate relevant information for the development or use of artificial intelligence systems.

The draft law would regulate text and data mining as follows:

Art. 42. The automated use of works, such as extraction, reproduction, storage and transformation, in data and text mining processes in artificial intelligence systems, in activities carried out by research organizations and institutions, journalism and museums, archives and libraries, does not constitute an offense to copyright, provided that:
I – it does not have as its objective the simple reproduction, exhibition or dissemination of the original work itself;
II – the use occurs to the extent necessary for the objective to be achieved;
III – it does not unjustifiably harm the economic interests of the owners; and
IV – it does not compete with the normal exploitation of the works.

§ 1. Any reproductions of works for data mining activities will be kept under strict security conditions, and only for the time necessary to carry out the activity or for the specific purpose of verifying the results of scientific research.

§ 2. The provisions of the caput shall apply to the activity of data and text mining for other analytical activities in artificial intelligence systems, provided that the conditions of the items of the caput and § 1 are met, provided that the activities do not communicate the work to the public and that access to the works has been legitimate.
§ 3. The activity of text and data mining involving personal data shall be subject to the provisions of Law No. 13,709, of August 14, 2018 (General Personal Data Protection Law) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]).

As noted above, this is only a draft legislation, and this could change as the draft bill is debated further in Brazil’s congress.

The draft TDM definition and exception are notable in being fairly aligned with other jurisdictions such as the European Union. Brazil’s draft definition of TDM goes so far as to stipulate that “large amounts of data or partial or full excerpts of textual content” will be permitted to be mined, which suggests even in this definition the intent to provide an exception from the existing copyright regime. The definition also limits this use to the purpose of “development or use of artificial intelligence systems.” Arguably, this language ensures that the exception will be limited to the AI field. The inclusion of TDM when AI systems are in “use” is an interesting addition, since it suggests that TDM might be permissible not only for the training stage, but also when AI is deployed.

Like other jurisdictions such as the EU, Brazil’s draft TDM exception at Article 42 provides for use of works by research organizations and cultural institutions, namely, museums, archives, and libraries. However, it also notably allows an exception for journalism, along with the scientific and cultural uses. It is also notable that draft Article 42 includes a requirement that any use of the TDM exception “does not unjustifiably harm the economic interests of the owners” or compete with or replace the original works. Like the EU, subsection (42)(1) requires security conditions and limits the time for keeping the works.

Draft section 42(2) appears to provide a broader TDM exception that is not limited to scientific research, journalism, or cultural institutions, with additional requirements that entities using 42(2) must also not communicate the work to the public and must have had legitimate access to the works in the first place. This would seem to suggest that scraping is not allowed under draft section 42(2), but possibly is allowed for scientific research, journalistic purposes, or cultural purposes. Notably, this draft broad TDM exception in 42(2) does not include any kind of mechanism for rights holders who do not wish their works to be used in TDM activities to opt-out.

Finally, draft subsection 42(3) states that Brazil’s general data privacy law does apply to TDM activities. Thus, if this proposed language becomes law, entities using the TDM exception will still have to consider data privacy.

=== China ===
We have not identified a definition of ‘text and data mining’ in Chinese legislation or policy, so we have relied on the definition from Directive (EU) 2019/790:
''‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations. ''
This definition exists with a European Union (EU) law regarding exceptions and limitations of copyright for text and data mining. Consequently, to consider the Chinese position regarding text and data mining, we turn first to frame the copyright regime in China. 

==== Copyright Law of the People’s Republic of China (CLC) ====
Copyright Law of the People’s Republic of China in an administrative regulation enacted in 1951 and last revised in 2021. The Copyright Law aims to protect the copyright of authors in their literacy, artistic and scientific works and the copyright-related rights and interests, of encouraging the creation and dissemination of works which could contribute to the construction of socialist spiritual and material civilization, and of promoting the development and prosperity of the socialist culture and science. 
It applies to:
*works of chinese citizens, legal entities or other organizations, whether published or not
*work of a foreign or stateless person which is eligible to enjoy copyright 
**under an agreement concluded between the country to which the foreign belongs and China 
**international agreement
*works of foreign or stateless persons first published in the territory of China

==== Fair Use Doctrine ====
China is a civil law country which adheres to early continental European traditions, following the concept of the European droit d’auteur system. The structure of China’s copyright exception model can be considered as a closed list rather than an open-ended one (e.g U.S).
Specifically, Article 22 of the Chinese Copyright Law, the so-called fair use clause, lists 13 situations in which the use of copyright material constitutes permitted fair use, but it is difficult to categorize the use of copyright materials for AI training within these scenarios. Nevertheless, the [http://lawinfochina.com/display.aspx?id=9280&lib=law Chinese Supreme People’s Court judicial policy document] offers some flexibility in applying the fair use doctrine under special circumstances. It states that: 
''‘Under special circumstances as necessary for promoting technological innovation and business development, a use of works may be determined as reasonable after consideration of the nature and purposes of use, the nature of works used, the quantity and quality of the part of works used, impacts of use on potential markets or values, and other factors, provided that such use neither contravenes the normal use of the works nor results in unreasonable damage to the lawful interests of the author.’ ''
Additionally, the [https://www.wipo.int/wipolex/en/legislation/details/13428 Regulations for the Implementation of the CLC] (RICL) provides an in-depth examination of Article 22 CLC. According to Article 21 RICL ‘the exploitation of a published work which may be exploited without permission from the copyright owner in accordance with the relevant provisions of the Copyright Law shall not impair the normal exploitation of the work concerned, nor unreasonably prejudice the legitimate interests of the copyright owner. Thus, this two-step test serves as a complement to the listed exceptions in Article 22 CLC: the extent of exempted uses should not violate the two step test of Article 21 RICL. 
With the law being last revised in 2021, text and data mining is not specifically referenced as an exception to copyright. Nevertheless, a few of the listed exceptions may concern text or data mining used for AI training.
'''Fair use exceptions'''
Article 22(1) CLC provides that ‘use of a published work for the purposes of the user’s own private study, research or self-entertainment’ can be exempted. However, this example will not offer much safeguards as most AI users are corporations and the research they carry out cannot be deemed as private. 
Article 22(6) CLC provides that ‘translation, adaptation, compilation, playing, or reproduction in a small quantity of copies, of a published work for use by teachers or scientific researchers, in classroom teaching or scientific research of schools, provided that the translation or reproduction shall not be published or distributed’ can be exempted and may cover text and data mining. Still, the term ‘schools’ excludes commercial educational institutions and the commercial activities conducted by non-commercial institutions. Moreover, even if research institutions such as public universities may be covered by this exception, it is also required that the reproduction of published work shall be kept in ‘small quantity’. Thus, it is not a welcomed limitation for text and data mining that may require huge amounts of copyright data. 
Finally,  it could be a reasonably arguable position that Article 22, paragraph 7 may empower the State to engage in text and data mining, provided the State:
*mentions the name of the author and the title of the work; for example, in a list referencing all the works that were subject to the mining; and 
*the mining is by a State organ fulfilling official duties.  

{|
|-
| Article 22, paragraph 7, paraphrased: 
A work may be exploited without permission from, and without payment of remuneration to, the copyright owner, if the name of the author and the title of the work are mentioned and the other rights enjoyed by the copyright owner by virtue of this Law are not prejudiced, in the circumstance of a State organ using a published work, within proper scope, for the purpose of fulfilling its official duties.
|}

==== Amendments to the Law ====
===== Regulation for Generative Artificial Intelligence Services =====
On April 11th 2023, the Cyberspace Administration of China released a draft of the [https://www.china-briefing.com/news/how-to-interpret-chinas-first-effort-to-regulate-generative-ai-measures/ Regulation for Generative Artificial Intelligence Services], in force since August 2023. It includes 21 measures encompassing a wide array of subjects pertaining to the development and provision of Generative AI services. 
The regulation applies to ‘only applicable to services accessible to the general public within China’. It excludes from its scope AI services developed and utilized by enterprises, research and academics, research and academics institutions, and other public entities ([https://www.cac.gov.cn/2023-04/11/c_1682854275475410.htm Article 2]). Generative AI technologies are defined as models and related technologies that can generate contents in the form of texts, pictures, audios and videos (Article 22). 
<h5 class="mwt-heading" >Requirements for training data (article 7-8)</h5>
The Generative AI Measures require service provides to source data and foundation models from legitimate sources, respect the intellectual property rights of users, and process personal information with appropriate consent or legal basis under Chinese Laws. Providers must enhance the quality of training data, striving for ‘authenticity, accuracy, objectivity, and diversity’(article 7). Thus, the Regulation places significant emphasis on safeguarding personal data and information by imposing on providers the obligation to protect the input information of users and usage records during the service provision process. During the development phase, providers must establish ‘clear, specific and practical’ labeling rules for the training data. Conducting quality assessment of data labeling and sample verification to ensure accuracy of labeled content is also required (article 8). Additionally, illegal retention of input information that can be used to infer user identities, creation of user profiles based on input information usage, and disclosure of user input information to third parties are prohibited (Article 11). 

===== AI security governance framework =====
On 10 September 2024, the State Council of China [https://english.www.gov.cn/news/202409/10/content_WS66df9f30c6d0868f4e8eac91.html published] an AI security governance framework, to come into effect on 1 January 2025. The [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf Framework] was put together by China's National Technical Committee 260 on Cybersecurity and seeks to promote responsible AI innovation. Although this framework is not a piece of legislation, compliance is [https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ suggested] to be mandatory. 
[https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ Onetrust] identifies key areas of the framework as: 
*Risk management and transparency 
*Ethical responsibilities
*Accountability mechanisms
*Cross-border data, security, and privacy considerations

 Relevant for consideration of copyright and text and data mining exceptions are: 
*requirements for data integrity, 
*recordkeeping obligations for data sources, 
*systems that comply with China’s Data Security Law and Personal Information Protection Law 

 The Safety Guidelines of the Framework are significant and wide reaching. The relevant guidelines for training AI models apply to developers. Developers of AI models [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf should] (see 6.1): 
<div>

{| style="height: 130px;"
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*uphold a people-centered approach 
| style="height: 51px; width: 454px;" |
*strengthen data security and personal information protection
|- style="height: 28px;"
| style="height: 28px; width: 512px;" |
*adhere to the principle of AI for good
| style="height: 28px; width: 454px;" |
*respect intellectual property and copyright
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*follow science and technology ethics in key stages such as requirement analysis, project initiation, model design and development, and training data selection and use
| style="height: 51px; width: 454px;" |
*ensure that data sources are clear and acquisition methods are compliant
|}
</div>
This framework also has a national security flavour, and seeks to ensure AI develops without bias or discriminatory results.  

==== Hong Kong Amendment of Copyright Ordinance ====
[https://techinsights.linklaters.com/post/102jf9o/hong-kong-proposes-new-copyright-exception-for-text-and-data-mining-to-facilitate The Hong Kong government] recently launched a two-month public [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf consultation] aimed at enhancing the Copyright Ordinance to address the challenges brought by AI technology. To maintain a balance of interests between copyright owners and users, the Copyright Ordinance contains a number of copyright exceptions that permit reasonable use of copyright works under specific circumstances. However, each exception is confined to certain situations and purposes and subject to their respective conditions and there is no specific copyright exception for text and data mining. 
The consultation focuses on four areas: 
*copyright protection of AI generated work
*copyright infringement liability for AI generated works 
*introduction to specific copyright exception for text and data mining activities 
*other issues e.g deepfakes The proposal defines [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf text and data mining] as ‘automated techniques to extract and conduct computational analysis of extensive collection of text, images, data and other types of information for generating valuable insights, patterns, trends and correlations that would likely be unattainable through manual efforts alone’.

==== Case law  ====
===== Beijing Internet Court grants Copyright to AI-Generated Image =====
The [https://globallitigationnews.bakermckenzie.com/2024/05/08/china-a-landmark-court-ruling-on-copyright-protection-for-ai-generated-works/ first case] to address whether AI-generated work
:a) are protectable by copyright and
:b) who owns the copyright
was decided before the Beijing Internet Court in November 2023.'''Facts'''
The plaintiff, Mr. Li, used Stable Diffusion (an artificial intelligence) to generate the image involved in the case and published it on the Xiaohongshu (Little Red Book) platform; the defendant, a blogger on Baijiahao, used the image generated by the plaintiff’s AI to accompany the article, and the plaintiff sued. 
'''Judgement'''
First, the Court considered the meaning of ‘works’ under the Copyright Law of China, which provides that works must be original and reflect intellectual achievement. In terms of intellectual achievement, the Court noted that the plaintiff did not merely use existing pictures returned by search engines or rearranged pre-designed elements when creating the picture. Instead, the plaintiff designed how the woman should look in the picture and entered the relevant prompts. The plaintiff then inputted detailed prompts such as ‘japan idol’, ‘cool pose’, ‘viewing at camera’ and ‘film grain’, and then further adjusted the prompts based on the preliminary images generated by Stable Diffusion. According to the court, these actions demonstrates the plaintiff's intellectual input. 
Regarding the concept of originality, the court notes that this means that the work should be independently completed by the author and that should reflect the author’s subjective expression. In the context of AI-generated images, originality should be assessed on a case-by-case basis. In this case, the plaintiff designed the different elements of the image by inputting and fine-tuning the prompts and adjusting the parameters, which ultimately demonstrates the plaintiff's original judgment. Thus, the Court held that the picture is protected by copyright as an original work. It recognized the picture as a ‘work of fine arts’ under Article 3 CLC. 
Secondly, on the matter of copyright ownership, [https://english.bjinternetcourt.gov.cn/2023-12/28/c_688.htm the Court held] that Copyright Law provides that copyright shall be owned by the author of the work and an AI model cannot be an author because it is not a natural or legal person. Moreover, the designer of Stable Diffusion only created the AI model, it was not involved in the intellectual input leading to the creation of the picture and the licensing agreements states that the designer of Stable Diffusion does not claim rights in any output content. 

===== Pending Case to address whether AI Training constitute Copyright Infringement =====
In China, the [https://www.managingip.com/article/2dnu9r92bmzrcdrw84ykg/sponsored-content/training-ai-models-and-copyright-challenges-chinese-and-eu-insights first case] to address whether AI training constitutes copyright infringement is pending before the Beijing Internet Court.
The case was brought by four Chinese illustrators against the developers of Trik AI, a generative AI painting app released by the famous Chinese lifestyle platform Xiaohongshu, with a particular strength in generating traditional Chinese-style paintings. The illustrators claimed, among others, that Xiaohongshu’s use of their work to train its AI model constituted an infringement of their reproduction rights. Xiaohongshu, on the other hand, contends that using the plaintiffs’ works for AI training should be considered "fair use" under Article 24 of the Chinese Copyright Law. A judgment in this case has not yet been issued.
From a technical perspective, establishing copyright infringement in China depends on whether the AI model has made a ‘temporary’ or ‘permanent’ reproduction of a copyrighted work during the training process. Under the Chinese Copyright Law, the general rule is that it is only when a permanent copy is made that copyright infringement occurs.

=== India ===
[https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry] has stated that India’s existing regime of intellectual property rights (IPR) and copyright is sufficient to protect both rights holders of AI-generated works, and rights holders of content that may be used by Generative AI (e.g., training data). Consequently, the Ministry states there is no reason nor need to develop an additional regime specifically regulating AI and related innovations. As a result, there is no specific regulation to discuss relating to training data and scraping, also known as text and data mining (TDM), for AI training purposes. This paper thus focuses on aspects of the current regulatory regime that are relevant to the question of AI training data, and discusses potential limitations and criticisms of the reliance on the current regime. 

 Important to note is that India also lacks regulation regarding AI generally, not just lacking regulation regarding TDM either generally or for the purposes of AI training. Despite this, the government has addressed the growing challenge of AI through publishing the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence] which highlights numerous legal and societal challenges arising from AI. This Strategy does not explicitly mention copyright or legal issues arising from TDM, but highlights privacy problems that may be relevant for TDM for training as part of the AI lifecycle.
 [https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry brings attention] to a few specific aspects of the current IPR regime. Exclusive economic rights of a copyright owner are provided by the Copyright Act 1957. For generative AI to make use of copyrighted material under this act, the use must be covered under fair dealing exceptions in Section 52 of the Copyright Act 1957. Additionally, India’s personal data regulatory framework may be a relevant consideration for TDM.

==== The Copyright Act 1957 ====
 [https://www.copyright.gov.in/Documents/Copyrightrules1957.pdf The Copyright Act 1957] is India’s main regulatory instrument regarding intellectual property and copyright. Section 13 of the Copyright Act 1957 highlights which works are provided copyright protections, which include (1) original literary, dramatic, musical and artistic works, (2) cinematographic films, and (3) sound recordings. Section 14 expounds on actions that are prohibited to take against copyrighted works. Most relevant is the mention of the prohibitions of “the storing of [the copyrighted work] in any medium by electronic or other means” (emphasis added). This is applicable for the cases of a literary, dramatic, or musical work, a computer programme, an artistic work, and cinematographic films, covering all types of works mentioned in the Copyright Act 1957.
===== Infringement of Copyright and Fair Dealing Exceptions =====
 Chapter XI Copyright Act 1957 addresses infringements of copyright. Section 51 outlines when copyright will be deemed infringed, which includes when anything is done which is the exclusive right of the copyright holder (Section 51(a)(i)), and other distributions of the copyrighted work, including when it is “to such an extent to affect prejudicially the owner of the copyright” (Section 51(b)(ii)).

 Section 52 outlines when certain acts are not considered an infringement of copyright, commonly known as fair dealing exceptions. Section 52(a)  excludes from infringement “a fair dealing with any work, not being a computer programme,” for the purposes of either “(i) private or personal use; including research; (ii) criticism or review [...]; [and] (iii) the reporting of current events and current affairs.” An accompanying explanation states that the storing of any copyrighted work in an electronic medium for the aforementioned purposes shall not constitute an infringement. Section 52(aa) (sic) excludes from infringements the certain actions towards copyrighted computer programmes, such as when a lawful possessor of a copy makes copies of the programme for certain purposes (Section aa(i)-(ii) (ab), (ac), (ad), …). Section 52 is expansive and outlines numerous other exceptions.

===== Application of the CRA 1957 to TDM =====
Generally, the Copyright Act 1957 is vague. The fair dealing exceptions in Section 52 are strict and lack any specific reference to TDM or more generally to the use of copyrighted information to develop a product as such. The Copyright Act 1957 does reference electronic storage and recent technological changes such as, for example, listing the circumvention of “an effective technological measure applied for the purpose of protecting any of the rights conferred by this Act” (Section 65A) as an offence. However, such mentions are limited and still revolve around the (illegal) act of creating a copy of a copyrighted work. Much of the Copyright Act 1957 is focused on the illegal replication of works.
The Copyright Act’s particular focus has resulted in scholarly opinion that the Act would actually not prohibit TDM despite a lack of explicit fair dealing exception. Dr. Arul George Scaria, Co-Director of the [https://ciipc.org/ Centre for Innovation, Intellectual Property, and Competition (CIIPC) at National Law University in Delhi], has argued for the legality of TDM under Indian copyright law. He [https://spicyip.com/2019/08/should-indian-copyright-law-prevent-text-and-data-mining.html argues that Indian copyright law] only protects the expression of ideas, not facts or ideas themselves. So, when a researcher, for example, uses a copyrighted article in the course of TDM, this should be considered a non-expressive use of the work outside of copyright protection. He goes so far as to argue that it is thus “morally and legally impermissible to allow publishers to use End User Licence Agreements or other contractual tools to restrict researchers from using articles for TDM.” 
Additionally, Dr. Scaria emphasises that India’s copyright regime privileges not only the rights of the creators or copyright holders, but also the users of such works. He references the[https://indiankanoon.org/doc/135895592/ Delhi University Photocopy Shop (Single Bench)] decision, wherein Justice Endlaw states that the rights of persons in Section 52, the fair dealing exception, should not be interpreted narrowly or strictly. The rights given to users should be interpreted on par with those given to creators. Lastly, Dr. Scaria argues that India’s fair dealing regime can provide the flexibility to apply to newer technological developments such as TDM. Whilst Dr. Scaria makes a compelling argument, part of that compelling argument derives from his discussion of TDM as done by researchers, rather than addressing, for example, the use of TDM to train AI for ultimately commercial purposes.
Another case did address TDM for another use, by the state. Whilst this does not explicitly address the use of TDM to train AI, it still provides perspective on how TDM might be understood in the context of India’s regulatory framework. The Supreme Court of India, in the case of [https://indiankanoon.org/doc/127517806/ Justice K.S. Puttaswamy (Retired) vs Union of India and Ors.], recognised TDM’s importance for the state. The Court held that “[TDM] with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the state to insist on the collection of authentic data.” However, this case addressed TDM primarily from a privacy law perspective, rather than copyright; consequently, there still is no litigation that addresses the TDM in a copyright context. This raises further concerns considering the lack of explicit inclusion of a TDM fair dealing exception in Section 52 of the Copyright Act 1957.
As a result, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html likely means of justifying TDM is through Section 52(1)(a) ]which allows for private and personal use of copyrighted works, including for research. This provision is nuanced, wherein the making of copyrighted works publicly available to facilitate private and personal use such as by public libraries could be justified. However, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html Calcutta High Court in 2013] stated that “commercial exploitation” does not fall under “private or personal use,” a position reaffirmed by the Bombay High Court in 2018. Thus, it seems that the main way in which TDM could be justified under India’s copyright regulation is through arguing that TDM does not infringe on the expression of the idea or data, and thus copyright does not apply, as argued by Dr. Scaria.
==== Database protection ====
 A newer form of intellectual property rights relates to database protection, which may be relevant when it comes to TDM. India does not have an explicit database right in its intellectual property right regime, but it has recently been subsumed into its copyright regulatory framework. [https://link.springer.com/chapter/10.1007/978-981-10-3984-3_10 The Delhi High Court in Himalaya Drug Company v Sumit] ruled that compilations of databases could be considered literary works and consequently covered by the Copyright Act 1957. This would mean use of compilations of databases in TDM contexts would have to fall under fair dealing exceptions in Section 52 of the Copyright Act 1957. 
==== Personal data mining ====
 Another problematic aspect of data mining is the use of [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf personal data]. The source of data used for data mining can be essential, and if the data obtained is not public knowledge or obtained consensually, Indian personal protection legislation might apply. Companies and organizations that do not obtain personal data with permission or [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf discriminate] against individuals based on age, sex, gender, race, or religion are not going to be compliant with local or transnational laws. Specifically in India, data mining in such circumstances is regulated by the [https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf Information Technology Act], 2000 (IT Act) (e.g Article 43A which outlines rules on unauthorized access, sensitive personal data, and information, as well as compensation for failure to protect data), and the [https://www.google.com/url?q=https://www.meity.gov.in/writereaddata/files/Digital%2520Personal%2520Data%2520Protection%2520Act%25202023.pdf&sa=D&source=docs&ust=1732737698777765&usg=AOvVaw0wY-MZ1iAH8P634ZfD2-Vf Personal Data Protection Bill, 2019 (PDP Bill)]. However, some scholars discuss that the production of Privacy Preserving Data Mining Techniques[https://www.researchgate.net/profile/Ahmad-Ahmad-79/publication/375343129_Psychological_Burden_of_Caregivers_of_Children_with_Cancer_at_AL-Amal_Hospital_in_Baghdad_City/links/65476ca9b86a1d521bb8fe8a/Psychological-Burden-of-Caregivers-of-Children-with-Cancer-at-AL-Amal-Hospital-in-Baghdad-City.pdf#page=410 could circumvent] regulation from data protection regulation. This approach is somewhat reflected in the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence], wherein the Indian government recommends investing in privacy-preserving AI research methods to reduce the “risks of data exploitation and personal identification (from an anonymisation dataset).”

=== United States ===
==== Text and data mining in the US ====
'''Introduction TDM'''Text- and data mining is a process used to develop AI models. Data is fed into a model and algorithms are applied to the data. The term TDM is not defined in US Law, but rather as "machine and human- based inputs” under Title 15 Commerce and Trade. Another reference can be found under Machine Learning, which mentions "the ability to automatically learn and improve on the basis of data or experience. 
'''US definition AI'''The legal definition of AI originates from the National Artificial Intelligence Initiative Act of 2020, which regulates public bodies' use of AI:
"a machine based system that can, for a given set of human-defined objectives, make predictions,  recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems  use machine- and human-based inputs to perceive real and virtual environments; abstract such  perceptions into models through analysis in an automated manner; and use model inference to  formulate options for information or action.”,
The legal question is: do any restrictions apply to the use of input such as publicly available text or data in digital form for the purpose of training AI models?
To the extent that the input may be protected by copyright, the Copyright Act of 1976 is applicable.
To the extent that the input may be pertaining to data created by human behavior, other acts or constitutional rights may apply.
To the extent that the use of the data may be unfair or harmful to competition or consumer rights, FTC regulations may apply.

==== U.S. Constitution ====
Patent and Copyright Clause
(a.k.a. Patent Clause, the Copyright Clause, and the Progress Clause)
The Congress shall have Power ...to promote the Progress of Science and useful Arts, by securing for limited Tımes to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

==== Federal Law ====
===== The Copyright Act of 1976 =====
The United States copyright law is contained in the United States Code, chapters 1 through 8 and 10 through 12 of Title 17. The Copyright Act of 1976, which provides the basic framework for the current copyright law.
The authority has been granted to the US Copyright Office since 1870. 
To the extent that “human-based input’ and data can be a product of human work, it may be protected under the constitutional clause which grants an exclusive right to the Author or Inventor.
Copyright protection is granted to original works of authorship that are fixed in a tangible medium of expression . The author of the work generally holds copyright ownership generally, a right which she may transfer or license their rights to others. 
Essential to the copyright protection in the US is the fair use doctrine, which allows for several exemptions for which limited use of copyrighted material is allowed without the author’s permission. 
Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work.
The legal discussion regarding TDM in the US is evolving essentially around the application of the exceptions under the legal doctrine of fair use.
Following the Executive Order  Executive Order 13859 announcing the American Artificial Intelligence Initiative, the United States Patent and Trademark Office (USPTO) released a report titled “Public Views on Artificial Intelligence and Intellectual Property Policy.” The report consults a wide variety of stakeholder views on the impact of artificial intelligence (AI) across the intellectual property (IP) landscape, including patent, trademark, copyright, and trade secret policy, as well as developing issues about database protection. 
In this report, the USPTO stated:‘ “The ingestion of copyrighted works for purposes of machine learning will almost by definition involve the reproduction of entire works or substantial portions thereof. Accordingly, whether this constitutes copyright infringement will generally be determined by considering the applicability of the fair use doctrine, an exception set forth in section 107 of the Copyright Act, 17 U.S.C. § 107. Fair use is applied on a case-by-case basis, requiring courts to weigh several statutory factors, and is highly fact-dependent.’  § 102).’
The report included the results of a poll among a broad array of public and private stakeholders. The report  showed that the existing legal framework lacks instruments to tackle the challenges of AI. While the majority found the existing U.S. intellectual property laws calibrated correctly to address the evolution of AI (copyright, trademarks, trade secrets, and data fields), some suggested a need for new classes of IP rights. Overall, many agreed that existing commercial law principles (e.g., contract law) might adequately fill any gaps left by IP law in the wake of advances in AI .

===== COPIED ACT bill proposal =====
July 11th 2024 the bipartisan bill was introduced in Congress.
Content Origin Protection and Integrity from Edited and Deepfaked Media Act of 2024
The bill proposal addresses the new IP issues with respect to content by requiring transparency and content provenance information in an aim to protect artistic content.
The intention to establish NIST standards for provenance information seems to open the possibility for remuneration for rights-holders. This would be aligned with the intent of the constitutional right in the Patent and Copyright Clause.

==== Recent US Court cases regarding TDM ====
NEW YORK TIMES v. OPEN AI INC (2023)
The New York Times claimed that OpenAI and Microsoft, as creators of highly profitable generative AI models, did not give credit or remuneration to the New York Times despite relying on their works. The New York Times further alleges that this conduct not only infringes on their intellectual property rights but could also threaten their business model of providing news coverage, analysis and commentary on current events.
AUTHORS GUILD v. OPEN AI INC (2024)
17 authors argue that OpenAI should have first obtained their permission to use their copyrighted works and now seek a permanent injunction against OpenAI to prevent these alleged harms from reoccurring. The Authors Guild is also seeking damages for the lost opportunity to licence their works and asserts that OpenAI and Microsoft forced them into a position where they unknowingly aided their own market replacement. 

==== Policy ====
Two executive orders have been released pertaining to the use of AI by public bodies.
Executive Order 14110 of October 30, 2023 Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence mentions data as understood in 1.1.
Regarding availability of data for training the Executive Order states:
(b) …This effort requires investments in AI-related education, training, development, research, and capacity, while simultaneously tackling novel intellectual property (IP) questions and other problems to protect inventors and creators.
(e) … The Federal Government will enforce existing consumer  protection laws and principles and enact appropriate safeguards against fraud, unintended bias,  discrimination, infringements on privacy, and other harms from AI. Such protections are especially important in critical fields like healthcare, financial services, education,  housing, law, and transportation, where mistakes by or misuse of AI could harm patients, cost  consumers or small businesses, or jeopardize safety or rights. At the same time, my Administration will  promote responsible uses of AI that protect consumers, raise the quality of goods and services, lower  their prices, or expand selection and availability.
(f) Americans’ privacy and civil liberties must be protected as AI continues advancing. Artificial Intelligence is making it easier to extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires. Artificial Intelligence’s capabilities in these areas can increase the risk that personal data could be exploited and exposed. To combat this risk, the Federal Government will ensure that the collection, use, and retention of data is lawful, is secure, and mitigates privacy and confidentiality risks. Agencies shall use available policy and technical tools, including privacy-enhancing technologies (PETs) where appropriate, to protect privacy and to combat the broader legal and societal risks—including the chilling of First Amendment rights—that result from the improper collection and use of people’s data. 
The Executive Order stipulates the need for  “tackling novel intellectual property (IP) question”, “enforce protection laws and principles”and “enact safeguards against harms from AI” as “AI is making it easier to extract …on sensitive information about people’s identities, locations, habits and desires.” The Executive order acknowledges the need for new policies to not only protects copyrights-holders in the context of AI, but also citizens as their behavioral data are being used to train AI-models.

==== Enforcement ====
As stated in section 1.1., human-based data may be a broad term, the use of which may violate several laws and regulations.. A certain responsibility  to protect competition in the interest of consumers lies with the FTC. In the case of AI, it may be difficult to assess whether infringement of violations take place.
A special enforcement resolution  was issued by the FTC in November 2023,  “ directing use of compulsory process in a non-public investigation of products and services that use or are produced using artificial intelligence or that purport to detect the use of artificial intelligence”. The specific action enables the FTC to start investigations of possible use of AI in violation with Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 to detect unfair, deceptive, anticompetitive,  collusive, coercive, predatory, exploitative, or exclusionary acts or practices in or affecting commerce relating to products and services that use or are produced using artificial intelligence, including but not limited to, machine-based systems that can, for a given set of defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments, or that purport to use or detect the use of artificial intelligence.
The proposed bill COPIED act may be instrumental in enabling the AI market to become more transparent, for rights-holders to receive remuneration based on standardized provenance mechanisms.

=== South Africa ===

Module 5: Artificial Intelligence

2025-11-26T19:45:56Z

NadineWalsh: /* European Union */

== Text and data mining ==
According to [https://eur-lex.europa.eu/eli/dir/2019/790/oj Directive (EU) 2019/790], "‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations". The Directive further provides a framework for the use of such techniques.
=== European Union ===
'''The Relationship between the CDSM Directive and AI Act'''When considering the compatibility between the CDSM Directive and the AI Act, Regulation[https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (EU) 2024/1689, Art. 53.1]provides a broad reference to the CDSM Directive: Providers of general-purpose AI models are required “to identify and comply with, including through state-of-the-art technologies, a reservation of rights expressed pursuant to Article 4(3) of Directive (EU) 2019/790”. Additional obligations (Art.53.1(d)) outline the requirement to “draw up and make publicly available a sufficiently detailed summary about the content used for training of the general-purpose AI model”. It is the responsibility of the AI Office to provide a template to ensure that providers follow the guidance and are exhaustive in the information made available. Where the[https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng AI Act refers to TDM is in Rec. 104 and 105], which is in reliance of the CDSM Directive. Here it is stated that general-purpose AI models remain, despite a number of  exceptions from obligations and requirements, obliged to produce a summary about the content used for model training. A reference to the withholding of rights over works by the rightsholder, only in cases not related to scientific research is outlined in the AIA’s recitals and cautions providers of general-purpose AI models to obtain authorisation from rightsholders if such works were to be included in TDM. 

'''Questions of Scope and Enforceability'''The concern is that the current provisions seem less stringent or tight in light of the fact that in order to train and develop large language models, such as Chat GPT, the input is required to come from a large variety of sources. Sources, such as books, essays, website, and even chatbot messages and social media posts may contain copyrighted materials. Under what conditions the use of these materials is considered legal, is one of the current dilemmas in the training of large language models, which form the basis of general AI use. Although it is the responsibility of the development company to ensure that copyright violations do not take place in the training and development of general-purpose AI models, Lucchi emphasises that this is a[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf field of the law, which is “multifaceted and dynamic” and which “necessitates meticulous examinations on a per-case basis”]- i.e. when are ‘fair-use’ or ‘legal exceptions’ relevant. A recent[https://www.europarl.europa.eu/thinktank/en/document/IUST_STU(2025)774095 study report on generative AI and copyright], which was requested by the JURI Committee, addresses inconsistent implementation of how rights are to be reserved in a machine-readable way. This is creating difficulties for developers with regards to the aspect and ways of how the data they use is lawful. From the perspective of training and developing AI models, input and output are extrinsically interlinked and the line between both is “extremely permeable”. The growing concern, which is gaining popular airtime currently, is the fact that existing frameworks may not be sufficient to address the inherent complexities of generative AI systems, as these have or are developing the capabilities to “[https://www.cambridge.org/core/services/aop-cambridge-core/content/view/CEDCE34DED599CC4EB201289BB161965/S1867299X23000594a.pdf/chatgpt-a-case-study-on-copyright-challenges-for-generative-artificial-intelligence-systems.pdf directly compete or even dwarf original works]”.

'''Challenges & Case Law'''In an[https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ open letter], published on 30th July by the European Writers’ Council, a coalition of rightsholders emphasised that the “the damage to and unfair competition with the cultural and creative sectors can be seen each day”.[https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ The coalition]requested stronger safeguards for the cultural and creative sectors. By rejecting the view that the Code of Practise provides a fair and workable balance on the use of training material access for and by GenAI models, it issued a plea to the European Parliament and member states to challenge the[https://europeanwriterscouncil.eu/ccs-joint-statement-july25/ “unsatisfactory process of the exercise”]as this practise is seen to further weaken the situation of the creative and cultural sectors across Europe.The first case[https://curia.europa.eu/juris/showPdf.jsf?docid=300681&doclang=EN (C-250/25)]of this kind, was lodged with the Court of Justice of the European Union (CJEU) in April 2025. The applicant, Like Company, a Hungarian publishing and news organisation, is alleging that Google Ireland Limited has accessed news reports and press releases. Like Company’s revenue is derived from advertising provided on its news portals, where news content of a journalistic nature is published.  The referring Hungarian court is requesting a ruling whether the accessing and training Google’s AI Chatbot Gemini has infringed the applicant’s rights under EU legislation. When asked directly, “the chatbot operated by the defendant is capable of providing a response that displays the content of a protected press publication”. “The applicant asked the referring court to find that the defendant had infringed the applicant’s rights under the relevant national and EU legislation, by reproducing through electronic means the applicant’s press publications, in order to make them available to the public.

=== Brazil ===

==== Introduction ====

Brazil is currently in the process of implementing a national strategy on AI, a process which Brazil began in 2020. The strategy is holistic and considers many different aspects where Brazil is working on legislation, regulation, and AI governance with an eye to ethical use of AI and alignment with international approaches to AI. Brazil’s AI policy also puts a focus on education, workforce & training, research, development and innovation, how AI can be applied in “productive sectors” of the economy and in public bodies, and public security. The overall policy is founded on a goal of stimulating research, innovation and development of AI solutions while maintaining conscious and ethical use of AI. This national strategy is captured in policy documents, including the Brazilian Artificial Intelligence Strategy ([https://www.gov.br/mcti/pt-br/acompanhe-o-mcti/transformacaodigital/arquivosinteligenciaartificial/ebia-summary_brazilian_4-979_2021.pdf EBIA]), as well as the National Strategy for Intellectual Property ([https://www.gov.br/inpi/pt-br/central-de-conteudo/noticias/cerimonia-marca-50-anos-do-inpi-e-lancamento-da-estrategia-nacional-de-propriedade-intelectual/EstratgiaNacionaldePropriedadeIntelectual.pdf ENPI]) and the National Policy of Innovation.

Pursuant to the Brazilian Artificial Intelligence Strategy, Brazil is working on specific legislation for AI. An initial draft AI Act was introduced in Brazil’s lower legislative chamber (the Chamber of Deputies) in 2020 (PL 21/2020), and was subsequently sent to the upper chamber (the Senate). The Senate convened a committee of experts to hold public hearings and collect public comments, the Comissão de Juristas responsável por subsidiar elaboração de substitutivo sobre inteligência artificial no Brasil ([https://legis.senado.leg.br/atividade/comissoes/comissao/2504/ source]). Other relevant draft laws were also pending in the Senate, so the Senate issued an order to combine, restructure and improve the text of these proposed laws pending input from the Committee. The Committee held meetings in 2022 and issued a final report in December 2022 with proposed changes to text. According to a press release from August 2024, the Senate is still reviewing draft AI legislation. A new draft text incorporating the recommended language from the committee of experts has been assigned bill number PL 2338/23, and it is this bill that appears to be moving forward in the Senate. The Chamber of Deputies’ original draft text PL 21/2020 has not moved forward; several other draft laws that relate to AI are also pending in the Senate. The Senate now has another commission debating the draft AI Act, which is continuing to meet regularly ([https://legis.senado.leg.br/atividade/comissoes/comissao/2629/ source]). Thus, it appears Brazil is getting closer to finalizing the draft legislation.

==== Text and Data Mining in Brazil ====

With the AI legislation in Brazil not yet finalized, from a copyright perspective, Brazil law currently does not authorize text and data mining (TDM) without permission of the copyright holder. Although Brazil’s copyright act, Law No. 9.610 of February 19, 1998 (Law on Copyright and Neighboring Rights), does include some exceptions to the exclusive rights of a copyright holder, none of these exceptions (in Articles 46, 47, and 48 of ) address text and data mining. [source: https://www.wipo.int/wipolex/en/legislation/details/514]. Thus, the work that Brazil’s Senate is doing on the draft AI will be important to regulate text and data mining activities when the law is finalized and approved.

The most recent and active draft AI Act in Brazil, PL 2338/23, includes the following definition of text and data mining:

\Art. 4. For the purposes of this Law, the following definitions are adopted:

[…] VIII – text and data mining: process of extracting and analyzing large amounts of data or partial or full excerpts of textual content, from which patterns and correlations are extracted that will generate relevant information for the development or use of artificial intelligence systems.

The draft law would regulate text and data mining as follows:

Art. 42. The automated use of works, such as extraction, reproduction, storage and transformation, in data and text mining processes in artificial intelligence systems, in activities carried out by research organizations and institutions, journalism and museums, archives and libraries, does not constitute an offense to copyright, provided that:
I – it does not have as its objective the simple reproduction, exhibition or dissemination of the original work itself;
II – the use occurs to the extent necessary for the objective to be achieved;
III – it does not unjustifiably harm the economic interests of the owners; and
IV – it does not compete with the normal exploitation of the works.

§ 1. Any reproductions of works for data mining activities will be kept under strict security conditions, and only for the time necessary to carry out the activity or for the specific purpose of verifying the results of scientific research.

§ 2. The provisions of the caput shall apply to the activity of data and text mining for other analytical activities in artificial intelligence systems, provided that the conditions of the items of the caput and § 1 are met, provided that the activities do not communicate the work to the public and that access to the works has been legitimate.
§ 3. The activity of text and data mining involving personal data shall be subject to the provisions of Law No. 13,709, of August 14, 2018 (General Personal Data Protection Law) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]) ([https://wolterskluwerblogs.com/copyright/wp-content/uploads/sites/49/2023/01/ARQUIVO_PORTAL_CJSUBIA_7430ComissaoESPComissaoCJSUBIA20221206-4.pdf source]).

As noted above, this is only a draft legislation, and this could change as the draft bill is debated further in Brazil’s congress.

The draft TDM definition and exception are notable in being fairly aligned with other jurisdictions such as the European Union. Brazil’s draft definition of TDM goes so far as to stipulate that “large amounts of data or partial or full excerpts of textual content” will be permitted to be mined, which suggests even in this definition the intent to provide an exception from the existing copyright regime. The definition also limits this use to the purpose of “development or use of artificial intelligence systems.” Arguably, this language ensures that the exception will be limited to the AI field. The inclusion of TDM when AI systems are in “use” is an interesting addition, since it suggests that TDM might be permissible not only for the training stage, but also when AI is deployed.

Like other jurisdictions such as the EU, Brazil’s draft TDM exception at Article 42 provides for use of works by research organizations and cultural institutions, namely, museums, archives, and libraries. However, it also notably allows an exception for journalism, along with the scientific and cultural uses. It is also notable that draft Article 42 includes a requirement that any use of the TDM exception “does not unjustifiably harm the economic interests of the owners” or compete with or replace the original works. Like the EU, subsection (42)(1) requires security conditions and limits the time for keeping the works.

Draft section 42(2) appears to provide a broader TDM exception that is not limited to scientific research, journalism, or cultural institutions, with additional requirements that entities using 42(2) must also not communicate the work to the public and must have had legitimate access to the works in the first place. This would seem to suggest that scraping is not allowed under draft section 42(2), but possibly is allowed for scientific research, journalistic purposes, or cultural purposes. Notably, this draft broad TDM exception in 42(2) does not include any kind of mechanism for rights holders who do not wish their works to be used in TDM activities to opt-out.

Finally, draft subsection 42(3) states that Brazil’s general data privacy law does apply to TDM activities. Thus, if this proposed language becomes law, entities using the TDM exception will still have to consider data privacy.

=== China ===
We have not identified a definition of ‘text and data mining’ in Chinese legislation or policy, so we have relied on the definition from Directive (EU) 2019/790:
''‘text and data mining’ means any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations. ''
This definition exists with a European Union (EU) law regarding exceptions and limitations of copyright for text and data mining. Consequently, to consider the Chinese position regarding text and data mining, we turn first to frame the copyright regime in China. 

==== Copyright Law of the People’s Republic of China (CLC) ====
Copyright Law of the People’s Republic of China in an administrative regulation enacted in 1951 and last revised in 2021. The Copyright Law aims to protect the copyright of authors in their literacy, artistic and scientific works and the copyright-related rights and interests, of encouraging the creation and dissemination of works which could contribute to the construction of socialist spiritual and material civilization, and of promoting the development and prosperity of the socialist culture and science. 
It applies to:
*works of chinese citizens, legal entities or other organizations, whether published or not
*work of a foreign or stateless person which is eligible to enjoy copyright 
**under an agreement concluded between the country to which the foreign belongs and China 
**international agreement
*works of foreign or stateless persons first published in the territory of China

==== Fair Use Doctrine ====
China is a civil law country which adheres to early continental European traditions, following the concept of the European droit d’auteur system. The structure of China’s copyright exception model can be considered as a closed list rather than an open-ended one (e.g U.S).
Specifically, Article 22 of the Chinese Copyright Law, the so-called fair use clause, lists 13 situations in which the use of copyright material constitutes permitted fair use, but it is difficult to categorize the use of copyright materials for AI training within these scenarios. Nevertheless, the [http://lawinfochina.com/display.aspx?id=9280&lib=law Chinese Supreme People’s Court judicial policy document] offers some flexibility in applying the fair use doctrine under special circumstances. It states that: 
''‘Under special circumstances as necessary for promoting technological innovation and business development, a use of works may be determined as reasonable after consideration of the nature and purposes of use, the nature of works used, the quantity and quality of the part of works used, impacts of use on potential markets or values, and other factors, provided that such use neither contravenes the normal use of the works nor results in unreasonable damage to the lawful interests of the author.’ ''
Additionally, the [https://www.wipo.int/wipolex/en/legislation/details/13428 Regulations for the Implementation of the CLC] (RICL) provides an in-depth examination of Article 22 CLC. According to Article 21 RICL ‘the exploitation of a published work which may be exploited without permission from the copyright owner in accordance with the relevant provisions of the Copyright Law shall not impair the normal exploitation of the work concerned, nor unreasonably prejudice the legitimate interests of the copyright owner. Thus, this two-step test serves as a complement to the listed exceptions in Article 22 CLC: the extent of exempted uses should not violate the two step test of Article 21 RICL. 
With the law being last revised in 2021, text and data mining is not specifically referenced as an exception to copyright. Nevertheless, a few of the listed exceptions may concern text or data mining used for AI training.
'''Fair use exceptions'''
Article 22(1) CLC provides that ‘use of a published work for the purposes of the user’s own private study, research or self-entertainment’ can be exempted. However, this example will not offer much safeguards as most AI users are corporations and the research they carry out cannot be deemed as private. 
Article 22(6) CLC provides that ‘translation, adaptation, compilation, playing, or reproduction in a small quantity of copies, of a published work for use by teachers or scientific researchers, in classroom teaching or scientific research of schools, provided that the translation or reproduction shall not be published or distributed’ can be exempted and may cover text and data mining. Still, the term ‘schools’ excludes commercial educational institutions and the commercial activities conducted by non-commercial institutions. Moreover, even if research institutions such as public universities may be covered by this exception, it is also required that the reproduction of published work shall be kept in ‘small quantity’. Thus, it is not a welcomed limitation for text and data mining that may require huge amounts of copyright data. 
Finally,  it could be a reasonably arguable position that Article 22, paragraph 7 may empower the State to engage in text and data mining, provided the State:
*mentions the name of the author and the title of the work; for example, in a list referencing all the works that were subject to the mining; and 
*the mining is by a State organ fulfilling official duties.  

{|
|-
| Article 22, paragraph 7, paraphrased: 
A work may be exploited without permission from, and without payment of remuneration to, the copyright owner, if the name of the author and the title of the work are mentioned and the other rights enjoyed by the copyright owner by virtue of this Law are not prejudiced, in the circumstance of a State organ using a published work, within proper scope, for the purpose of fulfilling its official duties.
|}

==== Amendments to the Law ====
===== Regulation for Generative Artificial Intelligence Services =====
On April 11th 2023, the Cyberspace Administration of China released a draft of the [https://www.china-briefing.com/news/how-to-interpret-chinas-first-effort-to-regulate-generative-ai-measures/ Regulation for Generative Artificial Intelligence Services], in force since August 2023. It includes 21 measures encompassing a wide array of subjects pertaining to the development and provision of Generative AI services. 
The regulation applies to ‘only applicable to services accessible to the general public within China’. It excludes from its scope AI services developed and utilized by enterprises, research and academics, research and academics institutions, and other public entities ([https://www.cac.gov.cn/2023-04/11/c_1682854275475410.htm Article 2]). Generative AI technologies are defined as models and related technologies that can generate contents in the form of texts, pictures, audios and videos (Article 22). 
<h5 class="mwt-heading" >Requirements for training data (article 7-8)</h5>
The Generative AI Measures require service provides to source data and foundation models from legitimate sources, respect the intellectual property rights of users, and process personal information with appropriate consent or legal basis under Chinese Laws. Providers must enhance the quality of training data, striving for ‘authenticity, accuracy, objectivity, and diversity’(article 7). Thus, the Regulation places significant emphasis on safeguarding personal data and information by imposing on providers the obligation to protect the input information of users and usage records during the service provision process. During the development phase, providers must establish ‘clear, specific and practical’ labeling rules for the training data. Conducting quality assessment of data labeling and sample verification to ensure accuracy of labeled content is also required (article 8). Additionally, illegal retention of input information that can be used to infer user identities, creation of user profiles based on input information usage, and disclosure of user input information to third parties are prohibited (Article 11). 

===== AI security governance framework =====
On 10 September 2024, the State Council of China [https://english.www.gov.cn/news/202409/10/content_WS66df9f30c6d0868f4e8eac91.html published] an AI security governance framework, to come into effect on 1 January 2025. The [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf Framework] was put together by China's National Technical Committee 260 on Cybersecurity and seeks to promote responsible AI innovation. Although this framework is not a piece of legislation, compliance is [https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ suggested] to be mandatory. 
[https://www.onetrust.com/blog/chinas-tc260-releases-ai-safety-governance-framework/ Onetrust] identifies key areas of the framework as: 
*Risk management and transparency 
*Ethical responsibilities
*Accountability mechanisms
*Cross-border data, security, and privacy considerations

 Relevant for consideration of copyright and text and data mining exceptions are: 
*requirements for data integrity, 
*recordkeeping obligations for data sources, 
*systems that comply with China’s Data Security Law and Personal Information Protection Law 

 The Safety Guidelines of the Framework are significant and wide reaching. The relevant guidelines for training AI models apply to developers. Developers of AI models [https://www.tc260.org.cn/upload/2024-09-09/1725849192841090989.pdf should] (see 6.1): 
<div>

{| style="height: 130px;"
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*uphold a people-centered approach 
| style="height: 51px; width: 454px;" |
*strengthen data security and personal information protection
|- style="height: 28px;"
| style="height: 28px; width: 512px;" |
*adhere to the principle of AI for good
| style="height: 28px; width: 454px;" |
*respect intellectual property and copyright
|- style="height: 51px;"
| style="height: 51px; width: 512px;" |
*follow science and technology ethics in key stages such as requirement analysis, project initiation, model design and development, and training data selection and use
| style="height: 51px; width: 454px;" |
*ensure that data sources are clear and acquisition methods are compliant
|}
</div>
This framework also has a national security flavour, and seeks to ensure AI develops without bias or discriminatory results.  

==== Hong Kong Amendment of Copyright Ordinance ====
[https://techinsights.linklaters.com/post/102jf9o/hong-kong-proposes-new-copyright-exception-for-text-and-data-mining-to-facilitate The Hong Kong government] recently launched a two-month public [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf consultation] aimed at enhancing the Copyright Ordinance to address the challenges brought by AI technology. To maintain a balance of interests between copyright owners and users, the Copyright Ordinance contains a number of copyright exceptions that permit reasonable use of copyright works under specific circumstances. However, each exception is confined to certain situations and purposes and subject to their respective conditions and there is no specific copyright exception for text and data mining. 
The consultation focuses on four areas: 
*copyright protection of AI generated work
*copyright infringement liability for AI generated works 
*introduction to specific copyright exception for text and data mining activities 
*other issues e.g deepfakes The proposal defines [https://www.ipd.gov.hk/filemanager/ipd/en/share/consultation-papers/Eng-Copyright-and-AI-Consultation-Paper-20240708.pdf text and data mining] as ‘automated techniques to extract and conduct computational analysis of extensive collection of text, images, data and other types of information for generating valuable insights, patterns, trends and correlations that would likely be unattainable through manual efforts alone’.

==== Case law  ====
===== Beijing Internet Court grants Copyright to AI-Generated Image =====
The [https://globallitigationnews.bakermckenzie.com/2024/05/08/china-a-landmark-court-ruling-on-copyright-protection-for-ai-generated-works/ first case] to address whether AI-generated work
:a) are protectable by copyright and
:b) who owns the copyright
was decided before the Beijing Internet Court in November 2023.'''Facts'''
The plaintiff, Mr. Li, used Stable Diffusion (an artificial intelligence) to generate the image involved in the case and published it on the Xiaohongshu (Little Red Book) platform; the defendant, a blogger on Baijiahao, used the image generated by the plaintiff’s AI to accompany the article, and the plaintiff sued. 
'''Judgement'''
First, the Court considered the meaning of ‘works’ under the Copyright Law of China, which provides that works must be original and reflect intellectual achievement. In terms of intellectual achievement, the Court noted that the plaintiff did not merely use existing pictures returned by search engines or rearranged pre-designed elements when creating the picture. Instead, the plaintiff designed how the woman should look in the picture and entered the relevant prompts. The plaintiff then inputted detailed prompts such as ‘japan idol’, ‘cool pose’, ‘viewing at camera’ and ‘film grain’, and then further adjusted the prompts based on the preliminary images generated by Stable Diffusion. According to the court, these actions demonstrates the plaintiff's intellectual input. 
Regarding the concept of originality, the court notes that this means that the work should be independently completed by the author and that should reflect the author’s subjective expression. In the context of AI-generated images, originality should be assessed on a case-by-case basis. In this case, the plaintiff designed the different elements of the image by inputting and fine-tuning the prompts and adjusting the parameters, which ultimately demonstrates the plaintiff's original judgment. Thus, the Court held that the picture is protected by copyright as an original work. It recognized the picture as a ‘work of fine arts’ under Article 3 CLC. 
Secondly, on the matter of copyright ownership, [https://english.bjinternetcourt.gov.cn/2023-12/28/c_688.htm the Court held] that Copyright Law provides that copyright shall be owned by the author of the work and an AI model cannot be an author because it is not a natural or legal person. Moreover, the designer of Stable Diffusion only created the AI model, it was not involved in the intellectual input leading to the creation of the picture and the licensing agreements states that the designer of Stable Diffusion does not claim rights in any output content. 

===== Pending Case to address whether AI Training constitute Copyright Infringement =====
In China, the [https://www.managingip.com/article/2dnu9r92bmzrcdrw84ykg/sponsored-content/training-ai-models-and-copyright-challenges-chinese-and-eu-insights first case] to address whether AI training constitutes copyright infringement is pending before the Beijing Internet Court.
The case was brought by four Chinese illustrators against the developers of Trik AI, a generative AI painting app released by the famous Chinese lifestyle platform Xiaohongshu, with a particular strength in generating traditional Chinese-style paintings. The illustrators claimed, among others, that Xiaohongshu’s use of their work to train its AI model constituted an infringement of their reproduction rights. Xiaohongshu, on the other hand, contends that using the plaintiffs’ works for AI training should be considered "fair use" under Article 24 of the Chinese Copyright Law. A judgment in this case has not yet been issued.
From a technical perspective, establishing copyright infringement in China depends on whether the AI model has made a ‘temporary’ or ‘permanent’ reproduction of a copyrighted work during the training process. Under the Chinese Copyright Law, the general rule is that it is only when a permanent copy is made that copyright infringement occurs.

=== India ===
[https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry] has stated that India’s existing regime of intellectual property rights (IPR) and copyright is sufficient to protect both rights holders of AI-generated works, and rights holders of content that may be used by Generative AI (e.g., training data). Consequently, the Ministry states there is no reason nor need to develop an additional regime specifically regulating AI and related innovations. As a result, there is no specific regulation to discuss relating to training data and scraping, also known as text and data mining (TDM), for AI training purposes. This paper thus focuses on aspects of the current regulatory regime that are relevant to the question of AI training data, and discusses potential limitations and criticisms of the reliance on the current regime. 

 Important to note is that India also lacks regulation regarding AI generally, not just lacking regulation regarding TDM either generally or for the purposes of AI training. Despite this, the government has addressed the growing challenge of AI through publishing the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence] which highlights numerous legal and societal challenges arising from AI. This Strategy does not explicitly mention copyright or legal issues arising from TDM, but highlights privacy problems that may be relevant for TDM for training as part of the AI lifecycle.
 [https://pib.gov.in/PressReleasePage.aspx?PRID=2004715 The Indian Ministry of Commerce and Industry brings attention] to a few specific aspects of the current IPR regime. Exclusive economic rights of a copyright owner are provided by the Copyright Act 1957. For generative AI to make use of copyrighted material under this act, the use must be covered under fair dealing exceptions in Section 52 of the Copyright Act 1957. Additionally, India’s personal data regulatory framework may be a relevant consideration for TDM.

==== The Copyright Act 1957 ====
 [https://www.copyright.gov.in/Documents/Copyrightrules1957.pdf The Copyright Act 1957] is India’s main regulatory instrument regarding intellectual property and copyright. Section 13 of the Copyright Act 1957 highlights which works are provided copyright protections, which include (1) original literary, dramatic, musical and artistic works, (2) cinematographic films, and (3) sound recordings. Section 14 expounds on actions that are prohibited to take against copyrighted works. Most relevant is the mention of the prohibitions of “the storing of [the copyrighted work] in any medium by electronic or other means” (emphasis added). This is applicable for the cases of a literary, dramatic, or musical work, a computer programme, an artistic work, and cinematographic films, covering all types of works mentioned in the Copyright Act 1957.
===== Infringement of Copyright and Fair Dealing Exceptions =====
 Chapter XI Copyright Act 1957 addresses infringements of copyright. Section 51 outlines when copyright will be deemed infringed, which includes when anything is done which is the exclusive right of the copyright holder (Section 51(a)(i)), and other distributions of the copyrighted work, including when it is “to such an extent to affect prejudicially the owner of the copyright” (Section 51(b)(ii)).

 Section 52 outlines when certain acts are not considered an infringement of copyright, commonly known as fair dealing exceptions. Section 52(a)  excludes from infringement “a fair dealing with any work, not being a computer programme,” for the purposes of either “(i) private or personal use; including research; (ii) criticism or review [...]; [and] (iii) the reporting of current events and current affairs.” An accompanying explanation states that the storing of any copyrighted work in an electronic medium for the aforementioned purposes shall not constitute an infringement. Section 52(aa) (sic) excludes from infringements the certain actions towards copyrighted computer programmes, such as when a lawful possessor of a copy makes copies of the programme for certain purposes (Section aa(i)-(ii) (ab), (ac), (ad), …). Section 52 is expansive and outlines numerous other exceptions.

===== Application of the CRA 1957 to TDM =====
Generally, the Copyright Act 1957 is vague. The fair dealing exceptions in Section 52 are strict and lack any specific reference to TDM or more generally to the use of copyrighted information to develop a product as such. The Copyright Act 1957 does reference electronic storage and recent technological changes such as, for example, listing the circumvention of “an effective technological measure applied for the purpose of protecting any of the rights conferred by this Act” (Section 65A) as an offence. However, such mentions are limited and still revolve around the (illegal) act of creating a copy of a copyrighted work. Much of the Copyright Act 1957 is focused on the illegal replication of works.
The Copyright Act’s particular focus has resulted in scholarly opinion that the Act would actually not prohibit TDM despite a lack of explicit fair dealing exception. Dr. Arul George Scaria, Co-Director of the [https://ciipc.org/ Centre for Innovation, Intellectual Property, and Competition (CIIPC) at National Law University in Delhi], has argued for the legality of TDM under Indian copyright law. He [https://spicyip.com/2019/08/should-indian-copyright-law-prevent-text-and-data-mining.html argues that Indian copyright law] only protects the expression of ideas, not facts or ideas themselves. So, when a researcher, for example, uses a copyrighted article in the course of TDM, this should be considered a non-expressive use of the work outside of copyright protection. He goes so far as to argue that it is thus “morally and legally impermissible to allow publishers to use End User Licence Agreements or other contractual tools to restrict researchers from using articles for TDM.” 
Additionally, Dr. Scaria emphasises that India’s copyright regime privileges not only the rights of the creators or copyright holders, but also the users of such works. He references the[https://indiankanoon.org/doc/135895592/ Delhi University Photocopy Shop (Single Bench)] decision, wherein Justice Endlaw states that the rights of persons in Section 52, the fair dealing exception, should not be interpreted narrowly or strictly. The rights given to users should be interpreted on par with those given to creators. Lastly, Dr. Scaria argues that India’s fair dealing regime can provide the flexibility to apply to newer technological developments such as TDM. Whilst Dr. Scaria makes a compelling argument, part of that compelling argument derives from his discussion of TDM as done by researchers, rather than addressing, for example, the use of TDM to train AI for ultimately commercial purposes.
Another case did address TDM for another use, by the state. Whilst this does not explicitly address the use of TDM to train AI, it still provides perspective on how TDM might be understood in the context of India’s regulatory framework. The Supreme Court of India, in the case of [https://indiankanoon.org/doc/127517806/ Justice K.S. Puttaswamy (Retired) vs Union of India and Ors.], recognised TDM’s importance for the state. The Court held that “[TDM] with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the state to insist on the collection of authentic data.” However, this case addressed TDM primarily from a privacy law perspective, rather than copyright; consequently, there still is no litigation that addresses the TDM in a copyright context. This raises further concerns considering the lack of explicit inclusion of a TDM fair dealing exception in Section 52 of the Copyright Act 1957.
As a result, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html likely means of justifying TDM is through Section 52(1)(a) ]which allows for private and personal use of copyrighted works, including for research. This provision is nuanced, wherein the making of copyrighted works publicly available to facilitate private and personal use such as by public libraries could be justified. However, the [https://spicyip.com/2020/06/crawl-cautiously-examining-the-legal-landscape-for-text-and-data-mining-in-india-part-i.html Calcutta High Court in 2013] stated that “commercial exploitation” does not fall under “private or personal use,” a position reaffirmed by the Bombay High Court in 2018. Thus, it seems that the main way in which TDM could be justified under India’s copyright regulation is through arguing that TDM does not infringe on the expression of the idea or data, and thus copyright does not apply, as argued by Dr. Scaria.
==== Database protection ====
 A newer form of intellectual property rights relates to database protection, which may be relevant when it comes to TDM. India does not have an explicit database right in its intellectual property right regime, but it has recently been subsumed into its copyright regulatory framework. [https://link.springer.com/chapter/10.1007/978-981-10-3984-3_10 The Delhi High Court in Himalaya Drug Company v Sumit] ruled that compilations of databases could be considered literary works and consequently covered by the Copyright Act 1957. This would mean use of compilations of databases in TDM contexts would have to fall under fair dealing exceptions in Section 52 of the Copyright Act 1957. 
==== Personal data mining ====
 Another problematic aspect of data mining is the use of [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf personal data]. The source of data used for data mining can be essential, and if the data obtained is not public knowledge or obtained consensually, Indian personal protection legislation might apply. Companies and organizations that do not obtain personal data with permission or [https://www.icsi.edu/media/webmodules/CSJ/june/18ArticleKanchanBhave.pdf discriminate] against individuals based on age, sex, gender, race, or religion are not going to be compliant with local or transnational laws. Specifically in India, data mining in such circumstances is regulated by the [https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf Information Technology Act], 2000 (IT Act) (e.g Article 43A which outlines rules on unauthorized access, sensitive personal data, and information, as well as compensation for failure to protect data), and the [https://www.google.com/url?q=https://www.meity.gov.in/writereaddata/files/Digital%2520Personal%2520Data%2520Protection%2520Act%25202023.pdf&sa=D&source=docs&ust=1732737698777765&usg=AOvVaw0wY-MZ1iAH8P634ZfD2-Vf Personal Data Protection Bill, 2019 (PDP Bill)]. However, some scholars discuss that the production of Privacy Preserving Data Mining Techniques[https://www.researchgate.net/profile/Ahmad-Ahmad-79/publication/375343129_Psychological_Burden_of_Caregivers_of_Children_with_Cancer_at_AL-Amal_Hospital_in_Baghdad_City/links/65476ca9b86a1d521bb8fe8a/Psychological-Burden-of-Caregivers-of-Children-with-Cancer-at-AL-Amal-Hospital-in-Baghdad-City.pdf#page=410 could circumvent] regulation from data protection regulation. This approach is somewhat reflected in the [https://www.niti.gov.in/sites/default/files/2023-03/National-Strategy-for-Artificial-Intelligence.pdf National Strategy for Artificial Intelligence], wherein the Indian government recommends investing in privacy-preserving AI research methods to reduce the “risks of data exploitation and personal identification (from an anonymisation dataset).”

=== United States ===
==== Text and data mining in the US ====
'''Introduction TDM'''Text- and data mining is a process used to develop AI models. Data is fed into a model and algorithms are applied to the data. The term TDM is not defined in US Law, but rather as "machine and human- based inputs” under Title 15 Commerce and Trade. Another reference can be found under Machine Learning, which mentions "the ability to automatically learn and improve on the basis of data or experience. 
'''US definition AI'''The legal definition of AI originates from the National Artificial Intelligence Initiative Act of 2020, which regulates public bodies' use of AI:
"a machine based system that can, for a given set of human-defined objectives, make predictions,  recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems  use machine- and human-based inputs to perceive real and virtual environments; abstract such  perceptions into models through analysis in an automated manner; and use model inference to  formulate options for information or action.”,
The legal question is: do any restrictions apply to the use of input such as publicly available text or data in digital form for the purpose of training AI models?
To the extent that the input may be protected by copyright, the Copyright Act of 1976 is applicable.
To the extent that the input may be pertaining to data created by human behavior, other acts or constitutional rights may apply.
To the extent that the use of the data may be unfair or harmful to competition or consumer rights, FTC regulations may apply.

==== U.S. Constitution ====
Patent and Copyright Clause
(a.k.a. Patent Clause, the Copyright Clause, and the Progress Clause)
The Congress shall have Power ...to promote the Progress of Science and useful Arts, by securing for limited Tımes to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

==== Federal Law ====
===== The Copyright Act of 1976 =====
The United States copyright law is contained in the United States Code, chapters 1 through 8 and 10 through 12 of Title 17. The Copyright Act of 1976, which provides the basic framework for the current copyright law.
The authority has been granted to the US Copyright Office since 1870. 
To the extent that “human-based input’ and data can be a product of human work, it may be protected under the constitutional clause which grants an exclusive right to the Author or Inventor.
Copyright protection is granted to original works of authorship that are fixed in a tangible medium of expression . The author of the work generally holds copyright ownership generally, a right which she may transfer or license their rights to others. 
Essential to the copyright protection in the US is the fair use doctrine, which allows for several exemptions for which limited use of copyrighted material is allowed without the author’s permission. 
Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work.
The legal discussion regarding TDM in the US is evolving essentially around the application of the exceptions under the legal doctrine of fair use.
Following the Executive Order  Executive Order 13859 announcing the American Artificial Intelligence Initiative, the United States Patent and Trademark Office (USPTO) released a report titled “Public Views on Artificial Intelligence and Intellectual Property Policy.” The report consults a wide variety of stakeholder views on the impact of artificial intelligence (AI) across the intellectual property (IP) landscape, including patent, trademark, copyright, and trade secret policy, as well as developing issues about database protection. 
In this report, the USPTO stated:‘ “The ingestion of copyrighted works for purposes of machine learning will almost by definition involve the reproduction of entire works or substantial portions thereof. Accordingly, whether this constitutes copyright infringement will generally be determined by considering the applicability of the fair use doctrine, an exception set forth in section 107 of the Copyright Act, 17 U.S.C. § 107. Fair use is applied on a case-by-case basis, requiring courts to weigh several statutory factors, and is highly fact-dependent.’  § 102).’
The report included the results of a poll among a broad array of public and private stakeholders. The report  showed that the existing legal framework lacks instruments to tackle the challenges of AI. While the majority found the existing U.S. intellectual property laws calibrated correctly to address the evolution of AI (copyright, trademarks, trade secrets, and data fields), some suggested a need for new classes of IP rights. Overall, many agreed that existing commercial law principles (e.g., contract law) might adequately fill any gaps left by IP law in the wake of advances in AI .

===== COPIED ACT bill proposal =====
July 11th 2024 the bipartisan bill was introduced in Congress.
Content Origin Protection and Integrity from Edited and Deepfaked Media Act of 2024
The bill proposal addresses the new IP issues with respect to content by requiring transparency and content provenance information in an aim to protect artistic content.
The intention to establish NIST standards for provenance information seems to open the possibility for remuneration for rights-holders. This would be aligned with the intent of the constitutional right in the Patent and Copyright Clause.

==== Recent US Court cases regarding TDM ====
NEW YORK TIMES v. OPEN AI INC (2023)
The New York Times claimed that OpenAI and Microsoft, as creators of highly profitable generative AI models, did not give credit or remuneration to the New York Times despite relying on their works. The New York Times further alleges that this conduct not only infringes on their intellectual property rights but could also threaten their business model of providing news coverage, analysis and commentary on current events.
AUTHORS GUILD v. OPEN AI INC (2024)
17 authors argue that OpenAI should have first obtained their permission to use their copyrighted works and now seek a permanent injunction against OpenAI to prevent these alleged harms from reoccurring. The Authors Guild is also seeking damages for the lost opportunity to licence their works and asserts that OpenAI and Microsoft forced them into a position where they unknowingly aided their own market replacement. 

==== Policy ====
Two executive orders have been released pertaining to the use of AI by public bodies.
Executive Order 14110 of October 30, 2023 Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence mentions data as understood in 1.1.
Regarding availability of data for training the Executive Order states:
(b) …This effort requires investments in AI-related education, training, development, research, and capacity, while simultaneously tackling novel intellectual property (IP) questions and other problems to protect inventors and creators.
(e) … The Federal Government will enforce existing consumer  protection laws and principles and enact appropriate safeguards against fraud, unintended bias,  discrimination, infringements on privacy, and other harms from AI. Such protections are especially important in critical fields like healthcare, financial services, education,  housing, law, and transportation, where mistakes by or misuse of AI could harm patients, cost  consumers or small businesses, or jeopardize safety or rights. At the same time, my Administration will  promote responsible uses of AI that protect consumers, raise the quality of goods and services, lower  their prices, or expand selection and availability.
(f) Americans’ privacy and civil liberties must be protected as AI continues advancing. Artificial Intelligence is making it easier to extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires. Artificial Intelligence’s capabilities in these areas can increase the risk that personal data could be exploited and exposed. To combat this risk, the Federal Government will ensure that the collection, use, and retention of data is lawful, is secure, and mitigates privacy and confidentiality risks. Agencies shall use available policy and technical tools, including privacy-enhancing technologies (PETs) where appropriate, to protect privacy and to combat the broader legal and societal risks—including the chilling of First Amendment rights—that result from the improper collection and use of people’s data. 
The Executive Order stipulates the need for  “tackling novel intellectual property (IP) question”, “enforce protection laws and principles”and “enact safeguards against harms from AI” as “AI is making it easier to extract …on sensitive information about people’s identities, locations, habits and desires.” The Executive order acknowledges the need for new policies to not only protects copyrights-holders in the context of AI, but also citizens as their behavioral data are being used to train AI-models.

==== Enforcement ====
As stated in section 1.1., human-based data may be a broad term, the use of which may violate several laws and regulations.. A certain responsibility  to protect competition in the interest of consumers lies with the FTC. In the case of AI, it may be difficult to assess whether infringement of violations take place.
A special enforcement resolution  was issued by the FTC in November 2023,  “ directing use of compulsory process in a non-public investigation of products and services that use or are produced using artificial intelligence or that purport to detect the use of artificial intelligence”. The specific action enables the FTC to start investigations of possible use of AI in violation with Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 to detect unfair, deceptive, anticompetitive,  collusive, coercive, predatory, exploitative, or exclusionary acts or practices in or affecting commerce relating to products and services that use or are produced using artificial intelligence, including but not limited to, machine-based systems that can, for a given set of defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments, or that purport to use or detect the use of artificial intelligence.
The proposed bill COPIED act may be instrumental in enabling the AI market to become more transparent, for rights-holders to receive remuneration based on standardized provenance mechanisms.

=== South Africa ===

Module 4: Power

2025-11-26T18:50:59Z

NadineWalsh: /* Inquiries and Preliminary Report */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
==== Competition Act ====
When considering the regulation of platform power in South Africa, currently the only legally binding act applicable is the 1998 [https://www.compcom.co.za/wp-content/uploads/2021/03/Competition-Act-A6.pdf Competition Act]. 
However, this Act has been criticized for not being sufficiently equipped to handle uncompetitive practices in the digital sphere, including the acts of powerful platforms. In applying the Act to these circumstances, there are various other shortcomings. For instance, it does not provide clear mandates and roles to statutory bodies, like the Competition Commission, to offer remedies to consumers who have been subject to vulnerabilities stemming from the acts of platforms and other actors in the digital space. To highlight the drawbacks of the Act in applying to platforms, algorithmic price discrimination can be taken as an example. At the time when the Act was passed, algorithmic price discrimination did not exist, explaining the lack of reference to it. The lack of such a reference perpetuates uncertainty as to how it should be regulated and tackled by competition authorities in South Africa. These uncertainties disturb the proper functioning of competition authorities in carrying out their functions in combating and dealing with any kind of uncompetitive [https://www.compcom.co.za/wp-content/uploads/2025/09/Competition-Law-in-uncertain-times-The-rise-of-Digitalization.pdf conduct]. 

==== Inquiries and Preliminary Report ====
While the Competition Act may not explicitly refer to digital markets and powerful players on said markets, South African competition authorities alternatively rely on market inquiries to intervene in digital markets. Market inquiries are essentially studies of the state of the market, investigating various aspects such as ‘the general state of competition, the levels of concentration in and structure of a market for particular goods of services. The inquiries are referred to as being proactive as they seek to improve competition, instead of reacting and trying to address abusive conduct. The inquiries are concluded with a binding remedial action and recommendations to the government on any changes which should be adopted. These are considered effective as they produce ‘tangible solutions’ to address structural barriers, in comparison to targeted enforcement where only specific actions are being tackled. The inquiries find their legal basis in Chapter 4A of the Competition Act, setting out the procedures, timelines and responsibilities attached to them. Either the Competition Commission or the Ministry of Trade, Industry and Competition can initiate an inquiry if there are suspicions of market distortion. Interestingly, there is a lower threshold for proving adverse effects on competition in comparison to other enforcement tools (which are effective for traditional competition issues). Inquires can consider public interest factors, for example requiring the Commission to assess how anti competitive effects can affect SMEs and businesses owned by historically disadvantaged [https://unctad.org/system/files/non-official-document/ccpb_IGECOM2024_contribution_digital_markets_SA_en_0.pdf persons] (HDP). 
The most prominent inquiry was back in 2023, known as the [https://www.compcom.co.za/online-intermediation-platforms-market-inquiry/ Online Intermediation Platforms Market Inquiry]. This inquiry was launched upon concerns that certain intermediation platforms impeded or restricted competition by limiting the participation of SMEs and HDP participation, aiming to assess the competition dynamics. The final report concluded that SME and HDP participation was significantly constrained by anti-competitive practices of large platforms. Some anticompetitive conducts included price parity clauses, self preferencing, and a lack of transparency in paid search. Binding remedial actions were imposed on various platforms, such as Google, Apple, Booking.com, Uber Eats and Bolt [https://www.compcom.co.za/wp-content/uploads/2023/07/CC_OIPMI-Summary-of-Findings-and-Remedial-action.pdf Food]. For example Google has to add a South African badge and search filter to ease users in finding and supporting South African platforms. Furthermore, Google needs to provide training and 100 million Rand in advertising credits to smaller South African platforms. Additionally, Google is to implement the same changes it makes in Europe to prevent [https://www.bricscompetition.org/news/south-africas-regulator-published-its-final-report-on-online-intermediation-market-inquiry self-preferencing]. 

==== African Union Protocol ====
The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Protocol to the Agreement Establishing the African Continental Free Trade Area on Competition Policy] was agreed by the African Union in 2023. 
The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf key aims of the protocol] are to provide for an “integrated and unified African continental competition” and “manage the interrelationships of competition regimes and sectoral regulatory laws at the national, regional, and continental levels”. It borrows the terminology of ‘gatekeeper’ from DMA.
[https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Part II of the Protocol] outlines the anti-competitive business practices and conduct being “incompatible with the proper functioning of the Market”, such as collusion, abuse of a dominant position, mergers and acquisitions preventing market competition, price fixing, and bid-rigging among others.It is [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf prohibited for an undertaking or a group of undertakings or gatekeepers] to abuse the relative position of economic dependence over a customer or supplier if the conduct substantially affects the functioning and structure of competition in the market.
The [https://static.pmg.org.za/250903_Ratification_AfCFTA_Protocols.pdf latest status on the ratification process of the protocol] at the time of writing, was that it has not yet been signed by the required 23 or more member states and is therefore not yet in force.
''''''
==== Comparison with EU legislation and Appropriateness ====
In line with Anu Bradford’s claim that the “EU remains an influential superpower that shapes the world in its image”, the influence of European legislation on South Africa and the wider continent is apparent and the Brussels Effect seems to be in full swing.
Bauer and Pandya argue however that the adoption of the essence of foreign regulations, namely the EU’s DMAt is a marked shift away from the “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. principles of traditional competition regulation]”. 
A criticism of the market inquiry approach is the identification of market leaders as competitive distortion. What is missing however to substantiate this claim, are the formal findings of dominance. Where the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng DMA outlines prerequisites] to be established as dominant (i.e. annual turnover, market capitalisation, active (business) users), this is absent in the inquiry. 
A further criticism of relying on the EU regulation or any other as they were, is a way to regulate for “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. hypothetical risks while ignoring tangible consumer benefits]”. 
Where the inquiry leaves the alignment with the DMA behind is its proposed interventions, which [https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. Bauer and Pandya ] describe as “heavy-handed”. The interventions can potentially more closely be described as “market engineering”, with suggestions of providing free advertising space to rivals, artificially boosting local competitors in search rankings and subsidising rivals.
''''''
==== Outlook, recommendations, and how to get it right for South Africa ====
In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,
[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase] outlines the shortcomings of borrowing from other legislations.

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach] for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step] should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal. There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 4: Power

2025-11-26T18:50:41Z

NadineWalsh: /* Competition Act */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
==== Competition Act ====
When considering the regulation of platform power in South Africa, currently the only legally binding act applicable is the 1998 [https://www.compcom.co.za/wp-content/uploads/2021/03/Competition-Act-A6.pdf Competition Act]. 
However, this Act has been criticized for not being sufficiently equipped to handle uncompetitive practices in the digital sphere, including the acts of powerful platforms. In applying the Act to these circumstances, there are various other shortcomings. For instance, it does not provide clear mandates and roles to statutory bodies, like the Competition Commission, to offer remedies to consumers who have been subject to vulnerabilities stemming from the acts of platforms and other actors in the digital space. To highlight the drawbacks of the Act in applying to platforms, algorithmic price discrimination can be taken as an example. At the time when the Act was passed, algorithmic price discrimination did not exist, explaining the lack of reference to it. The lack of such a reference perpetuates uncertainty as to how it should be regulated and tackled by competition authorities in South Africa. These uncertainties disturb the proper functioning of competition authorities in carrying out their functions in combating and dealing with any kind of uncompetitive [https://www.compcom.co.za/wp-content/uploads/2025/09/Competition-Law-in-uncertain-times-The-rise-of-Digitalization.pdf conduct]. 

==== '''Inquiries and Preliminary Report ''' ====
While the Competition Act may not explicitly refer to digital markets and powerful players on said markets, South African competition authorities alternatively rely on market inquiries to intervene in digital markets. Market inquiries are essentially studies of the state of the market, investigating various aspects such as ‘the general state of competition, the levels of concentration in and structure of a market for particular goods of services. The inquiries are referred to as being proactive as they seek to improve competition, instead of reacting and trying to address abusive conduct. The inquiries are concluded with a binding remedial action and recommendations to the government on any changes which should be adopted. These are considered effective as they produce ‘tangible solutions’ to address structural barriers, in comparison to targeted enforcement where only specific actions are being tackled. The inquiries find their legal basis in Chapter 4A of the Competition Act, setting out the procedures, timelines and responsibilities attached to them. Either the Competition Commission or the Ministry of Trade, Industry and Competition can initiate an inquiry if there are suspicions of market distortion. Interestingly, there is a lower threshold for proving adverse effects on competition in comparison to other enforcement tools (which are effective for traditional competition issues). Inquires can consider public interest factors, for example requiring the Commission to assess how anti competitive effects can affect SMEs and businesses owned by historically disadvantaged [https://unctad.org/system/files/non-official-document/ccpb_IGECOM2024_contribution_digital_markets_SA_en_0.pdf persons] (HDP). The most prominent inquiry was back in 2023, known as the [https://www.compcom.co.za/online-intermediation-platforms-market-inquiry/ Online Intermediation Platforms Market Inquiry]. This inquiry was launched upon concerns that certain intermediation platforms impeded or restricted competition by limiting the participation of SMEs and HDP participation, aiming to assess the competition dynamics. The final report concluded that SME and HDP participation was significantly constrained by anti-competitive practices of large platforms. Some anticompetitive conducts included price parity clauses, self preferencing, and a lack of transparency in paid search. Binding remedial actions were imposed on various platforms, such as Google, Apple, Booking.com, Uber Eats and Bolt [https://www.compcom.co.za/wp-content/uploads/2023/07/CC_OIPMI-Summary-of-Findings-and-Remedial-action.pdf Food]. For example Google has to add a South African badge and search filter to ease users in finding and supporting South African platforms. Furthermore, Google needs to provide training and 100 million Rand in advertising credits to smaller South African platforms. Additionally, Google is to implement the same changes it makes in Europe to prevent [https://www.bricscompetition.org/news/south-africas-regulator-published-its-final-report-on-online-intermediation-market-inquiry self-preferencing]. 
==== African Union Protocol ====
The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Protocol to the Agreement Establishing the African Continental Free Trade Area on Competition Policy] was agreed by the African Union in 2023. 
The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf key aims of the protocol] are to provide for an “integrated and unified African continental competition” and “manage the interrelationships of competition regimes and sectoral regulatory laws at the national, regional, and continental levels”. It borrows the terminology of ‘gatekeeper’ from DMA.
[https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Part II of the Protocol] outlines the anti-competitive business practices and conduct being “incompatible with the proper functioning of the Market”, such as collusion, abuse of a dominant position, mergers and acquisitions preventing market competition, price fixing, and bid-rigging among others.It is [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf prohibited for an undertaking or a group of undertakings or gatekeepers] to abuse the relative position of economic dependence over a customer or supplier if the conduct substantially affects the functioning and structure of competition in the market.
The [https://static.pmg.org.za/250903_Ratification_AfCFTA_Protocols.pdf latest status on the ratification process of the protocol] at the time of writing, was that it has not yet been signed by the required 23 or more member states and is therefore not yet in force.
''''''
==== Comparison with EU legislation and Appropriateness ====
In line with Anu Bradford’s claim that the “EU remains an influential superpower that shapes the world in its image”, the influence of European legislation on South Africa and the wider continent is apparent and the Brussels Effect seems to be in full swing.
Bauer and Pandya argue however that the adoption of the essence of foreign regulations, namely the EU’s DMAt is a marked shift away from the “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. principles of traditional competition regulation]”. 
A criticism of the market inquiry approach is the identification of market leaders as competitive distortion. What is missing however to substantiate this claim, are the formal findings of dominance. Where the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng DMA outlines prerequisites] to be established as dominant (i.e. annual turnover, market capitalisation, active (business) users), this is absent in the inquiry. 
A further criticism of relying on the EU regulation or any other as they were, is a way to regulate for “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. hypothetical risks while ignoring tangible consumer benefits]”. 
Where the inquiry leaves the alignment with the DMA behind is its proposed interventions, which [https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. Bauer and Pandya ] describe as “heavy-handed”. The interventions can potentially more closely be described as “market engineering”, with suggestions of providing free advertising space to rivals, artificially boosting local competitors in search rankings and subsidising rivals.
''''''
==== Outlook, recommendations, and how to get it right for South Africa ====
In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,
[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase] outlines the shortcomings of borrowing from other legislations.

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach] for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step] should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal. There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 4: Power

2025-11-26T18:50:08Z

NadineWalsh: /* African Union Protocol */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
==== '''Competition Act''' ====
When considering the regulation of platform power in South Africa, currently the only legally binding act applicable is the 1998 [https://www.compcom.co.za/wp-content/uploads/2021/03/Competition-Act-A6.pdf Competition Act]. However, this Act has been criticized for not being sufficiently equipped to handle uncompetitive practices in the digital sphere, including the acts of powerful platforms. In applying the Act to these circumstances, there are various other shortcomings. For instance, it does not provide clear mandates and roles to statutory bodies, like the Competition Commission, to offer remedies to consumers who have been subject to vulnerabilities stemming from the acts of platforms and other actors in the digital space. To highlight the drawbacks of the Act in applying to platforms, algorithmic price discrimination can be taken as an example. At the time when the Act was passed, algorithmic price discrimination did not exist, explaining the lack of reference to it. The lack of such a reference perpetuates uncertainty as to how it should be regulated and tackled by competition authorities in South Africa. These uncertainties disturb the proper functioning of competition authorities in carrying out their functions in combating and dealing with any kind of uncompetitive [https://www.compcom.co.za/wp-content/uploads/2025/09/Competition-Law-in-uncertain-times-The-rise-of-Digitalization.pdf conduct]. 
==== '''Inquiries and Preliminary Report ''' ====
While the Competition Act may not explicitly refer to digital markets and powerful players on said markets, South African competition authorities alternatively rely on market inquiries to intervene in digital markets. Market inquiries are essentially studies of the state of the market, investigating various aspects such as ‘the general state of competition, the levels of concentration in and structure of a market for particular goods of services. The inquiries are referred to as being proactive as they seek to improve competition, instead of reacting and trying to address abusive conduct. The inquiries are concluded with a binding remedial action and recommendations to the government on any changes which should be adopted. These are considered effective as they produce ‘tangible solutions’ to address structural barriers, in comparison to targeted enforcement where only specific actions are being tackled. The inquiries find their legal basis in Chapter 4A of the Competition Act, setting out the procedures, timelines and responsibilities attached to them. Either the Competition Commission or the Ministry of Trade, Industry and Competition can initiate an inquiry if there are suspicions of market distortion. Interestingly, there is a lower threshold for proving adverse effects on competition in comparison to other enforcement tools (which are effective for traditional competition issues). Inquires can consider public interest factors, for example requiring the Commission to assess how anti competitive effects can affect SMEs and businesses owned by historically disadvantaged [https://unctad.org/system/files/non-official-document/ccpb_IGECOM2024_contribution_digital_markets_SA_en_0.pdf persons] (HDP). The most prominent inquiry was back in 2023, known as the [https://www.compcom.co.za/online-intermediation-platforms-market-inquiry/ Online Intermediation Platforms Market Inquiry]. This inquiry was launched upon concerns that certain intermediation platforms impeded or restricted competition by limiting the participation of SMEs and HDP participation, aiming to assess the competition dynamics. The final report concluded that SME and HDP participation was significantly constrained by anti-competitive practices of large platforms. Some anticompetitive conducts included price parity clauses, self preferencing, and a lack of transparency in paid search. Binding remedial actions were imposed on various platforms, such as Google, Apple, Booking.com, Uber Eats and Bolt [https://www.compcom.co.za/wp-content/uploads/2023/07/CC_OIPMI-Summary-of-Findings-and-Remedial-action.pdf Food]. For example Google has to add a South African badge and search filter to ease users in finding and supporting South African platforms. Furthermore, Google needs to provide training and 100 million Rand in advertising credits to smaller South African platforms. Additionally, Google is to implement the same changes it makes in Europe to prevent [https://www.bricscompetition.org/news/south-africas-regulator-published-its-final-report-on-online-intermediation-market-inquiry self-preferencing]. 
==== African Union Protocol ====
The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Protocol to the Agreement Establishing the African Continental Free Trade Area on Competition Policy] was agreed by the African Union in 2023. 
The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf key aims of the protocol] are to provide for an “integrated and unified African continental competition” and “manage the interrelationships of competition regimes and sectoral regulatory laws at the national, regional, and continental levels”. It borrows the terminology of ‘gatekeeper’ from DMA.
[https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Part II of the Protocol] outlines the anti-competitive business practices and conduct being “incompatible with the proper functioning of the Market”, such as collusion, abuse of a dominant position, mergers and acquisitions preventing market competition, price fixing, and bid-rigging among others.It is [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf prohibited for an undertaking or a group of undertakings or gatekeepers] to abuse the relative position of economic dependence over a customer or supplier if the conduct substantially affects the functioning and structure of competition in the market.
The [https://static.pmg.org.za/250903_Ratification_AfCFTA_Protocols.pdf latest status on the ratification process of the protocol] at the time of writing, was that it has not yet been signed by the required 23 or more member states and is therefore not yet in force.
''''''
==== Comparison with EU legislation and Appropriateness ====
In line with Anu Bradford’s claim that the “EU remains an influential superpower that shapes the world in its image”, the influence of European legislation on South Africa and the wider continent is apparent and the Brussels Effect seems to be in full swing.
Bauer and Pandya argue however that the adoption of the essence of foreign regulations, namely the EU’s DMAt is a marked shift away from the “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. principles of traditional competition regulation]”. 
A criticism of the market inquiry approach is the identification of market leaders as competitive distortion. What is missing however to substantiate this claim, are the formal findings of dominance. Where the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng DMA outlines prerequisites] to be established as dominant (i.e. annual turnover, market capitalisation, active (business) users), this is absent in the inquiry. 
A further criticism of relying on the EU regulation or any other as they were, is a way to regulate for “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. hypothetical risks while ignoring tangible consumer benefits]”. 
Where the inquiry leaves the alignment with the DMA behind is its proposed interventions, which [https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. Bauer and Pandya ] describe as “heavy-handed”. The interventions can potentially more closely be described as “market engineering”, with suggestions of providing free advertising space to rivals, artificially boosting local competitors in search rankings and subsidising rivals.
''''''
==== Outlook, recommendations, and how to get it right for South Africa ====
In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,
[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase] outlines the shortcomings of borrowing from other legislations.

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach] for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step] should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal. There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 4: Power

2025-11-19T15:04:10Z

NadineWalsh: /* South Africa */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
==== '''Competition Act''' ====
When considering the regulation of platform power in South Africa, currently the only legally binding act applicable is the 1998 [https://www.compcom.co.za/wp-content/uploads/2021/03/Competition-Act-A6.pdf Competition Act]. However, this Act has been criticized for not being sufficiently equipped to handle uncompetitive practices in the digital sphere, including the acts of powerful platforms. In applying the Act to these circumstances, there are various other shortcomings. For instance, it does not provide clear mandates and roles to statutory bodies, like the Competition Commission, to offer remedies to consumers who have been subject to vulnerabilities stemming from the acts of platforms and other actors in the digital space. To highlight the drawbacks of the Act in applying to platforms, algorithmic price discrimination can be taken as an example. At the time when the Act was passed, algorithmic price discrimination did not exist, explaining the lack of reference to it. The lack of such a reference perpetuates uncertainty as to how it should be regulated and tackled by competition authorities in South Africa. These uncertainties disturb the proper functioning of competition authorities in carrying out their functions in combating and dealing with any kind of uncompetitive [https://www.compcom.co.za/wp-content/uploads/2025/09/Competition-Law-in-uncertain-times-The-rise-of-Digitalization.pdf conduct]. 
==== '''Inquiries and Preliminary Report ''' ====
While the Competition Act may not explicitly refer to digital markets and powerful players on said markets, South African competition authorities alternatively rely on market inquiries to intervene in digital markets. Market inquiries are essentially studies of the state of the market, investigating various aspects such as ‘the general state of competition, the levels of concentration in and structure of a market for particular goods of services. The inquiries are referred to as being proactive as they seek to improve competition, instead of reacting and trying to address abusive conduct. The inquiries are concluded with a binding remedial action and recommendations to the government on any changes which should be adopted. These are considered effective as they produce ‘tangible solutions’ to address structural barriers, in comparison to targeted enforcement where only specific actions are being tackled. The inquiries find their legal basis in Chapter 4A of the Competition Act, setting out the procedures, timelines and responsibilities attached to them. Either the Competition Commission or the Ministry of Trade, Industry and Competition can initiate an inquiry if there are suspicions of market distortion. Interestingly, there is a lower threshold for proving adverse effects on competition in comparison to other enforcement tools (which are effective for traditional competition issues). Inquires can consider public interest factors, for example requiring the Commission to assess how anti competitive effects can affect SMEs and businesses owned by historically disadvantaged [https://unctad.org/system/files/non-official-document/ccpb_IGECOM2024_contribution_digital_markets_SA_en_0.pdf persons] (HDP). The most prominent inquiry was back in 2023, known as the [https://www.compcom.co.za/online-intermediation-platforms-market-inquiry/ Online Intermediation Platforms Market Inquiry]. This inquiry was launched upon concerns that certain intermediation platforms impeded or restricted competition by limiting the participation of SMEs and HDP participation, aiming to assess the competition dynamics. The final report concluded that SME and HDP participation was significantly constrained by anti-competitive practices of large platforms. Some anticompetitive conducts included price parity clauses, self preferencing, and a lack of transparency in paid search. Binding remedial actions were imposed on various platforms, such as Google, Apple, Booking.com, Uber Eats and Bolt [https://www.compcom.co.za/wp-content/uploads/2023/07/CC_OIPMI-Summary-of-Findings-and-Remedial-action.pdf Food]. For example Google has to add a South African badge and search filter to ease users in finding and supporting South African platforms. Furthermore, Google needs to provide training and 100 million Rand in advertising credits to smaller South African platforms. Additionally, Google is to implement the same changes it makes in Europe to prevent [https://www.bricscompetition.org/news/south-africas-regulator-published-its-final-report-on-online-intermediation-market-inquiry self-preferencing]. 
==== '''African Union Protocol''' ====
The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Protocol to the Agreement Establishing the African Continental Free Trade Area on Competition Policy] was agreed by the African Union in 2023. The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf key aims of the protocol] are to provide for an “integrated and unified African continental competition” and “manage the interrelationships of competition regimes and sectoral regulatory laws at the national, regional, and continental levels”. It borrows the terminology of ‘gatekeeper’ from DMA.

[https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Part II of the Protocol] outlines the anti-competitive business practices and conduct being “incompatible with the proper functioning of the Market”, such as collusion, abuse of a dominant position, mergers and acquisitions preventing market competition, price fixing, and bid-rigging among others.It is [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf prohibited for an undertaking or a group of undertakings or gatekeepers] to abuse the relative position of economic dependence over a customer or supplier if the conduct substantially affects the functioning and structure of competition in the market.The [https://static.pmg.org.za/250903_Ratification_AfCFTA_Protocols.pdf latest status on the ratification process of the protocol] at the time of writing, was that it has not yet been signed by the required 23 or more member states and is therefore not yet in force.

==== '''Comparison with EU legislation and Appropriateness''' ====In line with Anu Bradford’s claim that the “EU remains an influential superpower that shapes the world in its image”, the influence of European legislation on South Africa and the wider continent is apparent and the Brussels Effect seems to be in full swing.Bauer and Pandya argue however that the adoption of the essence of foreign regulations, namely the EU’s DMAt is a marked shift away from the “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. principles of traditional competition regulation]”. A criticism of the market inquiry approach is the identification of market leaders as competitive distortion. What is missing however to substantiate this claim, are the formal findings of dominance. Where the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng DMA outlines prerequisites] to be established as dominant (i.e. annual turnover, market capitalisation, active (business) users), this is absent in the inquiry. A further criticism of relying on the EU regulation or any other as they were, is a way to regulate for “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. hypothetical risks while ignoring tangible consumer benefits]”. Where the inquiry leaves the alignment with the DMA behind is its proposed interventions, which [https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. Bauer and Pandya ] describe as “heavy-handed”. The interventions can potentially more closely be described as “market engineering”, with suggestions of providing free advertising space to rivals, artificially boosting local competitors in search rankings and subsidising rivals.

==== '''Outlook, recommendations, and how to get it right for South Africa''' ====In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,

[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase] outlines the shortcomings of borrowing from other legislations.

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach] for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step] should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal. There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 4: Power

2025-11-13T19:13:40Z

NadineWalsh: /* South Africa */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
'''African Union Protocol'''
The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Protocol to the Agreement Establishing the African Continental Free Trade Area on Competition Policy] was agreed by the African Union in 2023. 
The [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf key aims of the protocol] are to provide for an “integrated and unified African continental competition” and “manage the interrelationships of competition regimes and sectoral regulatory laws at the national, regional, and continental levels”. It borrows the terminology of ‘gatekeeper’ from DMA.
[https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Part II of the Protocol] outlines the anti-competitive business practices and conduct being “incompatible with the proper functioning of the Market”, such as collusion, abuse of a dominant position, mergers and acquisitions preventing market competition, price fixing, and bid-rigging among others.It is [https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf prohibited for an undertaking or a group of undertakings or gatekeepers] to abuse the relative position of economic dependence over a customer or supplier if the conduct substantially affects the functioning and structure of competition in the market.
The [https://static.pmg.org.za/250903_Ratification_AfCFTA_Protocols.pdf latest status on the ratification process of the protocol] at the time of writing, was that it has not yet been signed by the required 23 or more member states and is therefore not yet in force.

==== '''Comparison with EU legislation and Appropriateness''' ====
In line with Anu Bradford’s claim that the “EU remains an influential superpower that shapes the world in its image”, the influence of European legislation on South Africa and the wider continent is apparent and the Brussels Effect seems to be in full swing.
Bauer and Pandya argue however that the adoption of the essence of foreign regulations, namely the EU’s DMAt is a marked shift away from the “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. principles of traditional competition regulation]”. 
A criticism of the market inquiry approach is the identification of market leaders as competitive distortion. What is missing however to substantiate this claim, are the formal findings of dominance. Where the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng DMA outlines prerequisites] to be established as dominant (i.e. annual turnover, market capitalisation, active (business) users), this is absent in the inquiry. 
A further criticism of relying on the EU regulation or any other as they were, is a way to regulate for “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. hypothetical risks while ignoring tangible consumer benefits]”. 
Where the inquiry leaves the alignment with the DMA behind is its proposed interventions, which [https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. Bauer and Pandya ] describe as “heavy-handed”. The interventions can potentially more closely be described as “market engineering”, with suggestions of providing free advertising space to rivals, artificially boosting local competitors in search rankings and subsidising rivals.

==== '''Outlook, recommendations, and how to get it right for South Africa''' ====
In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,
[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase] outlines the shortcomings of borrowing from other legislations.

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach] for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step] should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal. There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 4: Power

2025-11-13T19:11:23Z

NadineWalsh: /* South Africa */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
'''African Union Protocol'''The[https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Protocol to the Agreement Establishing the African Continental Free Trade Area on Competition Policy]was agreed by the African Union in 2023. The[https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf key aims of the protocol]are to provide for an “integrated and unified African continental competition” and “manage the interrelationships of competition regimes and sectoral regulatory laws at the national, regional, and continental levels”. It borrows the terminology of ‘gatekeeper’ from DMA.[https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf Part II of the Protocol]outlines the anti-competitive business practices and conduct being “incompatible with the proper functioning of the Market”, such as collusion, abuse of a dominant position, mergers and acquisitions preventing market competition, price fixing, and bid-rigging among others.It is[https://au.int/sites/default/files/treaties/45080-treaty-EN_AfCFTA_Protocol_on_Competition_Policy.pdf prohibited for an undertaking or a group of undertakings or gatekeepers]to abuse the relative position of economic dependence over a customer or supplier if the conduct substantially affects the functioning and structure of competition in the market.The[https://static.pmg.org.za/250903_Ratification_AfCFTA_Protocols.pdf latest status on the ratification process of the protocol]at the time of writing, was that it has not yet been signed by the required 23 or more member states and is therefore not yet in force.
==== '''Comparison with EU legislation and Appropriateness''' ====
In line with Anu Bradford’s claim that the “EU remains an influential superpower that shapes the world in its image”, the influence of European legislation on South Africa and the wider continent is apparent and the Brussels Effect seems to be in full swing.
Bauer and Pandya argue however that the adoption of the essence of foreign regulations, namely the EU’s DMAt is a marked shift away from the “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. principles of traditional competition regulation]”. 
A criticism of the market inquiry approach is the identification of market leaders as competitive distortion. What is missing however to substantiate this claim, are the formal findings of dominance. Where the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng DMA outlines prerequisites] to be established as dominant (i.e. annual turnover, market capitalisation, active (business) users), this is absent in the inquiry. 
A further criticism of relying on the EU regulation or any other as they were, is a way to regulate for “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. hypothetical risks while ignoring tangible consumer benefits]”. 
Where the inquiry leaves the alignment with the DMA behind is its proposed interventions, which [https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. Bauer and Pandya ] describe as “heavy-handed”. The interventions can potentially more closely be described as “market engineering”, with suggestions of providing free advertising space to rivals, artificially boosting local competitors in search rankings and subsidising rivals.

==== '''Outlook, recommendations, and how to get it right for South Africa''' ====
In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,
[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase] outlines the shortcomings of borrowing from other legislations.

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach] for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step] should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal. There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 4: Power

2025-11-13T19:10:57Z

NadineWalsh: /* Comparison with EU legislation and Appropriateness */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
==== '''Comparison with EU legislation and Appropriateness''' ====
In line with Anu Bradford’s claim that the “EU remains an influential superpower that shapes the world in its image”, the influence of European legislation on South Africa and the wider continent is apparent and the Brussels Effect seems to be in full swing.
Bauer and Pandya argue however that the adoption of the essence of foreign regulations, namely the EU’s DMAt is a marked shift away from the “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. principles of traditional competition regulation]”. 
A criticism of the market inquiry approach is the identification of market leaders as competitive distortion. What is missing however to substantiate this claim, are the formal findings of dominance. Where the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng DMA outlines prerequisites] to be established as dominant (i.e. annual turnover, market capitalisation, active (business) users), this is absent in the inquiry. 
A further criticism of relying on the EU regulation or any other as they were, is a way to regulate for “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. hypothetical risks while ignoring tangible consumer benefits]”. 
Where the inquiry leaves the alignment with the DMA behind is its proposed interventions, which [https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. Bauer and Pandya ] describe as “heavy-handed”. The interventions can potentially more closely be described as “market engineering”, with suggestions of providing free advertising space to rivals, artificially boosting local competitors in search rankings and subsidising rivals.

==== '''Outlook, recommendations, and how to get it right for South Africa''' ====
In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,
[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase] outlines the shortcomings of borrowing from other legislations.

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach] for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step] should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal. There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 4: Power

2025-11-13T19:10:08Z

NadineWalsh: /* South Africa */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
==== '''Comparison with EU legislation and Appropriateness''' ====
In line with Anu Bradford’s claim that the “EU remains an influential superpower that shapes the world in its image”, the influence of European legislation on South Africa and the wider continent is apparent and the Brussels Effect seems to be in full swing.Bauer and Pandya argue however that the adoption of the essence of foreign regulations, namely the EU’s DMAt is a marked shift away from the “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. principles of traditional competition regulation]”. A criticism of the market inquiry approach is the identification of market leaders as competitive distortion. What is missing however to substantiate this claim, are the formal findings of dominance. Where the[https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng DMA outlines prerequisites]to be established as dominant (i.e. annual turnover, market capitalisation, active (business) users), this is absent in the inquiry. A further criticism of relying on the EU regulation or any other as they were, is a way to regulate for “[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. hypothetical risks while ignoring tangible consumer benefits]”. Where the inquiry leaves the alignment with the DMA behind is its proposed interventions, which[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/#:~:text=For%20search%20results%2C%20Google%20is%20required%20to,in%20travel%2Drelated%20searches%20entirely%20free%20of%20charge. Bauer and Pandya ]describe as “heavy-handed”. The interventions can potentially more closely be described as “market engineering”, with suggestions of providing free advertising space to rivals, artificially boosting local competitors in search rankings and subsidising rivals.
==== '''Outlook, recommendations, and how to get it right for South Africa''' ====
In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,
[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase] outlines the shortcomings of borrowing from other legislations.

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach] for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step] should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal. There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 4: Power

2025-11-13T19:08:27Z

NadineWalsh: /* South Africa */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
==== '''Outlook, recommendations, and how to get it right for South Africa''' ====
In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,
[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase] outlines the shortcomings of borrowing from other legislations.

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach] for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].

[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step] should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal. There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 4: Power

2025-11-13T19:06:59Z

NadineWalsh: /* South Africa */

== Regulation of platform power ==
This section is concerned with the concentration of power by large digital platforms in relation to online ecosystems, advertising, and the concentration of data. It examines whether such power is regulated through, for example, competition law or digital markets provisions.
=== European Union ===
==== Introduction ====
Large online platforms concentrate economic and informational power through network effects, data advantages, default settings, and ecosystem control. They often take advantage of their position and superior bargaining power to raise barriers and set unbalanced conditions. That has stifled the market vitality and undermined individual rights including privacy and autonomy. The states have been attempting to address the problem.
==== General View ====
===== Legal Framework =====
Traditionally, the legal framework addressing market power is composed of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016ME%2FTXT-20250315 Treaty on the Functioning of the European Union] (TFEU), [https://eur-lex.europa.eu/eli/reg/2004/139/oj/eng EU Merger Regulation (EC) No 139/2004]. (EUMR), and national competition law. At the EU level, the law imposes prohibitions on anticompetitive coordinated conduct ([https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX%3A12008E101%3AEN%3AHTML TFEU Article 101]), unilateral monopolistic conduct ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A12008E102 TFEU Article 102]), and mergers with significant anticompetitive effects (EUMR). Recently, the [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C_202401645 EU Commission Notice (C/2024/1645)] on the definition of the relevant market for the purposes of Union competition law which recognises multi-sided platforms and digital ecosystems, updating how market power is assessed.
Regarding supervisory procedure and powers, [https://eur-lex.europa.eu/eli/reg/2003/1/oj/eng Council Regulation (EC) No 1/2003] sets up a shared enforcement system between the European Commission and the Member States’ competition authorities.

===== Gaps and Initiatives =====
The legal framework is not effective to handle the new challenges brought by digital platforms, because:-
*Platforms may not fit the characteristics targeted by competition law, thereby limiting its applicability. (DMA Recital 5)
*Competition law is enforced ex post and requires lengthy, complex factual investigation. Final decisions fail to effectively remedy competitive harm and [https://academic.oup.com/jeclap/article/15/4/222/7690940 lose their deterrent effect].
*Divergent regulatory solutions adopted by Member States against platform undertakings result in fragmentation of the internal market. (DMA Recital 6)
*The systemic social risk arising from the powerful platforms (e.g., disinformation) is [https://eur-lex.europa.eu/resource.html?uri=cellar:57a5679e-3f85-11eb-b27b-01aa75ed71a1.0001.02/DOC_1&format=PDF not directly addressed by competition law].
The Court of Justice of the European Union has taken initiative to bridge the gap, recognising new forms of abuse under Article 102 TFEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=289925&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1595695 Case C-48/22 P]) and connecting data protection legality and competition analysis in data-driven platform markets ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=2017287 Case C-252/21]).
Moreover, the EU pairs competition law with two new instruments: the [https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Markets Act] (DMA) and the [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Services Act] (DSA). The two acts target an overlapping set of entities (i.e., gatekeepers vs. very large online platforms). They tackle different issues (economic vs. social), but in a number of areas (e.g., online advertising) impose complementary obligations. Notably, the enforcement power under the DMA and that over very large online platforms/search engines under the DSA both belong to the European Commission. (DMA Article 38(7), Recital 91; DSA Articles 66, 74). 

==== Digital Markets Act (DMA) ====
The DMA does not replace competition law but complements it from following perspectives:-
*Purpose. The DMA seeks to ensure contestability and fairness in the digital sector. Although unfairness makes the market less contestable, fairness is not an objective of competition law. (Recitals 33, 34)
*Scope. The DMA applies to gatekeepers, covering undertakings with significant power but not addressed by competition law. (Article 3(1))
*Method. The DMA shifts from ex post application toward [https://academic.oup.com/jcle/article/20/1-2/1/7513584?login=false ex ante regulation], with clear and predetermined rules leading to procedural efficiency. 

===== Scope =====
The DMA applies to gatekeepers, i.e. undertakings having a significant impact, providing core platform service (CPS) to EU users, and enjoying an entrenched and durable position. (Articles 1, 3(1)) CPSs include typical digital services including intermediation, search engine, social network, operating system, number-independent interpersonal communications services (NIICS), online advertising, etc. (Article 2(2))
Quantitative criteria are adopted to simplify gatekeeper identification, presuming the fulfillment of three requirements. Significant impact is presumed based on annual turnover or market capitalization. Important gateway role requires meeting user thresholds. Entrenched and durable position is presumed if user thresholds were met in each of the last three financial years. (Articles 3(2)) To rebut the presumptions, the designated undertaking bears the burden of proof; only elements directly related to the quantitative criteria should be considered. (Article 3(5), Recital 23, [https://eur-lex.europa.eu/eli/C/2024/5325/oj/eng#:~:text=Case%20T-1077%2F23%3A%20Judgment%20of%20the%20General%20Court%20of,%E2%80%93%20Rights%20of%20the%20defence%20%E2%80%93%20Equal%20treatment%29 Case T-1077/23]).

===== Core Obligations =====
The DMA provides a menu of core obligations in Articles 5, 6 and 7. These rules have per se character, i.e., engaging in any conduct described therein is illegal as such. There is [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 no need to prove] the conduct is likely to exclude competitors or impact consumer welfare.
The rules exhibit different plasticity. Article 5 rules must be complied immediately as being clear enough to allow gatekeepers to abide by [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4395089 without further guidance from the Commission]. On the other hand, Articles 6 and 7 rules are calibratable (Article 8(2)), allowing the Commission to [https://academic.oup.com/jcle/article/20/1-2/1/7513584 specify to ensure effectiveness and proportionality].
Article 5 concerns:-
*Data-related restrictions, i.e., prohibition of processing, combining, or cross-using personal data without user consent. (Article 5(2))
*User substantive rights, specifically freedom of business promotion, contact and contract, and access to external content or function. (Articles 5(3), 5(4), 5(5))
*User procedural right, specifically freedom to raise non-compliance issues with public authorities. (Article 5(6))
*Prohibition on tying, including typing of ancillary services and of CPSs. ((Articles 5(7), 5(8))
*Transparency regarding advertising service, i.e., disclosure of key service conditions to advertisers and publishers. (Articles 5(9), 5(10))
Article 6 concerns:-
*Data and transparency, including prohibition on using competitor’s non-public data to favor themselves, disclosure of measuring tools and data to advertisers and publishers, data portability for end users, data access for business users, and data access for competing search engines. (Articles 6(2), 6(8), 6(9), 6(10), 6(11))
*End-user choice and control, including easy uninstallation of software and change to default settings, freedom to install third-party apps and use third party stores, and freedom to switch between apps and subscribe to available services. (Articles 6(3), 6(4), 6(6))
*Platform neutrality and fair terms, covering prohibition of self-preferencing, interoperability for competitors and business users, Fair, Reasonable, and Non-Discriminatory (FRAND) general access conditions, and prohibition on disproportionate contract termination conditions. (Articles 6(5), 6(7), 6(12), 6(13))
Article 7 concerns interoperability for NIICS. Gatekeepers shall make the basic functionalities of its NIICS interoperable with such service provided by another. To balance against security, only basic interoperability is required and could be achieved in stages. (Recital 64)

===== Merger Control Facilitation =====
Acquisitions of start-ups by gatekeepers frequently [https://op.europa.eu/en/publication-detail/-/publication/21dc175c-7b76-11e9-9f05-01aa75ed71a1/language-en escape the jurisdiction of the EUMR] which is based on turnover thresholds. 
To complement the EUMR, Article 14 requires gatekeepers to inform the Commission of any intended concentration, provided either party provides CPS or digital service or enables data collection, no matter if the threshold for notice under the EUMR is met.

==== Digital Services Act (DSA) ====
===== Purpose and Scope =====
The DSA regulates providers of online intermediaries services to improve the functioning of the internal market and ensure a safe, predictable, and trusted online environment. (Article 1(1)) It imposes harmonized rules and due diligence obligations tailored to specific categories of providers of online intermediary services (Article 1(2)(b), 2 (1)), with the heaviest layer of obligations designated for Very Large Online Platforms/Search Engines (VLOPs/VLOSEs). 
Notably, VLOP/VLOSEs are defined by user reach, not by market dominance. (Article 33) The DSA therefore differs from Article 102 of TFEU, as it alters the conditions through which dominance is entrenched by constraining lock-in and enabling auditability. In practice this complements the monopoly lens of competition law with ex ante, design-level governance.

===== Provisions addressing platform power =====
Ex-ante transparency duties under the DSA, platforms must disclose how distribution and ranking operate, and generate audit-ready evidence to inform competition analysis without a prior dominance finding:
*The DSA requires transparency reporting from providers on content moderation during the reported period, operates clear notice-and-action mechanisms and issue machine-readable statements of reasons for each restriction or removal, with entries in [https://transparency.dsa.ec.europa.eu/?lang=en DSA Transparency Database]. (Articles 15-17, 24 (5)).
*Platforms must explain in plain language the main parameters of recommender systems and available user controls (Article 27). VLOP/VLOSEs must offer at least one option not based on profiling. (Article 38).
*Transparency reporting is harmonized through common templates and biannual cycles (Article 42), complemented by the [https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng Commission Implementing Regulation (EU) 2024/2835]. 
The DSA imposes ex-ante systemic-risk mitigation duties on VLOPs/VLOSEs and requires testable risk governance and independent audit, complimenting competition analysis by addressing risks arising from platform power:
*The DSA requires VLOPSs/VLOSEs to periodically assess systemic risks arising from the service’s design and operation such as amplification and ranking defaults and to provide proportionate mitigation measures to address those risks. (Articles 34, 35) 
*The DSA provides a crisis-response mechanism for exceptional events that sharply increase systemic risks. (Article 36).
*The DSA mandates annual independent audits with follow-up on findings, and enables vetted researchers to access platform data to study systemic effects, including potential self-preferencing or discriminatory delivery. (Articles 37, 40).

=== Brazil ===
==== Introduction ====
On November 10, 2022, the '''Draft Law No. 2,768/2022''' was [https://www.camara.leg.br/proposicoesWeb/fichadetramitacao?idProposicao=2337417 introduced] in the Brazilian House of Representatives (Chamber of Deputies), proposing ex ante regulatory measures to regulate digital platforms. However, as it is still [https://digitalpolicyalert.org/change/5395-unilateral-conduct-regulation-in-bill-regulating-digital-platforms-pl-27682022 under deliberation], '''Law No. 12,529/2011''', the Competition Law, is the main legislation governing competition in digital markets.
==== Law No. 12,529/2011 ====
Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf structures] the Brazilian System for Protection of Competition (SBDC) and sets forth preventive measures and sanctions for violations against the economic order. It is guided by the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf constitutional principles] of free competition, freedom of initiative, social role of property, consumer protection and prevention of the abuse of economic power.
==== Brazilian System for Protection of Competition ====
The [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf SBDC] is formed by '''(i)''' the Administrative Council for Economic Defense (CADE) and '''(ii)''' the [https://one.oecd.org/document/DAF/COMP/AR(2020)39/en/pdf Secretariat of Competition Advocacy and Competitiveness], linked to the Ministry of Finance.
==== CADE ====
As the Competition Law governs both the prevention and repression of violations against the economic order, CADE, the authority responsible for its enforcement, operates on two main fronts: '''(i)''' concentration control through analysis and decisions on mergers and acquisitions; '''(ii)''' analysis and litigation of anti-competitive practices.
===== Concentration Control =====
Articles 88 to 91 of Law No. 12,529/2011 comprehend provisions on the so-called control of economic concentration, through the analysis of mergers and acquisitions. An [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf act of economic concentration] (generally) is carried out when: '''(i)''' two or more previously independent companies merge; '''(ii)''' one or more companies acquire, directly or indirectly, by purchase or exchange of stocks, shares, bonds or securities convertible into stocks or assets, whether tangible or intangible, by contract or by any other means or way, the control or parts of one or more companies; '''(iii)''' one or more companies incorporate one or more companies; or '''(iv)''' two or more companies enter into an associative contract, consortium or joint venture.Pursuant to Article 88 the parties involved in the act of economic concentration shall submit a ‘premerger notification’ to CADE if certain (cumulative) [https://www.mayerbrown.com/-/media/files/perspectives-events/publications/2012/06/cade-and-ministries-issue-rules-under-the-new-braz/files/update_tandc_cade_resolutions_0612/fileattachment/update_tandc_cade_resolutions_0612.pdf revenue criterias] are met: '''(i)''' at least one of the groups involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent or superior to seven hundred fifty million reais (R $ 750,000,000.00); and '''(ii)''' at least one other group involved in the transaction has registered, in the last balance sheet, annual gross sales or total turnover in the country, in the year preceding the transaction, equivalent to or greater than seventy-five million reais (R $ 75,000,000.00).Accordingly, notifiable acts [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf may not] be consummated before being reviewed.The review of an act of economic concentration may be carried out either '''(i)''' in the [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf ordinary procedure], which (generally) shall be performed within, at the latest, 240 days, as of the application protocol or amendment thereto, or '''(ii)''' in the [https://www.in.gov.br/web/dou/-/resolucao-cade-n-33-de-14-de-abril-de-2022-394063356 fast-track procedure]—depending on the convenience and opportunity, based on the experience acquired by the bodies comprising the SBDC in the analysis of mergers and in the identification of those that have less potential to violate competition.The opinion to be issued by CADE may follow three different directions of recommendation: '''(i)''' approval of the transaction, without any restrictions; '''(ii)''' approval of the transaction, conditional upon structural or behavioral restrictions, such as, but not limited to: divestment of assets, assumption of access obligations and non-discrimination of competitors, among other antitrust remedies; '''(iii)''' total ‘rejection’ of the transaction (veto).
===== Violations of the Economic Order =====
Article 36 of Law No. 12,529/2011 [https://cdn.cade.gov.br/portal-ingles/topics/legislation/internal-regulation/Internal%20Regulation%20of%20the%20Administrative%20Council%20for%20Economic%20Defese–RICADE.pdf establishes] that a conduct is considered a violation to the economic order whenever it has as objective or may have the following effects, regardless of fault, even if not achieved: '''(i)''' limit, restrain, or in any way injure free competition; '''(ii)''' control relevant markets for goods and services; '''(iii)''' arbitrarily increase profits; and '''(iv)''' exercise a dominant position abusively.§ 3 of Article 36 presents an exemplificative—and not exhaustive—list of practices that are deemed as violations to the economic order, among these the following may be mentioned:

creation of mechanisms to exclude competitors;
resale price fixing;
territorial and customer base restrictions;
predatory pricing;
tie-in arrangements;
price discrimination;
market closing;
cartel.At the administrative level, conducts considered as violations to the economic order result in the following [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf penalties]: '''(i)''' in the case of a company, a fine of 0.1 % to 20 % of gross sales, in the last fiscal year before proceedings, in the business field in which the violation occurred, not less than the benefit gained (if estimable); '''(ii)''' in the case of other individuals or legal entities, where the gross sales criterion is not applicable, a fine between R $ 50,000 and R $ 2,000,000,000; '''(iii)''' if an administrator is responsible for the violation, a fine of 1 % to 20 % of that applied to the company or the legal entity (see above).In case of [https://cdn.cade.gov.br/portal-ingles/topics/legislation/laws/LAW%20Nº%2012529%202011%20%28English%20version%20from%2018%2005%202012%29.pdf recurrence], the fines may be doubled.In addition to that, Article 38 establishes non-financial penalties and Law No. 12,529/2011, as amended by Law No. 14,470/2022, the right to double compensation for those that prove that they have been harmed by a conduct characterized as a violation to the economic order, in return for damage suffered as a result of the violations.Furthermore, Article 85 provides that CADE may, under certain circumstances, obtain from the defendant a ‘cease-and-desist commitment’ related to the practice under investigation or its harmful effects, if duly grounded, for convenience and at the proper time, and if it understands that it complies with the interests protected by law.
===== CADE’s Case Law on Digital Markets =====
In ''Naspers/Delivery Hero'' (2018), a horizontal merger case, which lead to the consolidation of iFood as Brazil’s leading online restaurant delivery platform, CADE restricted the  market definition to the online segment cleared the merger despite the applicants’ high market share, because there was a reasonable expectation for increasing rivalry in this incipient, innovative industry. However, later events, such as UberEats exiting the market and iFood’s exclusive practices, showed this expectation may have been overly optimistic.In ''Mosico/Buascapé'' (2019), a horizontal transaction between price comparison and web advertising platforms, the CADE was cautious in defining the affected market because of the two-sided-platform business models and rapidly evolving digital markets. Thus, it adopted a flexible approach by referring to the former Commissioner Bandeira Maia’s 2019 opinion in the ''Google Shopping'' conduct investigation, in the sense that in dynamic industries, relevant market definition should be taken as ‘an auxiliary guidance’ and not seen ‘as an end in itself’, indicating that market argents should not expect strict relevant market definition to shield potentially anticompetitive effects of mergers or conduct from the authority’s scrutiny.Finally, in ''Viação Águia Branca/JCA'' (2023), a joint venture between passenger intercity bus companies, which offered logistical services to operators while serving passengers directly, the CADE imposed because of the dual-sided business model behavioral remedies to mitigate anti-competitive risks (e.g. pre-approval for future partnerships and bans on specific routes).In conclusion, CADE demonstrates an increased interest in promoting competition enforcement in digital markets, indicating no need for legislative changes to address digital economy challenges. Instead, it is increasingly applying available procedural and substantive tools, such as interim measures and settlements.
==== The Draft Bill No. 2,768/2022 ====
In its Article 1, the Bill establishes provisions for the regulation, supervision, and sanctioning of digital platforms—particularly those with power to control essential access—providing services to the Brazilian public.In contrast to Law No. 12,529/2011, [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 enforcement] of the Draft Bill No. 2,768/2022 will be the responsibility of the National Telecommunications Agency (ANATEL), traditionally charged with regulating telecommunications service providers, rather than the CADE.Article 4 of the Draft Bill No. 2,768/2022 providing the objectives of this, is reminiscent of Article 170 of the Constitution of the Federative Republic of Brazil (see above).Article 5 of the Draft Bill No. 2,768/2022 establishes (vague) requirements that apply to all digital platforms, which are defined in Article 6(2), regardless of whether they hold power to control essential access or not (e.g. ‘fair competition’).Pursuant to Article 9, digital platforms shall be considered to have ‘power to essential access control’ when they generate an annual operating revenue of at least R $ 70,000,000.00 from offering services to the Brazilian public.As a result of this categorisation, the platforms in question are subject to various [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 obligations]: '''(i)''' transparency and provision of information; '''(ii)''' isonomic and non-discriminatory treatment in the provision of professional users and end users; '''(iii)''' appropriate use of the data collected in the exercise of its activities; and '''(iv)''' not refusing to provide access to the digital platform to professional users.In addition, these platforms are required to pay an [https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=2214237&filename=PL%202768/2022 inspection fee] corresponding to 2 % of their yearly gross operating revenue.Furthermore, the ANATEL has the authority to prohibit certain conducts and impose a fine of up to 2 % of the revenue in the last fiscal year on platforms that violate the rules set out in the Draft Bill No. 2,768/2022.Lastly, Article 13 appears to establish an exception to the limitations on CADE’s authority by referring to CADE’s jurisdiction in cases of acts of economic concentration involving digital platforms. However, one must consider this provision in the context of the revised wording of the General Telecommunications Law, empowering ANATEL to ‘exercise legal authority in relation to digital platforms, specifically in the areas of control, prevention and suppression of violations of the economic order’. Therefore, the compatibility between CADE's competition law enforcement and ANATEL's implementation of the Draft Bill No. 2,768/2022 might raise some doubts.
=== China ===
==== Anti-Monopoly Law (2008) ====
===== Historical context =====
<div style="font-weight: 400;">In the People’s Republic of China, the main legislative framework is the Anti-Monopoly Law (AML), which was introduced in August of 2007 and entered into force in 2008 ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). While it was China’s first real competition law, it came a little late to the scene compared to other jurisdictions. Most of the AML’s concepts and definitions are based on the EU’s competition regulatory framework. The AML’s main purpose was to address the steep market barriers and discouragement of competition by powerful state-owned enterprises (SOEs). These SOEs often engaged in harmful behavior for their competitors and consumers alike. The 2008 AML drove industrial innovation, reformed supply-side transactions and supported the emerging platform economy (especially the e-commerce sector) ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox#heading-1 source]). </div><div style="font-weight: 400;">First case of private competition litigation (2014) </div><div style="font-weight: 400;">An important indication that China’s traditional, protectionist, and socialist economical model was becoming more competitive was the ''Qihoo 360 v. Tencent ''case. Qihoo 360 – China’s leading anti-virus software company – alleged that Tencent – China's largest social media and gaming company – bundled their anti-virus software with it’s social media services, resulting in an abuse of their dominant position. While both the lower court and the appeals court dismissed Qihoo 360’s claim, this case was a milestone in Chinese antitrust. The vast amount of economic evidence presented by both sides makes it an valuable jurisprudential source for competition law. More importantly, this case marks the first time that private companies engage in litigation with one another over antitrust practices. Before this 2014 case, most antitrust cases were brought by enforcement authorities and involved abuses of power by SOEs ([https://en.wikipedia.org/wiki/360_v._Tencent source]). </div>
===== Enforcement =====
<div style="font-weight: 400;">Three separate authorities were responsible for the regulatory enforcement of the AML: the Ministry of Commerce, the National Development and Reform Commission (NDRC) and the State Administration for Industry and Commerce (SAIC). While the Ministry of Commerce handled regulated mergers, the latter two oversaw antitrust investigations. These three entities were ironically, often in regulatory competition with each other. This regulatory overlap and fragmentation was addressed in 2018, when the State Administration for Market Regulation (SAMR) was created. Today, the SAMR is China’s primary competition authority, although it does share some overlap with the NDRC and the Ministry of Industry and Information Technology (source: Zhang, Angela Huyue (2024). High Wire: How China Regulates Big Tech and Governs Its Economy. Oxford University Press. doi:10.1093/oso/9780197682258.001.0001, p.23). The SAMR is subject to the guidance of the Anti-Monopoly Commission, which sets up the competition policies and enforcement coordination, and which, in turn, reports to the State Council of China ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). </div>
===== Changing economic landscape =====
<div style="font-weight: 400;">From 2018 to 2022, some major developments shaped the Chinese economic and competition landscape. Concerns were raised around 2018 about the rapid growth, the size and negative effects on competition of e-commerce platforms like Alibaba, which filled the vacuum that the regulation of SOEs left in the economy. Alibaba and Meitan were fined for respectively 18 billion and 700 million Yuan for abuse of their dominant market position ([https://businesslawreview.uchicago.edu/print-archive/chinese-antitrust-paradox source]). In 2021, China collected was a record amount of fines and ‘confiscations’ for violations of the rules on monopoly agreements and market dominance ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]). </div><div style="font-weight: 400;">In December 2020, the PRC’s government released the draft Guidelines for Anti-monopoly in the Platform Economy to prevent monopolistic behavior, among other things ([https://www.china-briefing.com/news/china-releases-anti-monopoly-guidelines-for-its-platform-economy/ source]). These guidelines were finalized in February 2021, but have been reported to be difficult to implement ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). Still, they provide the SAMR with guidance for enforcement of competition laws in the tech space ([https://www.gibsondunn.com/antitrust-in-china-2021-year-in-review/ source]). The Guidelines were the foundation of the 2022 revision of the AML. They provide some additional factors to be considered when defining the relevant market in the platform economy (e.g. market entry, lock-in effects, or network effects). Moreover, they provide some insight into how the Chinese government aims to tackle data and algorithmic ‘collusion’ as a form of monopoly agreements ([https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source]). 
==== AML Revision in 2022 ====
</div><div style="font-weight: 400;">The AML was revised in 2022. It now includes higher fines for violations, sets out more rules against abuse of market dominance by administrative authorities and it includes specific prohibitions on the use of certain technology for anti-competitive behavior. Additionally, six (draft) provisions were added to the updated 2022. These provisions focus on, among other topics, the abuse of intellectual property rights to exclude and restrict competition, they prohibit monopoly agreements and the abuse of dominant market positions and they aim to suppress abuse of administrative powers to exclude and restrict competition ([https://www.china-briefing.com/news/what-has-changed-in-chinas-amended-anti-monopoly-law/#prohibitionoftechnologytoengageinanticompetitivebehaviorHeader source]). When reading these amendments and updated provisions, it becomes clear that China’s competition enforcement is aimed at curbing the power of tech and platform companies. Before we delve into the more platform and technology specific provisions of the updated AML, let’s discuss the general aim and scope of the law. </div>
===== Scope and definitions =====
<div style="font-weight: 400;">Article 1 states that the AML ''“promulgates to prevent and restrain monopolistic practices, protect fair market competition encourage innovation, enhance economic efficiency, safeguard consumers’ interests and the public interest, and promote the healthy development of the socialist market economy.”'' The law is addressed to 'undertakings' which can be natural or legal persons, or unincorporated organizations that trade or manufacture goods or provide services (Article 15). Interestingly, the AML has an extraterritorial reach since it does not just apply to monopolistic practices in economic activities within China: it also applies to such practices outside of the mainland that ''“eliminate or restrict competition in China’s domestic market”'' (Article 2). ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). Monopolistic practices, then, are defined as to include: i) conclusion of monopoly agreements, ii) abuse of dominant market positions and iii) concentrations of undertakings that may have effect of eliminating or restricting competition (Article 3). Note the use of ‘include’, which implies this list of practices is not exhaustive. 'Monopoly agreements', in turn, are defined in Article 16 as: ''“agreements, decisions or other concerted actions that eliminate or restrict competition.” ''More specifically, Article 17 prohibits competing undertakings to conclude monopoly agreements which:  </div><div style="font-weight: 400;">• fix or change the price of goods;  • limit the quantity of goods manufactured or marketed;  • divide the sales markets or markets for raw materials;  • restrict the purchase of new technology or new equipment or restrict the development of new technology or new product; and  • jointly boycott transactions.
Such monopoly agreements against competitors are often referred to as ‘horizontal’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). While this list may seem exhaustive, Article 17(6) stipulates that other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency are also forbidden. When undertakings are not in competition with one another, they are referred to as ‘counterparties’, and they are still prohibited from entering certain monopoly agreements. Such agreements are ‘vertical’ ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]), and are referred to in Article 18 of the AML as: </div><div style="font-weight: 400;">• those that fix the price of goods resold to a third party  • those that limit the lowest price of goods resold to a third party;   • other monopoly agreements as determined by the State Council anti-monopoly law enforcement agency. </div><div style="font-weight: 400;">However, when such an agreement is not ‘eliminating or restricting competition’, the agreement may still be permitted. This is also the case when the undertakings can show that they are below a certain market threshold. Some other examples of exemptions are mentioned in Article 20. This shows a less stringent regime for vertical monopoly agreements, which is often called a ‘safe harbor’. In March 2023, the SAMR published the final version of four 'Provisions' on 1) merger control review; 2) prohibition of monopoly agreements; 3) prohibition on abuse of dominance; and 4) Prohibition of Elimination and Restriction of Competition through Abuse of Administrative Power ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). However, these provisions do not specify when an undertaking reached the threshold as set out in Article 18. In earlier drafts 15% was proposed, but the SAMR has removed this percentage from the final version of the provisions. This leaves undertakings that want to engage in vertical agreements with many uncertainties.  </div><div style="font-weight: 400;">Another point of note is the AML explicitly aims to combat anti-competitive behavior of administrative organizations or organizations that have been authorized by law for certain public affairs. The prohibition for these organizations to ''“abuse their administrative authority to eliminate or restrict competition”'' is enshrined in Article 10 and Chapter V of the AML (Artt. 39-45) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).  </div><div style="font-weight: 400;">Finally, a 'relevant market' is described in Article 15 as referring to “the range of goods or territories in which undertakings compete for specific goods or services during a certain period of time.” Chapter III sets out the prohibitions and provisions related to abuse of dominant market positions. Such a position is defined as “the market position held by an undertaking that enables it to control the prices or quantities of goods or other trading conditions in the relevant market, or to hinder or affect the ability of other undertakings to enter the relevant market” (Article 22) ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]). More specifically, a dominant market position is presumed when an undertaking controls 50% of the relevant market. For two or undertakings, that should be, respectively, 66,67% and 75% of the relevant market. When it comes to merger and acquisitions control, Chapter IV stipulates the relevant provisions governing the concentrations (mergers and acquisitions) of undertakings. </div>
===== Specific provisions to combat tech and platform power =====
<div style="font-weight: 400;">Article 9 of the AML prohibits undertakings from using “data or algorithms, technology, capital advantages, or platform rules, etc., to engage in the monopolistic practices prohibited by this Law”. Additionally, Article 22 reiterates that an undertaking with a dominant market position cannot use data, algorithms, or anything set out in Article 9 to engage in abuse of their dominant position ([https://www.chinalawtranslate.com/en/anti-monopoly-law-2022/ source]).</div><div style="font-weight: 400;">In these two articles, the AML is incredibly vague on the more technical aspects of platform and tech regulation through the lens of competition law. However, the SAMR’s aforementioned Provisions, published in March 2023, provide more details for interpretation. There are also two sets of Guidelines: the 2021 Guidelines for Anti-Monopoly in the Platform Economy (discussed above) and the 20123 Classification and Responsibility Guidelines.  </div><div style="font-weight: 400;">‘Guidelines’ for Anti-Monopoly in the Platform Economy (2021)</div><div style="font-weight: 400;">The Guidelines prescribe that the relevant market is not always indicative in the platform economy. Investigations into platforms usually need to define the relevant market, depending on the role this relevant market plays. Importantly, what was missing from these guidelines (and still is) is the ‘safe harbor’ threshold for vertical monopoly agreements. Next, the Guidelines offer additional factors for defining this relevant market, and names lock-in or network effects as examples, as well as user groups. They also focus on the relevance of multi-sided platforms, and define 3 approaches to define the relevant products for such platforms (for more information, see this [https://www.competitionpolicyinternational.com/wp-content/uploads/2021/03/10-Antitrust-Guidelines-for-the-Platform-Economy-in-the-Era-of-Enhanced-Antitrust-Scrutiny-By-Wei-Huang-Wendy-Zhou-Xiumin-Ruan-Xi-Zhang.pdf source], p.4). Finally, the Guidelines address ‘data and algorithmic collusion’ for monopoly agreements. Hub-and-spoke agreements are specifically mentioned next to regular horizontal and vertical agreements, implying the PRC’s struggle with these types of concerted monopolistic practices ([https://www.winston.com/en/blogs-and-podcasts/competition-corner/antitrust-101-a-quick-spin-through-hub-and-spoke-conspiracies source]).</div><div style="font-weight: 400;">‘Provisions’ on Abuse of Dominance and on Monopoly Agreements (2023)</div><div style="font-weight: 400;">In the Provisions on Prohibitions of Abuse of Dominance, network effects are mentioned as important factors to take into account when defining the relevant product market for platforms. For example, markets may be separate for products involved on platforms ([https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2023/04/samr-publishes-the-long-awaited-implementing-provisions-for-the-amended-aml.pdf source]). The Provisions also provide more detailed guidance to identify specific abuse in the digital economy. Examples include calculating costs in cases of multi-sided platforms, or discriminatory treatment through ‘big data’ (i.e. price differentiating for different customers). However, while the draft version of these provisions explicitly named ‘self-preferencing’ as a type of abusive conduct, it is no longer in the final version. Still, it is implied self-preferencing is prohibited through Articles 9 and 22 of the AML. Finally, the Provisions </div><div style="font-weight: 400;">Classifications Guidelines and Responsibility Guidelines (draft) (2021)</div><div style="font-weight: 400;">These Draft Guidelines provide a more ex-ante instrument for competition regulation. SAMR applies an asymmetrical regulatory framework to Ultra-Large, Large and Middle/Small Platforms in China. The distinction is mostly made based on a platform’s active yearly users and annual turnover. Unlike the DMA, the amount of business users are not relevant for the classification in China. The Guidelines identify 6 types of platforms: </div><div style="font-weight: 400;">1. online sales platform (connects people and goods and provides trading services)  2. life service platform (connects people and services)  3. social entertainment platform: connect people to people)   4. information platform (connects people with information)  5. financial service platform (connects people and funds)  6. computing service platform (connects people and computing power) </div><div style="font-weight: 400;">This mirrors the asymmetrical regulation of the DSA. While interesting, these Classifications Guidelines and Responsiblity Guidelines are more relevant for a comparative discussion in relation to the EU’s DSA than the DMA ([https://centrocompetencia.com/anti-monopoly-regulation-of-digital-platforms-in-china/ source 1] and [https://digichina.stanford.edu/work/translation-guidelines-for-internet-platform-categorization-and-grading-draft-for-comment-oct-2021/ source 2]).</div>
===== Enforcement =====
<div style="font-weight: 400;">While the SAMR is China’s main competition authority, it has also delegated enforcement to provincial, regional or municipal authorities. Apart from “public” enforcement, the AML also provides for a “private” enforcement regime through civil litigation. This is mostly related to cases related to abuse of power through intellectual property licensing. Furthermore, civil public interest litigation is also possible – this would entail the public prosecutor to bring civil actions ([https://www.nortonrosefulbright.com/en/knowledge/publications/2a188da3/competition-law-fact-sheet-china#section4 source]). The Supreme People’s Court released guidelines for such antitrust civil litigation, which apply from July 1st 2024 ([https://www.mayerbrown.com/en/insights/publications/2024/07/chinas-antitrust-enforcement-a-look-back-on-2023-and-what-to-expect-in-2024 source]).  </div>
=== India ===
==== Introduction to India Competition Regulation ====
The main features of competition regulation in India resemble familiar competition law concepts around the world: prohibition of abuses of a dominant position, merger control and wide ranging investigative powers. We explain these in more detail below. The current key piece of legislation is the [https://www.indiacode.nic.in/handle/123456789/2010?sam_handle= Competition Act, 2002]. Prior to this law, the relevant legislation was the Monopolies and Restrictive trade Practices (“MRTP”) Act, 1969. The 1969 law was the first Indian legislation to restrain abuse of market power and was focused on curbing monopolies. In contrast, the 2002 law takes a broader approach to promote competition. Further, the 2002 law was drafted in line with [https://regulation.org.uk/competition-india-evolution.html international developments] and reflected India’s reforms of [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Liberalisation, Privatisation and Globalisation] in the [https://en.wikipedia.org/wiki/Economic_liberalisation_in_India#Liberalisation_of_1991 1990s]. More recently, the Competition Act was amended in 2023 to transform the law to address “[https://www.epw.in/engage/article/competition-amendment-bill-2022-review-and a new era of economic development and consumer welfare” ]and address emerging digital market issues. The Indian government is also contemplating an ex ante regulatory framework potentially modelled on the European Commission’s Digital Markets Act (DMA), to apply to ‘systemically important digital intermediaries’ (SIDIs). This is in the [https://magellanes.com/index.php/CMN/article/view/776/641 draft Competition Bill,] 2024 and would complement the existing competition law regime in India.
==== Constitutional Basis for Regulation ====
Competition regulation in India is based on a [https://regulation.org.uk/library/india/CUTS-Why_India_Adopted_a_new_Competition_Law.pdf constitutional basis]. The [https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf Constitution] of India says: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Article 38: (1) The State shall strive to promote the welfare of the people by securing and protecting as effectively as it may a social order in which justice, social, economic and political, shall inform all the institutions of the national life. 

|-
| style="width: 100%;" | Article 39: The State shall, in particular, direct its policy towards securing: (b)  that the ownership and control of the material resources of the community are so distributed as best to subserve the common good;(c) that the operation of the economic system does not result in the concentration of wealth and means of production to the common detriment; 
==== Overview of the Competition Act (2002) ====
According to India’s competition regulator, the 2002 law [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf “follows the philosophy of modern competition laws]”. Under the Competition Act, anti-competitive agreements and abuse of dominance are considered as potential impediments to free and fair competition in the markets. Penalties are imposed when the regulator concludes an enterprise has engaged in anticompetitive practices resulting in appreciable adverse effect on competition (AAEC). '''Scope''': The territorial scope of the Competition Act is interestingly not the entire state. It extends to the whole of India except the [https://en.wikipedia.org/wiki/Jammu_and_Kashmir_(state) State of Jammu and Kashmir] (section 1(2)). There is significant history surrounding this distinction, dating back to the [https://en.wikipedia.org/wiki/Kashmir_conflict Partition of India]. '''Regulator''': The Competition Act establishes the [http://164.100.58.95/sites/default/files/advocacy_booklet_document/CCI%20Basic%20Introduction_0.pdf Competition Commission of India ](CCI). The CCI is a quasi-judicial body responsible for the administration of the Act.The key substantive regimes of the Competition Act are: 

#'''anti-competitive agreements''' (section 3); 
#'''abuse of dominance''' (section 4); and 
#'''regulation of combinations '''(merger control) (sections 5-6).  
===== Anti-competitive Agreements =====
There is a [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=3&orgactid=AC_CEN_22_29_00005_200312_1517807324781 general prohibition] of anti-competitive agreements which cause or are likely to cause an appreciable adverse effect on competition within India (s 3(1)). The Indian law includes examples that are presumed to have an appreciable adverse effect on competition and those which may have such as effect: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 50%;" | Examples from 3(4) - '''may''' be prohibited
| style="width: 50%;" | Examples from S3(3) - '''presumed '''adverse effect on competition and therefore prohibited 
|-
| style="width: 50%;" | Tie-in arrangement
| style="width: 50%;" | Directly or indirectly determines purchase or sale prices
|-
| style="width: 50%;" | Exclusive dealing agreement
| style="width: 50%;" | Limits or controls production, supply, markets, technical development, investment or provision of services
|-
| style="width: 50%;" | Exclusive distribution agreement
| style="width: 50%;" | Shares the market or source of production or provision of services by way of allocation of geographical area of market, or type of goods or services, or number of customers in the market or any other similar way
|-
| style="width: 50%;" | Refusal to deal
| style="width: 50%;" | Directly or indirectly results in bid rigging or collusive bidding
|-
| style="width: 50%;" | Resale price maintenance
| style="width: 50%;" |
 
|}
===== Abuse of Dominance =====
S.4(1): No Enterprise or group shall abuse its dominant position.In addition to the broad prohibition, the Competition Act provides [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=4&orgactid=AC_CEN_22_29_00005_200312_1517807324781 examples] of when there shall be an abuse of dominant position, including if an enterprise or a group: 

a) directly or indirectly, imposes unfair or discriminatory:

      i. condition in purchase or sale of goods or service; or

      ii. price in purchase or sale (including predatory price) of goods or service. 

b) limits or restricts:

      i. production of goods or provision of services or market therefor; or

      ii. technical or scientific development relating to goods or services to the prejudice of consumers; or

c) indulges in practice or practices resulting in denial of market access [in any manner]; or

d) makes conclusion of contracts subject to acceptance by other parties of supplementary obligations which, by their nature or according to commercial usage, have no connection with the subject of such contracts; or

e) uses its dominant position in one relevant market to enter into, or protect, other relevant market.
 A "'''dominant position"''' means a position of strength, enjoyed by an enterprise, in the relevant market, in India, which enables it to: 

*operate independently of competitive forces prevailing in the relevant market; or
*affect its competitors or consumers or the relevant market in its favour;Predatory price means the sale of goods or provision of services, at a price which is below the cost. 
===== Regulation of Combinations =====
The regulation of combinations requires first that the acquisition or merger is considered a '''‘combination’''' - which is defined in [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=5&orgactid=AC_CEN_22_29_00005_200312_1517807324781 Section 5]. Being considered a combination that is subject to regulation depends partly on the value of the acquisition or merger, with values set in both rupees and US dollars. This is equivalent to what is commonly referred to as merger control. Some categories of combinations consider value only within India, and other categories consider worldwide turnover. For example, any merger or amalgamation in which the resulting legal entity will have, in India, the assets of the value of more than rupees one thousand crores or turnover more than rupees three thousand crores will be considered a combination (s 5(c)(i)(A)). 

*rupees one thousand crores = 110.415.600,00 Euro
*rupees three thousand crores = 331,250,400.00 EuroCombinations are prohibited if they cause or are likely to cause an appreciable adverse effect on competition within the relevant market in India [https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&orderno=6&orgactid=AC_CEN_22_29_00005_200312_1517807324781 (section 6(1))].'''Procedure:''' If a combination is proposed, it must be notified to the CCI. The CCI has powers to respond to such a notice contained in sections 29, 29A, 30 and 31.9563 of the Competition Act. This includes the power to approve - or withhold approval - for combinations. The Commission may inquire into whether a combination has caused or is likely to cause an appreciable adverse effect on competition in India within one year of the combination taking effect ([https://www.indiacode.nic.in/show-data?abv=CEN&statehandle=123456789/1362&actid=AC_CEN_22_29_00005_200312_1517807324781&sectionId=657&sectionno=20&orderno=21&orgactid=AC_CEN_22_29_00005_200312_1517807324781 s 20(1)]). This can be based on a notification or otherwise.  To determine if there is an AAEC, relevant factors are prescribed by the Competition Act and include: 

*actual and potential level of competition through imports in the market;
*barriers to entry into the market;
*level of concentration in the market, and degree of countervailing power in the market;
*likelihood that the combination would result in an ability to significantly and sustainably increase prices or profit margins;
*extent to which substitutes are available or are likely to be available in the market;
*market share, in the relevant market
*if the combination would remove a vigorous and effective competitor in the market;
*nature and extent of vertical integration in the market;
*possibility of a failing business; and
*nature and extent of innovation. 
==== Competition Commission of India ====
===== Regulatory Powers =====
If the Commission determines through an investigation there has been an abuse of a dominant position, or an enterprise as entered an anti-competitive agreement, the Commission may make any or all of the following orders: 
#direct any enterprise involved in such agreement to discontinue and not to re-enter such agreement  
#direct any enterprise involved in such abuse of dominant position to discontinue such abuse of dominant position
#impose such penalty not more than ten per cent of the average of the turnover or income for the last three preceding financial years
#in the case of a cartel, the fine imposed may be up to three times of each enterprises’ profit for each year of the continuance of such agreement or ten per cent of its turnover or income for each year of the continuance of such agreement, whichever is higher
#direct that the agreements shall stand modified to the extent and in the manner as may be specified in the order by the Commission;
#direct the enterprises concerned to abide by such other orders as the Commission may pass and comply with the directions, including payment of costs, if any;
#pass such other as it may deem fit. 

===== Structural Powers =====
The Commission may, by order in writing, direct division of an enterprise enjoying dominant position to ensure that such enterprise does not abuse its dominant position. 
In particular, the Commission can order:
*the transfer or vesting of property, rights, liabilities or obligations;
*the adjustment of contracts either by discharge or reduction of any liability or obligation or otherwise;
*the creation, allotment, surrender or cancellation of any shares, stocks or securities;
*the formation or winding up of an enterprise or the amendment of the memorandum of association or articles of association or any other instruments regulating the business of any enterprise;
*the extent to which, and the circumstances in which, provisions of the order affecting an enterprise may be altered by the enterprise and the registration thereof;
*any other matter which may be necessary to give effect to the division of the enterprise.

 This power does not require the Commission to first prove there has already been an abuse of a dominant position, hence, does not have similar ex-post problems of EU competition law. This power could be exercised by the Commission in a preventative manner. 

==== Amendments to the Competition Act of 2002 ====
In 2007, the Competition Act was amended to rectify administrative law issues regarding non-observance of the separation of powers. The amendments restructured the CCI to implement stronger separation of powers:
#the Commission as a seven-member (one chairperson and 2-6 members) expert Body to function as a market regulator for preventing and regulating anticompetitive practices in the country and to carry on the advisory and advocacy functions in its role as a regulator
#the Competition Appellate Tribunal (COMPAT) as a three-member quasi-judicial body to hear and dispose of appeals against any direction issued or decision made or order passed by the Commission. Consequently, the CCI only became fully operational in 2009. This meant that the CCI lacked its own [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3897291 jurisprudence] and instead leant on jurisprudence from EU, US and other mature competition law jurisdictions in developing the reasoning behind its orders. 
In 2023, the Competition Act was amended to increase penalties. Now, the CCI may impose a fine of [https://economictimes.indiatimes.com/tech/technology/ettech-explainer-timeline-of-ccis-antitrust-probe-into-amazon-and-flipkart/articleshow/113598290.cms?from=mdr up to 10%] of the average global turnover or income of three preceding financial years on each of the parties found to have breached the law. This may include revenue earned by the company in India and abroad.

==== Case Law ====

'''Online Marketplaces in the firing line'''Amazon and Flipkart are leading players in India's e-retail market which was estimated to be worth $57-60 billion in 2023, and set to top $160 billion in value by 2028, consultancy firm [https://www.thehindu.com/sci-tech/technology/amazon-flipkart-breached-antitrust-laws-cci/article68637232.ece Bain estimates].Amazon and Flipkart have been under investigation by the CCI since[https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles 2020]. The ‘[https://timesofindia.indiatimes.com/articleshow/71731500.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst probe]’ included questions about: 

*the source of origin of their private label brands; and 
*whether product listing on their marketplaces could be manipulated through advertising. The CCI has [https://www.livemint.com/companies/amazon-anti-trust-case-penalty-global-turnover-seller-competition-commission-of-india-cci-competition-act-11726049208090.html reportedly] sent its findings to Amazon and Flipkart - to which the platforms have a right of reply - prior to making a final, public order. '''Why has the regulatory action taken 4 years from investigation? '''Apart from 4 years being well within the general timeline of competition cases in other jurisdictions like Europe, the process was extended by both Amazon and Flipkart making procedural challenges regarding the investigation itself. In 2021, Amazon and Flipkart both challenged the CCI’s powers to investigate, (on two occasion in both a lower and higher court) but the courts upheld CCI’s power to investigate ([https://www.cci.gov.in/legal-framwork/judgements/15/0 2021 case]). 

On January 13, 2022, the CCI passed an order to investigate Flipkart and Amazon for anti-competitive practices. The [https://www.outlookbusiness.com/start-up/explainers/amazons-legal-woes-a-timeline-of-ccis-investigation-and-court-battles investigation] related to its exclusive arrangement practices, deep discounting and also preferential listing on labels - and included a dawn raid. Broadly, the conduct of concern is preferencing sellers on its platform. Further, the CCI is considered if alleged discounting practices affected the competition ecosystem as a whole.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | Alleged anti-competitive conduct:
|-
| style="width: 100%;" |
*preferential treatment of select sellers, particularly those with established partnerships, which allegedly results in higher search rankings.
|-
| style="width: 100%;" |
*deeply discounted pricing practices, possible [https://www.legalbusinessonline.com/features/explainer-how-will-cci%E2%80%99s-investigations-amazon-and-flipkart-change-e-commerce-india predatory pricing], particularly in the mobile phone sector.
|-
| style="width: 100%;" |
*exclusive arrangements, like exclusive product launches
|}Case Status: The CCI has completed its investigation of both Amazon and Flipkart and reported it has identified anti-competitive conduct in breach of the Competition Act. The companies now have an opportunity to report their respective reports prior to the CCI determining fines and other orders (predicted to be issued in November). It is predicted any regulatory action will be appealed to a court, based on even the legal basis for the initial investigation being twice appealed. 

''''Rideshare services also targeted''''There are [https://cci.gov.in/antitrust/orders three cases] by the CCI against Uber: 2015, 2016 and 2021. These cases are against the Indian, Dutch and American Uber entities. In the most recent[https://cci.gov.in/antitrust/orders/details/25/0 Uber] case, the CCI alleged contravention of both anti-competitive agreement and abuse of dominant position prohibitions by resorting to predatory pricing with an intention to drive out its equally efficient competitors like Meru. Specifically, this was Uber’s below-cost pricing strategy. Ultimately, no breaches were substantiated. The decision can be summarised as: 

*No finding of dominance, so abuse of dominance not applicable. The relevant market was the “market for radio taxi services in Delhi-NCR (National Capital Region)”. This was a distinct market from “ the conventional taxi market in India largely comprised of tourist taxis and kerb-based taxis” - due one not being substitutable for the other. Uber was not considered dominant, largely due to competitor Ola. This means section 4 (abuse of dominance) cannot apply. 
*Performance incentives in agreements between drivers and Uber did not foreclose competition. Uber did not restrict drivers from also being active on other platforms. While Uber did offer performance based incentives (with network effects), these were not considered anti-competitive. 

 The [https://cci.gov.in/antitrust/orders/details/446/0 2016 Uber decision] also did not find dominance (also due to Ola’s presence in the market) and no contraventions of the Competition Act. 

=== United States ===
==== Introduction ====
The United States (US) has generally been less eager to pursue competition or antitrust enforcement against digital platforms in comparison to the European Union. Additionally, the US is perceived as having a lax approach to antitrust [https://digitalcommons.lib.uconn.edu/cgi/viewcontent.cgi?article=1440&context=law_review in stark contrast ] to most other jurisdictions. However, in late 2020, a sterner approach towards antitrust arose in the US with the [https://www.justice.gov/atr/case/us-and-plaintiff-states-v-google-llc filing of complaints] by the Department of Justice (DOJ) and several states against Google. This has been followed by further actions indicating that antitrust enforcement in the realm of digital platforms is a growing priority for the Biden administration, such as [https://www.justice.gov/opa/pr/justice-department-celebrates-one-year-anniversary-executive-order-competition Executive Order 14036], also known as the Executive Order on Competition. Regarding platforms, the order specifically encourages the Federal Trade Commission (FTC) and the DOJ to use their powers under antitrust law to [https://www.whitehouse.gov/briefing-room/statements-releases/2021/07/09/fact-sheet-executive-order-on-promoting-competition-in-the-american-economy/ “challenge prior bad mergers] that past administrations did not previously challenge” in, amongst others, the tech sector.
==== Basis of Antitrust in the United States ====
[https://www.ftc.gov/advice-guidance/competition-guidance/guide-antitrust-laws/antitrust-laws The FTC describes the basic antitrust law framework] in the United States through referencing the triad of the Sherman Act, FTC Act, and Clayton Act.The Sherman Act is a foundational US antitrust law passed in 1890. It emphasizes the importance of free competition and prohibits unfair monopolies. Generally, the Act prohibits anti-competitive agreements and conduct that (attempts to) monopolize the given market. It empowers the DoJ to enforce the Act. The basis of the notion of protecting competition is not to prevent monopolies in of itself, but the potential adverse impact of monopolies on consumers. Congress passed two additional antitrust laws in 1914, including the FTC Act and the Clayton Act. The former created the FTC and the Clayton Act addresses unlawful mergers and acquisitions. The FTC Act also bans unfair means of competition and unfair or deceptive acts or practices. Violations of the Sherman Act also count as violations of the FTC Act, thus allowing the FTC to enforce against violations under the Sherman Act. The Clayton Act prohibits mergers and acquisitions when the effect “may be substantially to lessen competition” or “tend to create a monopoly.” The Clayton Act was amended by the Robinson-Patman Act of 1936 to prohibit discriminatory prices, services, and allowances.Both the Sherman Act and Clayton Act were amended by the Hart-Scott-Rodino Antitrust Improvements Act. Most importantly, it required that companies intending to undertake a significant merger or acquisition must notify the government in advance. Additionally, it created a means for private parties to sue for triple damages under the Clayton Act for harms caused by conduct which violates either the Sherman or Clayton Act.States often also have their own antitrust laws, though these three acts form the basis for antitrust law in the United States.
==== Past and current approaches to antitrust in the tech sector ====
Previous antitrust cases including [https://law.justia.com/cases/federal/appellate-courts/F3/253/34/576095/ Microsoft in 1998] were brought by the DOJ on the basis of ‘regular’ antitrust law, with no specific digital market provisions. Microsoft was a key case wherein the DOJ considered that Microsoft was using exclusionary practices to maintain its monopoly in the operating systems (OS) market. This posed further problems as Microsoft tied its web browser, Internet Explorer, to its dominant OS which had anticompetitive effects particularly for its main competitor, Netscape, whose competing browser was considered by the DOJ as a basis for a potential competing OS. Though this case managed to open up the market, antitrust enforcement in the tech sector in the US has been lacking, in part due to the laissez-faire understanding of consumer welfare underpinning US antitrust law. For example, the FTC undertook an investigation of Google in 2013 regarding self-preferencing practices. However, the FTC ultimately closed the investigation as the self-preferencing could be understood as an [https://www.ftc.gov/sites/default/files/documents/public_statements/statement-commission-regarding-googles-search-practices/130103brillgooglesearchstmt.pdf improvement for users]. Additionally, the judicial atmosphere seemed to be against regulating these platforms; Monti claims cases would have in any case met [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “defendant-friendly courts.”]Enforcing antitrust against digital platforms seemed more palatable in 2021, [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 when two (ongoing) cases were brought against Google.] However, this still mostly uses normal avenues of antitrust enforcement against the firm, rather than tech-specific provisions. For example, one of the cases addresses Google’s anti-competitive practices in [https://nypost.com/2024/08/05/business/google-is-a-monopolist-search-giant-broke-antitrust-law-in-landmark-case-judge-rules/ the general search market.] The DOJ claims that Google’s monopolisation of both the search and its advertising markets are closely linked, letting the DOJ address anti-competitive effects on both sides of the market. Despite the lack of specific tech sector provisions, certain legal innovations are occurring. For example, in the Google complaints, the DOJ identified a connection between a decrease in consumer choice and the lack of data protection and privacy for consumers. It identifies that[https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “companies such as Google that offer low data protection can harvest more data that will allow them to cement their dominant position.”] This facilitates demonstrating anticompetitive effects on consumers from behaviour specific to the tech sector, without necessarily relying on a specifically tailored provision.An even further step in the potentially right direction happened, in January 2023 when the DOJ jointly with eight other US states filed a [https://www.documentcloud.org/documents/23584911-usa-v-google civil suit against Google] alleging that the “industry behemoth […] has corrupted legitimate competition in the ad tech industry”, charging Google with [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ “illegally monopolizing the publisher ad server market, the ad exchange market, and the advertiser ad network market”]. Notably, Google/DoubleClick merger of 2008 is mentioned as one of the causes that allowed for these actions, which was both approved by the US authorities and the [https://ec.europa.eu/competition/mergers/cases/decisions/m4731_20080311_20682_en.pdf European Commission.] Unlike some other jurisdictions, the US is seemingly able to apply a structural [https://competitionlawblog.kluwercompetitionlaw.com/2023/02/28/the-u-s-dojs-antitrust-effort-to-break-up-google/ remedy and break up] the company which would undo the merger from many years ago. As an ongoing case, the results of the outcome will come in the future, but it is important to note that such a remedy is not ‘light’ and that a firm has not been broken up in such a way since [https://law.justia.com/cases/federal/district-courts/FSupp/552/131/1525975/ AT&T split in 1982].
==== From general antitrust to specific platform regulation: shifting regulatory approaches ====
The House Committee on the Judiciary, after a 16-month investigation, released a [https://www.washingtonpost.com/outlook/2021/06/25/ftc-antitrust-monopoly-silicon-valley/ 450-page report] in 2020 asserting platforms’ anticompetitive conduct. This signalled a shift towards antitrust enforcement against big platforms followed by an increased legislative fervour to regulate platforms and prevent anti-competitive behaviour. In 2021, numerous Bills were proposed in the US to address digital platforms as part of the [https://www.reuters.com/legal/legalindustry/house-antitrust-subcommittee-unveils-five-big-tech-antitrust-bills-2021-06-14/ bipartisan legislative agenda ]"A Stronger Online Economy: Opportunity, Innovation, Choice," which was created after the House Committee on the Judiciary’s investigation.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |
*American Choice and Innovation Online Act, H.R. 3816, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED H.R. 3816, 117th Congress, 21 December 2022.]
|-
| style="width: 100%;" |
*Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act of 2021, H.R. 3849, 117th Congress, 11 June 2021.
**Newest version:: [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D S.2521, 118th Congress, 26 July 2023.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Ending Platform Monopolies Act, H.R. 3825, 117th Congress, 11 June 2021.] 
|-
| style="width: 100%;" |
*Platform Competition and Opportunity Act of 2021, H.R. 3826, 117th Congress, 11 June 2021.
**Newest version: [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D S.3179, 117th Congress, 4 November 2021.]
|-
| style="width: 100%;" |
*[https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D Competition and Antitrust Law Enforcement Reform Act of 2024, S.4308, 118th Congress, 9 May 2024.]
|}Monti highlights that these legislative efforts represent a shift for the US from a relatively lax approach to an [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 “accelerated enforcement of antitrust law.” ]However, questions remain from a legal procedural perspective as the [https://journals.sagepub.com/doi/pdf/10.1177/0003603X211066978 Bills do not delineate their relationship] with the backbone of the US’s antitrust framework, the Sherman Act, at this stage in the legislative process.All Bills (excluding the ACCESS Act) use certain thresholds to determine which platforms and tech companies fall under its obligations. These thresholds include:

*At least 50,000,000 US-based monthly active users, or 100,000 US-based monthly business users
*Market capitalisation of over $600 billion.These conditions are cumulative. Platforms fulfilling these conditions are referred to as “covered platforms” in the relevant Bills. The DOJ and FTC must designate a platform as a “covered platform.”
==== The American Choice and Innovation Online Act ====
The American Choice and Innovation Online Act is an attempt to prevent platforms and large tech companies from [https://www.klobuchar.senate.gov/public/index.cfm/2021/10/klobuchar-grassley-colleagues-to-introduce-bipartisan-legislation-to-rein-in-big-tech “abusing their market power to harm competition, online businesses, and consumers,”] according to the senators pushing this Bill.[https://www.congress.gov/bill/117th-congress/house-bill/3816/all-info The Bill would prohibit] platforms from self-preferencing, intentionally disadvantaging other firms’ products or services, using non-public data from a business user to provide itself an advantage, and interfering with pricing decisions set by another business user. Such prohibitions are found in Section 2(a) and (b) of the Bill. It envisions empowering the FTC and DOJ to oversee enforcement of the law.Note that [https://www.congress.gov/bill/117th-congress/house-bill/3816/text Section 2(c) outlines affirmative defences] wherein such behaviour may fall under the Bill if the covered platform can show through “clear and convincing evidence” that their conduct falls under the listed exceptions. The first is when the conduct does not actually harm the competitive process, the second is when the conduct was tailored, necessary, and the least discriminatory way possible to either prevent a violation of or comply with federal or state law, or protect user privacy or other non-public data. Lastly, the conduct may also fall under an exception if the covered platform can show it increases consumer welfare.Section 2(f) outlines remedies for when covered platforms are found in violation. [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#HF45741D64737438EBCB163BB567554DD Violating platforms] can be fined up to 15% of their total US revenue for the previous calendar year, or 30% of the revenue affected by the unlawful conduct during the relevant period. These may be followed by various other [https://www.congress.gov/bill/117th-congress/house-bill/3816/text#H443284287DB5490C8A25189F5E627EED remedies in addition.]
==== Augmenting Compatibility and Competition by Enabling Service Switching (ACCESS) Act ====
The ACCESS Act aims to promote competition through reducing consumer switching costs between online communications services, primarily through requiring interoperability between services. The Bill addresses large communications platforms, and [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id26253909d5314223b55373e44fdd36d9 large communications platforms] providers, defined in Section 2(7) and (8). A large communications platform is one that generates income “directly or indirectly from the collection, processing, sale, or sharing of user data,” and has more than 100,000,000 monthly active users in the US. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id2e3053dea84b489592ab939f68ff8ee0 Providers are those that provide such a platform.]The Bill establishes a general duty for providers to maintain tools to allow for the [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc786796c31404569bf23dc60e25e082a secure transfer of user data] to either a user or a competing communications provider in a commonly used, accessible format (Section 3(a)). It requires any competing provider to secure received data (Section 3(b)). This duty does not apply when a large communications platform provider provides a service that does not generate income from data.[https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idc90be17d957046b697b27e4f831e540a A general duty of interoperability] between communications platforms is also proposed in Section 4. [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1fa00d27e2a8439c9abcb502f53018d0 Model technical standards for interoperability] will be published no later than 180 days after date of enactment by the Director of the National Institute of Standards and Technology (Section 6(c)). [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#id1ad905045b35484ba2917b0623c9cf85 The FTC will oversee enforcement] (Section 6(e)). Violations will be treated as [https://www.congress.gov/bill/118th-congress/senate-bill/2521/text?s=1&r=1&q=%7B%22search%22%3A%22Augmenting+Compatibility+and+Competition+by+Enabling+Service+Switching+%28ACCESS%29+Act%22%7D#idddd0056d66a04b819f77764e1bd3bdce an unfair and deceptive act] under Section 18(A)(1)(B) of the FTC Act 15 U.S.C. 57(A)(1)(B) (Section 6(f)(1)).
==== Ending Platform Monopolies Act ====
This Bill proposes to promote competition and economic opportunity in digital markets through removing conflicts of interest resulting from [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D “dominant online platforms’ concurrent ownership or control of an online platform and certain other businesses.”]  It would be unlawful for covered platforms to “own, control, or have a beneficial interest” in a business other than their platform that [https://www.congress.gov/bill/117th-congress/house-bill/3825/text?s=2&r=2&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#HC7C7E9E8D8EC402B8FE86E12F6A84252 uses the covered platform to:]

*Sell or provide its products or services (Section 2(a)(1),
*Offers a product or service that the covered platform requires a business user to use to access the covered platform or for preferential status on the covered platform (Section 2(a)(2)),
*Or causes a conflict of interest (Section 2(a)(3)), which covers situations expounded on in Section 2(b)(1) to (2). This includes when a covered platform’s ownership of another business incentivises the covered platform to advantage their own products or services, or disadvantage competitors’ products or services.The FTC and DOJ are in charge of enforcement, and a violation will be considered an unfair method of competition under Section 5 of the FTC Act 15 U.S.C. 5 (Section 3(b)). Civil penalties for any person, or any individual who acts as an officer, director, partner, or employee of a person who fails to comply with the Bill are present. The civil penalties constitute either up to 15% of the total average daily US revenue of the person for the previous calendar year, or 30% of the total average daily US revenue of the person in any line of business impacted or targeted by the unlawful conduct during the relevant period (Section 3(c)(1) and (2)). Note that this mirrors the penalty amounts also listed for the American Choice and Innovation Online Act. Additionally, the FTC can pursue civil litigation to seek relief (Section 3(c) and (d)).
==== Platform Competition and Opportunity Act ====
The Bill seeks to promote competition and economic opportunity by establishing certain acquisitions by dominant online platforms as unlawful. Section 2 establishes a general presumption of unlawfulness of covered platforms acquisition of the whole or any part of stock or share capital of another person engaged in commerce and equivalent activities, or the whole or any part of their assets [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H5A69E35E0A71403AA0874E86B7E9B8D7 (Section 2(a)(1) and (2))]. For an acquisition to be lawful, the covered platform must provide clear and convincing evidence the acquisition falls under one of the exclusions in Section 2(b), which, most interestingly, include that the acquired assets do not compete with the covered platform or “constitute nascent or potential competition” or enhance the covered platform’s ability to maintain its market position. Competition must be understood in this Act also as competition for a user’s attention [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H7D70987E9BC147D980E7D58EC590F390 (Section 2(c)).] Additionally, the Bill recognises that acquisitions resulting in additional data may increase the market position or the ability to maintain the market position of a covered platform [https://www.congress.gov/bill/117th-congress/senate-bill/3197/text?s=4&r=2&q=%7B%22search%22%3A%22%5C%22Platform+Competition+and+Opportunity+Act%5C%22%22%7D#H711F48D2FDA94BFFBE5AE57144362C92 (Section 2(d)).]Enforcement falls under Section 5 of the FTC Act as any violation of the Bill is treated as an unfair method of competition (Section 5(b)). Civil action against a person may be pursued by the FTC to obtain a civil penalty and relief (Section 5(c)). The persons injured may also pursue suits to recover three times the damages sustained (Section 7).
==== Competition and Antitrust Law Enforcement Reform Act of 2024 ====
The Bill aims to reform antitrust laws to better protect competition through amending the Clayton Act’s standards for unlawful acquisitions, deterring exclusionary conduct (particularly for dominant firms – Section 2(a)(5), and enhancing the DoJ and FTC’s enforcement powers.The Bill has a starting point that the Clayton Act’s effectiveness has been diluted and must be restored, and that enforcement powers and budgets have not grown in pace to current antitrust concerns. Section 4 addresses unlawful acquisitions and outlines sweeping amendments to the Clayton Act to increase its scope and reduce barriers to proving an anticompetitive effect from a merger. For example, Section 4(b)(1) states Section 7 of the Clayton Act should be amended to replace the threshold of “substantially to lessen” competition to [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id90af6c43a1c245169db2844d6adfafb3 “to create an appreciable risk of materially lessening”] competition. Additionally, it adjusts merger thresholds in a way that seems to address specific risks arising from big tech firms. Such firms often acquire small startups and integrate those services, flying under the radar of merger and acquisition regulation due to the low market share of the acquired startup. The Bill, in Section 4(3)(6)(B)(ii) provides that a court should review an acquisition when [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id44298cf180aa4e088770bc92d7492cdb “the person acquiring or the person being acquired has assets, net annual sales, or a market capitalisation greater than $100,000,000,000.” ]Regarding exclusionary powers, Section 10 proposes to amend the Clayton Act by inserting a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id76234b49b47b439d929467b62c919507 Section 26A on exclusionary conduct]. This would include a [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#id83d0ca3851f04e4d9a4e8f09d4e8f365 presumption that exclusionary conduct presents an appreciable risk of harming competition] when the person(s) acting have either (A) a market share greater than 50% as a seller or a buyer in the relevant market, or (b) otherwise has significant power in the market. Additionally, when a defendant operates a multi-sided platform business, it does not require establishing that the exclusionary conduct presents an appreciable risk of harming competition on [https://www.congress.gov/bill/118th-congress/senate-bill/4308/text?s=1&r=1&q=%7B%22search%22%3A%22ending+platform+monopolies%22%7D#idbca34fb8fdf640dcb49ba0377b8948f3 more than one side of the multi-sided platform.]As the Bill proposes to amend the Sherman Act, enforcement and penalties are pursued under the Sherman Act itself. However, Section 11 of the Bill also proposes amendments to the Sherman Act regarding penalties for violations. It includes the possibility that every person who violates either Section 1 and/or 2 of the Sherman Act will be liable to the US for either a civil or criminal penalty up to either 15% of the total US revenue of the person of the previous calendar year, or 30% of the US revenue of the person in any part of the trade and commerce related to or targeted by the unlawful conduct during the relevant period (Section 11(1) and (2)).  This aligns with the penalty amounts seen in the American Choice and Innovation Online Act and the Ending Platform Monopolies Act. This penalty may be recovered through civil or criminal actions initiated by the US. It additionally proposes to amend the FTC Act to adjust the ability of the FTC to bring civil actions against persons, partnerships, or corporations who violated the law and undertook an unfair method of competition (Section 11(3) and (4)). This aligns the FTC’s enforcement powers with those the DoJ would have under the Sherman Act (as the FTC Act empowers the FTC to enforce Sherman Act violations and requires its own amendment). The Attorney General and and the FTC will thus be further aligned through the obligation to issue joint guidelines on the appropriate amount of a civil penalty to impose (Section 12). Civil penalties henceforth provided by the proposed amendments do not preclude other remedies provided in US law, such as for example the Clayton Act or other sections of the FTC Act (Section 11(4)(b)).
==== Responses to Proposed New Regulatory Approaches ====
Of course, the approaches of some of these Bills are more radical than others on their impacts on big tech firms. None of these bills have been passed and it is now unpredictable to determine which will pass in the wake of [https://www.reuters.com/world/us/trumps-republicans-win-control-us-senate-make-gains-house-2024-11-06/ Trump’s 2024 election win], and the Republican control more generally over numerous federal institutions. Additionally, big tech Chief Executive Officers (CEOs) have been reported [https://edition.cnn.com/2024/10/27/politics/big-tech-ceos-donald-trump-election/index.html sidling up to Trump], with Elon Musk’s endorsement the strongest, possibly hoping for Trump to [https://www.wired.com/story/dial-up-jared-clemons/ extend tax cuts] to big corporations implemented during his first term.
=== South Africa ===
==== '''Outlook, recommendations, and how to get it right for South Africa''' ====
In a parallel evaluation of how South Africa is adapting to rising pressures from digital platforms on an increasingly competitive market and the need for a “robust regulatory response”,[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5562298 Yolani Ndamase]outlines the shortcomings of borrowing from other legislations.[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr Dina Waked’s two-step approach]for designing effective competition enforcement in developing countries is referenced. Waked starts by asking the question “[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr what is the point of the law]”, which is crucial to be answered to assess the country’s own needs and tailor the respective competition law enforcement or required regulation accordingly, based on South Africa’s unique[https://africanantitrust.com/2025/05/02/borrowed-blueprints-unintended-consequences-south-africa-and-the-eus-digital-markets-act/ institutional constraints and specific market dynamics].[https://digitalcommons.law.seattleu.edu/cgi/viewcontent.cgi?article=2276&context=sulr The first step]should have as the outcome the identification of the overall goal of antitrust enforcement, with the  second step being the identification of the market structure that is responsible for accomplishing such a goal.There is clearly a strong need to put in the work to establish the criteria in order to be able to identify and if necessary designate gatekeepers and with it to evaluate specific digital intermediaries’ positions and degree of dominance. The ex ante approach of the EU should not be followed blindly, without “[https://download.ssrn.com/2025/10/4/5562298.pdf?response-content-disposition=inline&X-Amz-Security-Token=IQoJb3JpZ2luX2VjECUaCXVzLWVhc3QtMSJGMEQCIET8ptF2OPfBFhmpkEaUOSCvKrk9l49E2WW1NMc9WbxsAiBIEEl4n%2FfSpZas8ZDHPRdT1dc0Y49j93%2FVmUX%2FTIVZZSrGBQju%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAQaDDMwODQ3NTMwMTI1NyIMeKOqpwXbEqwezSAuKpoFJS0QqO7lmXNNUxvD%2BKioB9e7PiwUxSlNKsxQvI%2BL2ORJTeIrCujCZ5t51k5nsXZnuz0krhUrvsaA%2BioIhjSM2%2BEuxktiQ5J82KGiZKebhI73fzcDR4GqTgwaqUWI8h05LF3qBxxk5289pxSF7etj0LkFHLqcDGjWp3kMr9JU8Vj0BidWrWTky596%2FEu1xYh6TyoNgHWvMgb7%2BCTSEdexXH4wZZXXrQFwH72CYuy2opzB7OMd%2FJkCGjt5r1S6gvZDgCNJaFsRguCqFUBaFp1i%2FdWXTxHgITNr0HUg3G6vx%2BKfJmMd8TVUcF0mUlWmQRZRVjcGFVkWEjE9Hu9uywjCkwZ4XYIlFJeVWHcmjV9ei9ViZ2MitzPCLc%2B%2F%2FfSqs5chx6d7Opj5jjHx7oxIXMSyMrEohu6k8K7kd9CRvbh16jOSUQUPQwaW4Wr0mnH2I72ErUBWMHHEXKrD3Cf08Q4mfLrtxlWpgCY%2FHRO963P3%2BIgbCct85R9F7wN9emaZpF30ASLjDEER%2BoJ163hN%2B8X0cjRoHpCa1LCuwEZnrcIk8b%2B3fFnlmskqDur8vBHFgjLw%2BuRQak82cIsWFcqptoojQ0XX%2BZdYFW3MkPS3%2B6xjFKCbMOUE453ewvNXHtiK3YR3tSpfXLgT2O1oncpgUXwRyMYvJzf6EmWF8hEPq30BBpZgEgHfyWNTv3lVSVYMZT2EpJAmKfVLZmdWyBY25S%2F1uGjoajEJDdfUK7Bz9JYw5TJiP6RwQdsjF725AJxQFWxkK5kmOlCKmGYir7f0JjWiVOZxFnhDIOhWwQxs5XfuxsAdHf9LMwgsKZeMsMaY9Urr7S01VX2wvt4J7%2BFW%2BvimQ%2FYnw6BGQk17dXePIdB0ONVzTve%2F4sLRZl04MNCZwsgGOrIBTSRNTPxqjnhS9SekaqPMOiR8%2FokZohK6dO5MSrkwTChVnoIshYHssGqR8oPbalHAYePWYa4dnsd84IaRfmfmS%2BLRqyihBEwlh8bAFQV9zTz36IoH9Qhe7BdxuwHFtMt1iXojuvIgjemXSXYqlMGIV69xE0q559oM4De8ZBec%2Bfk5KQfx2FqlB7vc9fBCxvIREtimvjNdMGvUS9IJ%2FuVeqt6ZJP9Am1UpKdwnQz1smORjVw%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20251109T130027Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAUPUUPRWE4JCE6E3G%2F20251109%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=931a70732ea28852da4da7d58bf9996bee0382b59f21483db3d75a2a664c48ba&abstractId=5562298 conducting further market inquiries]” as this can ensure that the regulatory framework is well-informed and built on clarity and clear objectives as well as to provide a better position to understand where on the scale between market liberalisation and planned economy South Africa desires to be and which measure it will apply, one of  social-political preference or of macroeconomics, rather.

Module 3: Content

2025-10-30T19:36:17Z

NadineWalsh:

== Misinformation and Disinformation Online ==
[https://digital-strategy.ec.europa.eu/en/policies/online-disinformation Disinformation] is false or misleading content that is spread with an intention to deceive or secure economic or political gain, and which may cause public harm. [https://digital-strategy.ec.europa.eu/en/policies/online-disinformation Misinformation] is false or misleading content shared without harmful intent though the effects can be still harmful.
=== European Union ===
==== Definitions ====
The definitions for Misinformation and Disinformation can be found within the[https://digital-strategy.ec.europa.eu/en/policies/code-practice-disinformation Code of Practice on Disinformation], which was issued as a framework by the Commission in 2018 and updated in 2022. It was initially meant to be read in conjunction with the Digital Services Act, which is described in more detail in one of the later sections. From early 2025, however, the Code of Practice on Disinformation has been integrated as a[https://digital-strategy.ec.europa.eu/en/library/code-conduct-disinformation Code of Conduct on Disinformation]within the framework of the Digital Services Act (DSA) endorsed by the Commission and the European Board for Digital Services.The Code of Conduct, which was signed by a number of stakeholders, from online platforms and search engines to large-scale advertisers,[https://digital-strategy.ec.europa.eu/en/library/code-conduct-disinformation took effect on 1st July 2025]and borrows the definitions of Misinformation and Disinformation from the[https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM%3A2020%3A790%3AFIN&qid=1607079662423 European Action Plan]in the following manner:Misinformation is false or misleading content without harmful intent though the effects can be still harmful, e.g. when people share false information with friends and family in good faith.Disinformation is false or misleading content that is spread with an intention to deceive or secure economic or political gain and which may cause public harm.The EU adopts two key regulations to counter disinformation and misinformation. One is the[https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Digital Service Act (DSA)], rooted in the EU’s competence to harmonize the internal market, establishing a systemic risk framework compelling Very Large Online Platforms (VLOPs) to identify, assess, and mitigate systemic risks, including disinformation and misinformation. The other is the[https://eur-lex.europa.eu/eli/reg/2024/1083/oj/eng European Media Freedom Act (EMFA)], which functions as a media-specific supplement to the DSA, aiming to safeguard media editorial independence and pluralism, both being essential for creating quality media content that serves as an antidote to disinformation and information manipulation.
==== The Digital Services Act (EU) 2022/2065 ====
The[https://eur-lex.europa.eu/eli/reg/2022/2065/oj Digital Services Act]which applies from 17 February 2024, regulates the Digital Market for Digital Services.[https://eur-lex.europa.eu/eli/reg/2022/2065/oj ]The rationale for the implementation of the DSA was the fact that “information society services” as well as[https://eur-lex.europa.eu/eli/reg/2022/2065/oj “intermediary services’s” importance had increased in the 20 years prior to drafting of the DSA].[https://eur-lex.europa.eu/eli/reg/2022/2065/oj ][https://eur-lex.europa.eu/eli/reg/2022/2065/oj New ways of sharing and accessing information as well and the transactions]following on from this were deemed a risk to regulate in order to minimise the challenges that these new services created for individuals.The regulation has as its aim[https://eur-lex.europa.eu/eli/reg/2022/2065/oj the functioning of the market as intermediary services], in order to create a safe, predictable, and trusted online environment with innovation and consumer protection at its heart.[https://eur-lex.europa.eu/eli/reg/2022/2065/oj ] Looking specifically at Misinformation and Disinformation, the DSA is based on the definitions in prior EU documents, it does however define[https://eur-lex.europa.eu/eli/reg/2022/2065/oj illegal content]as “any information that, in itself or in relation to an activity, including the sale of products or the provision of services, is not in compliance with Union law or the law of any Member State which is in compliance with Union law, irrespective of the precise subject matter or nature of that law.”[https://eur-lex.europa.eu/eli/reg/2022/2065/oj ] [https://eur-lex.europa.eu/eli/reg/2022/2065/oj Key articles], which outline the responsibilities of the so called ‘intermediary services’ start with regulating the responsibility to take down illegal content, once they have been informed of such nature. 
*Article six, addresses hosting in general terms and the roles that information society services play.
*Article 9, in turn, addresses the response and reactions of these intermediary services against illegal content, laying down the actions required against illegal content, such as informing the relevant authorities or any other competent authority required and the required timescales attached (although the terminology used is unspecific ‘without undue delay’), as well as the process of informing Digital Services Coordinators and individuals.
*The providers of hosting services are obliged to put in place notice and action mechanism (Article 16), which allow (individual) users to flag illegal content and ensure for a feedback mechanism, where possible or requested.
*In Article 22, the DSA coined the term ‘trusted flaggers’ which means entities with designated expertise, who receive special status by means of the Digital Services Coordinator of a Member State. These groups or entities also have the responsibility to issue reports to the Digital Services Coordinators outlining the number of notices amounting to alleged illegal content, amongst other information and demonstrating its continued independence.
 • • The assessment and mitigation of risks are outlined in Articles 34 and 35 respectively, governing VLOP’s and VLOSE’s roles and responsibilities to identify, analyse, and assess their own and related services in terms of risks as well as the mitigation of these.
==== EMFA.... ====
==== COMPARISON ====
==== Use Cases & Secondary Reading on Elections ====
When evaluating the impact that disinformation can have on elections, this can come in the form of[https://brill.com/view/journals/shrs/29/1-4/article-p24_24.xml?language=en&srsltid=AfmBOoqrpv373XI0PPmq6TFSnXUoN8nw222b2StBNXzqE_O3Gd4N-Q_Q ‘fake news’, misleading polls, or false claims by election-monitor].[https://brill.com/view/journals/shrs/29/1-4/article-p24_24.xml?language=en&srsltid=AfmBOoqrpv373XI0PPmq6TFSnXUoN8nw222b2StBNXzqE_O3Gd4N-Q_Q Disinformation in Elections]emphasises that “ there is a growing realisation that disinformation has become a major feature of elections in many countries around the world”.Online communities make it even[https://www-taylorfrancis-com.proxy.uba.uva.nl/reader/read-online/a0afa1d1-12d9-4c3e-a249-750a4b21b467/book/epub?context=ubx easier for like-minded people]to meet and for specific misinformation to spread.Two recent and extremely prevalent use cases of disinformation influencing elections, namely the Brexit Referendum in the UK and the US Elections of 2016, are the Cambridge Analytica ones. Data improperly obtained on close to 90m Facebook users were used to target users and voters online with ads and opinion-forming information to[https://www.europarl.europa.eu/RegData/etudes/ATAG/2019/637952/EPRS_ATA(2019)637952_EN.pdf manipulate behaviour, for the purpose of influencing the voting for the respective polls]. An[https://rahwebdav.swan.ac.uk/repec/pdf/wp2018-01.pdf evaluation of Twitter [now X] data on the Brexit Referendum and the US elections], suggests that “the aggressive use of Twitter bots, [...] could [also] contribute to the vote outcomes.”
=== ===
=== Brazil ===
<div>

==== '''The Brazilian Context''' ====

<div>The Brazilian 2018 presidential elections brought the spotlight onto issues of disinformation into the policy debate due to the use of disinformation in Jair Bolsanaro’s campaign. A key aspect of efforts to fight disinformation and the design of policy bills centers around the use of messaging services, primarily [https://www.terra.com.br/byte/no-telegram-golpistas-falavam-de-invasao-ao-congresso-desde-comeco-de-janeiro,eb32e7542879048f48c82e0f30aa4414av9dzxap.html Telegram] and [https://journals.sagepub.com/doi/10.1177/20563051231160632 WhatsApp][https://journals.sagepub.com/doi/10.1177/20563051231160632 , to spread disinformation during] the presidential elections. Due to the fact that the rates of sending traditional (‘SMS’) messages in Brazil were unaffordable and very expensive for the majority of people in Brazil, the web-based [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3618781 WhatsApp offered] a less expensive alternative. The feature that stood out in these messaging apps in particular was the ability to make large-scale messaging chains, which became a prime social-media instrument for targeted political disinformation campaigns in Brazil. Consequently, it was noted that Bolsonaro’s supporters often preyed on Brazil’s ‘poor,’ to gain a voting base in [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj disadvantaged communities]. These WhatsApp-led disinformation campaigns, which later led to the surrounding discussion on disinformation regulation in Brazil, culminated in an [https://edition.cnn.com/2023/01/09/americas/brazil-congress-attack-explained-intl/index.html attack on the Brazilian Congress] by supporters of Bolsanaro after his loss, reminiscent of the January 6 Capitol attack in the United States.

</div>
<div>Legislation relating to disinformation in Brazil is still in progress, with greater progress after COVID-19. [https://journal.ciu.edu.ge/storage/articles/July2022/U3gaRK9olWAJZAUdy3pC.pdf Numerous bills have been raised] with different approaches to regulating disinformation, such as user-centered, non-content-focused approaches like identification and location requirements of users for platform access, and measures targeting businesses including transparency reports and complaint processes obligations.

</div>
<div>Due to the overarching societal and political backlash, Brazilian legislators have proposed a very large sum of bills that can be, one way or another, connected to challenges and the problems of the spread of disinformation. In particular, sixty-two disinformation bills were proposed between 2019 and 2022. Academics have tried to analyze the bills to understand the commonalities and differences – for example, one [https://misinforeview.hks.harvard.edu/article/framing-disinformation-through-legislation-evidence-from-policy-proposals-in-brazil/ analysis of these bills] showcased that many do not specify exactly which problem related to disinformation they aim to address, though a common focus is on election-related disinformation. This is particularly challenging due to the [https://misinforeview.hks.harvard.edu/article/framing-disinformation-through-legislation-evidence-from-policy-proposals-in-brazil/ use of one word, desinformação], to describe both intentional and unintentional spread of false information, with a lack of clear definitions in bills.

</div>
<div>Two main approaches are identified in the bills, the first being a focus on individual criminalization, and the second focusing on platform regulation. [https://journal.ciu.edu.ge/storage/articles/July2022/U3gaRK9olWAJZAUdy3pC.pdf The former was more popular pre-2020], whereas the latter has appeared in more bills after 2020.</div>
<div>While the landscape of Brazilian law on this topic is quite complex, inevitable uncertainty is present when it comes to which bills will be passed and what will be the legal framework chosen to protect the Brazilian people in the coming years. Nonetheless, what seems to be a commonality in the majority of the available academic writing on disinformation is the importance and prominence of the [https://www.tandfonline.com/doi/full/10.1080/13183222.2023.2201801 “Fake News Bill” PL 2630]. The following sections will focus on what are the present legally binding instruments governing the field, the unique role of the judicial branch in this context, and what the most talked about bill, Fake News Bill, has to offer as a mitigation strategy.</div>
<div> </div>
<div></div>

==== Pre-2020 approaches: Law 13.834/2019 ====

<div>The only law currently in place aiming to regulate disinformation is Law 13.834/2019, more specifically, Article 20. It criminalizes attributing an innocent person to a crime, particularly in the context of elections, to provoke criminal investigations. This Article [https://journal.ciu.edu.ge/storage/articles/July2022/U3gaRK9olWAJZAUdy3pC.pdf reflects the pre-2020 state of disinformation regulation] in Brazil, wherein regulatory approaches focused on the content of individual expressions and aimed to discourage individuals from spreading disinformation. This was done primarily through enhancing pre-existing punishments, such as for libel and defamation, and empowering both platforms and authorities to remove offending content. However, such approaches were critiqued for being heavy-handed in their impacts on freedom of expression.</div>
<div></div>

==== Post-2020 approaches ====

<div>The widespread disinformation claiming that the election that Bolsanaro lost and brought Lula into power was fraudulent brought disinformation regulation even more into policymakers' focus. However, criticisms regarding impacts on freedom of expression and the powers of the government still remained even with the new approaches taken in bills after 2020, which [https://journal.ciu.edu.ge/storage/articles/July2022/U3gaRK9olWAJZAUdy3pC.pdf focuses more on platform regulation] (obligations of content removal, advertisement, and complaint process transparency). Additionally, another development includes the growing role of the Supreme Court in tackling disinformation.</div>
<div></div>

==== The role of the judiciary and Supreme Court ====

<div>The Brazilian judiciary generally plays a large role in combating disinformation due to the [https://www.opendemocracy.net/en/democraciaabierta/brazil-crack-down-fake-news-disinformation-lula-restore-trust-internet/ ‘sluggishness’ of legislators] to pass effective legislation. The Electoral Justice has launched a [https://www.wilsoncenter.org/blog-post/combating-disinformation-brazilian-judiciary-initiatives-2024-municipal-elections Permanent Program to Combat Disinformation] particularly in an electoral context. This program involves an ‘Electoral Disinformation Alert System’ to help detect and respond to false content relating to the electoral process through collaboration with various platforms, companies, and fact-checking agencies. The judiciary collaborates with other public authorities and private institutions in the [https://www.wilsoncenter.org/blog-post/combating-disinformation-brazilian-judiciary-initiatives-2024-municipal-elections ‘Integrated Center for Confronting Disinformation and Defending Democracy’] which focuses on analysing, monitoring, and responding to disinformation. The Centre revolves around tackling disinformation that seeks to delegitimize public institutions and the electoral system through collaboration with platforms and fact-checking agencies. Lastly, the ‘Disinformation Combat Program’ is led by the Supreme Federal Court to address disinformation that impacts public perceptions of and trust in the Court.Additionally, the Supreme Court, more specifically, Justice Alexandre de Moraes, [https://www.opendemocracy.net/en/democraciaabierta/brazil-crack-down-fake-news-disinformation-lula-restore-trust-internet/ has taken a strong stance against fake news.] This is possible due to the strong powers attributed to the Supreme Court in Brazil, which acts as a constitutional court, final court of appeals, and a trial court for elected officials. Justice Moraes was responsible for the blocking of [https://www.france24.com/en/americas/20240831-brazil-block-on-social-media-platform-x-comes-into-effect-after-supreme-court-order X, formerly Twitter, in Brazil] due to [https://apnews.com/article/brazil-musk-x-twitter-moraes-bef06c0dbbb8ed87495b1afbb0edf211 Elon Musk’s unwillingness to comply] with Moraes’ order to block certain individuals associated with the 2023 attack on the Brazilian Congress. X was suspended in Brazil, but access was [https://www.cbsnews.com/news/brazil-supreme-court-lifts-ban-social-media-site-x-elon-musk/ reinstated after Musk] complied with the orders and settled the imposed fines worth $5.2 million. It was noted that such a judiciary order was something that was [https://noticias-stf-wp-prd.s3.sa-east-1.amazonaws.com/wp-content/uploads/wpallimport/uploads/2024/08/30203157/suspensao-item-2.pdf never done before], and critics question whether such actions go against due process. The president of the Brazilian Bar Association (OAB), [https://midiasimcloud.com.br/vegaseferreiraadv/oab-vai-ao-stf-por-revisao-ou-esclarecimento-de-multa-fora-do-devido-processo-para-quem-usar-vpn/ Beto Simonetti], voiced his concern and requested further review of the Supreme Court, specifically around the section of the decision to impose fines for VPN users attempting to access blocked platforms.</div>
<div> </div>
<div></div>

==== The Fake News Bill PL 2630 ====
Whilst the Fake News Bill takes on a platform regulation perspective, it still focuses primarily on the election context and also seeks to regulate messenger services considering their significant role in spreading disinformation during the 2018 elections. The [https://www.tandfonline.com/doi/full/10.1080/13183222.2023.2201801 original draft of the bill] had concerning rights implications relating to identification requirements, expansion of data retention requirements, and the monitoring of private communications, but many of these were phased out with multi-stakeholder consultations. However, it showcases how polarising disinformation regulation is in Brazil, due to its perceived urgent need with the rise of far-right disinformation campaigns and its high likelihood to impact human rights, particularly freedom of expression. The progress of the Bill can be followed [https://www25.senado.leg.br/web/atividade/materias/-/materia/141944 here].

<div>The March 2022 draft of the [https://www.tandfonline.com/doi/full/10.1080/13183222.2023.2201801 Bill features a variety of obligations as follows]. Unfortunately, following the progress and various drafts of the bills is complicated and inaccessible. However, the March 2022 draft was lauded by civil society organizations in Brazil and seems to represent the new approach of the legislators to be followed.
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>'''Chapter 1''' outlines the goals of the bill and definitions. </div>
<div>
*Bill aims to bolster the transparency of social networks, search engines, and instant messaging service providers.
</div>
<div>
*It applies to providers offering the aforementioned services in Brazil with over 10 million registered users.
</div>
|-
| style="width: 100%;" | <div>'''Chapter 2''' outlines the accountability obligations of those providers.</div>
<div>
*''Article 6'' requires all automated accounts to be identified as such to either the users or providers and for sponsored and automated content to be clearly defined to users.
</div>
<div>
*''Articles 9 and 10'' oblige providers to conduct half-yearly transparency reports focusing on the measures implemented to comply with the Bill’s applications, how many decisions taken pertaining to users were reverted after appeals, the systems used in content moderation, aggregated information on content which is ‘irregularly’ reaching greater audiences as identified by the provider, and the characteristics of the human content moderation team.
</div>
<div>
*''Article 13'' empowers legal authorities to request messaging services to register and disclose user interactions for up to 60 days during an investigation.
</div>
<div>
*''Article 15'' obliges platforms to implement procedural rights for users when their content is moderated.
</div>
|-
| style="width: 100%;" | <div>'''Chapter 3 '''introduces transparency criteria for boosted content and advertising with a specific focus on political advertising during electoral campaigns.</div>
<div>
*''Article 19'' requires providers to make public the amount spent by candidates and parties on online political advertising on their platforms, and other characteristics including the period of advertising circulation and general profiling categories of the targeted audience.
</div>
|-
| style="width: 100%;" | <div>'''Chapter 4''' includes a specific regime to apply to platform accounts of public administration and office holders.</div>
<div>
*Article 22 stipulates that politicians cannot block either journalists or non-governmental organisations.
</div>
<div>
*However, ‘parliamentary immunity’ is also extended to the content of the accounts, potentially protecting politicians from moderation decisions even if they participate in spreading false information.
</div>
|-
| style="width: 100%;" | '''Chapter 5''' addresses the promotion of media literacy.
|-
| style="width: 100%;" | '''Chapter 6 '''addresses sanctions to platforms based on turnover.
|-
| style="width: 100%;" | '''Chapter 7''' addresses the new functions of the Brazilian Internet Steering Committee (CGI.br) creating a co-regulatory mechanism.
|-
| style="width: 100%;" | '''Chapter 8''' obliges service providers to create their own self-regulating institutions.
|-
| style="width: 100%;" |
'''Chapter 9''' includes criminal sanctions for the dissemination of fake news.
*''Article 36'' states that criminal sanctions could be applied for the spreading of fake news if it either compromises the integrity of the electoral system or cause physical harm.
|}
</div>
<div></div>
<div> </div>
<div>
===== How does the Fake News Bill fit into other digital law in Brazil? =====
</div>
<div>
====== Setting the scene with MCI and LGPD ======
</div>
<div>After Brazil hosted the 2014 World Cup, there was great anticipation for the upcoming 2016 Olympic Games in Rio. The opportunity to have such large events in Brazil stimulated [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj a considerable amount of technological development] to take place in the country’s urban areas. As a consequence, social and digital inequalities between different regions of the country seem to have further advanced when it comes to Brazil’s marginalized populations. To aid these issues, Brazilian legislators decided to [https://www.cgi.br/pagina/marco-civil-law-of-the-internet-in-brazil/180#:~:text=1o%20This%20Law%20establishes,the%20municipalities%20in%20this%20regard. codify] “democratic principles of internet openness by advancing a civil right to internet access, protecting net neutrality, providing preliminary guidelines for data privacy, and protecting internet intermediaries.” This was done under the bill named the “Civil Rights Framework for the Internet,” or MCI in short, which was passed in 2014. At the time, the bill was [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj praised by scholars] as a tool with “democratizing potential”.</div>
<div>Soon after, the next step in the legislative agenda was an act focusing on data protection and privacy: the LGPD. While the MCI outlined the important democratic principles of Internet governance, the [https://iapp.org/resources/article/brazilian-data-protection-law-lgpd-english-translation/ LGPD] aimed at specific regulations concerning data privacy. LGPD set out various protections for individuals, and most notably, took heavy inspiration from the EU’s [https://eur-lex.europa.eu/eli/reg/2016/679/oj General Data Protection Regulation ](GDPR).</div>
<div> </div>
<div>
===== Critique of the ‘Fake News’ Bill =====
</div>
<div>While the ‘Fake News’ Bill provides a practical example of the challenges of combating disinformation, the spread of propaganda, and defamation in the digital and online environment, critics point out that it might also [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj pose threats] to the data protection principles of the LGPD, and to the “universal internet access and freedom of association provisions” of the MCI. For example, the initial draft of the Fake News Bill took a heavy-handed approach that clashed with both the LGPD and MCI. Even though Article 2 of the initial draft Fake News Bill explicitly mentions its compliance with the LGPD and MCI, Bill’s vagueness and ambiguity was still criticised as potentially posing a threat to freedom of expression and privacy safeguards. For example, the Bill obliges social media providers to monitor user identities by implementing mechanisms to mandate linking phone numbers of users to their accounts, allowing for potentially unauthorized surveillance. Another provision suggested that social media platforms should “track and store the chain of forwarded communications of Brazilian internet users,” connected to the risks of Whatsapp large-scale [https://scholarship.law.slu.edu/cgi/viewcontent.cgi?article=2281&context=lj messaging chains.]</div>
<div>Whilst the May 2022 draft of the Bill makes great strides in response to civil society consultation, this shows an underlying tension within the Brazilian legislature about how strict the approach towards disinformation should be. The harshness of the initially proposed measures is understandable in the Brazilian local context, where disinformation was overwhelmingly used by the far-right and supporters of Jair Bolsanaro to destabilize electoral processes.</div>
<div> </div>
<div>
===== Current progress of the bill =====
</div>
<div>Since the first draft was put out for discussion, the text of the Bill has seemingly changed many times, sometimes drastically Scholarly articles were written on a variety of drafts throughout this legislative process, and therefore it was challenging to distinguish and identify which draft is being discussed as well as which draft is currently standing and waiting to be approved. The above sections consequently aim to explain the overarching image and vision of the Fake News Bill, and its changing approaches. Therefore, a final conclusion is yet to be made, dependent on if the Bill is passed, and what final form it takes.</div>

=== China ===
In today's [https://dictionary.cambridge.org/dictionary/english/post-truth 'post-truth'] era, the phenomenon of [https://www.taylorfrancis.com/books/mono/10.4324/9780367815677/fake-news-context-lesley-farmer misinformation] and [https://www.eeas.europa.eu/sites/default/files/action_plan_against_disinformation.pdf disinformation] is not only pervasive but also deeply complex, exploiting emotions and biases to polarize audiences and provoke strong reactions. Beyond merely influencing public opinion, however, disinformation often intersects with criminal behaviors, including hate speech, harassment, and invasions of privacy. Technological advances like deep fakes have amplified these issues, enabling highly convincing yet misleading content that can be used for personal attacks or political manipulation. The semantic and regulatory challenges of combating cybercrimes associated with the dissemination of fake news are profound, especially when navigating varied legal definitions and the lack of consensus across different legal systems. For democratic states, regulatory debates around disinformation often focus on preserving freedom of expression while minimizing harm. However, in a tightly controlled, authoritarian context like China, disinformation takes on an additional layer of complexity. Here, the government itself defines and regulates what constitutes 'disinformation' often to reinforce state ideologies and stifle dissent rather than purely for public interest. In this context, the line between combating disinformation and controlling narratives blurs, raising fundamental questions about information integrity, government accountability, and the very definition of 'truth'. 

==== The Early Days (1997-2000) ====
In China, fake news are referred to as ''''online rumors'''' and the government has been dealing with them since the early development of the Internet. In April 1994, China officially accessed the [https://download.e-bookshelf.de/download/0017/6346/90/L-G-0017634690-0076175462.pdf Internet] and by 1997 it was already considering introducing laws to address the anticipated influx of allegedly false information associated with international connectivity. For this reason, the Ministry of Public Security enacted Decrees No. 195 and No. 33 to regulate network content. While Decree No. 195 prohibited the creation, access, copying, and dissemination of content that disrupts public order or contains obscene or pornographic material, Decree No. 33 specified nine categories of prohibited content, '''including fabricated or distorted facts, rumor-spreading that disturbs social order''', advocacy of feudal superstitions, obscenity, pornography, gambling, violence, murder, terror, and incitement to criminal activities. It also banned content that publicly insulted or slandered others by fabricating facts.
With the further rise of communication platforms like portals, chat rooms, blogs, the channels for internet users (''''netizens'''') expanded significantly, thus amplifying the social influence of online media and highlighting the value of public opinion on the Internet. However, according to the Chinese Government, along with the heightened influence, a large volume of false, illegal and harmful content has also appeared online.
Therefore, in December 2000, the Ministry of Culture, State Administration of Radio, Film, and Television, All-China Students' Federation, State Informatization Promotion Office, China Telecom, and China Mobile jointly initiated the 'Network Civilization Project'. Under [https://download.e-bookshelf.de/download/0017/6346/90/L-G-0017634690-0076175462.pdf Decree No. 292], the nine types of prohibited content, known as the 'Nine Prohibitions' already outlined in Decree No. 33, were confirmed and further specified and were 'information that endangers social stability and order, including rumor-spreading, social disorder, and activities that undermine social stability; along with content promoting obscenity, pornography, gambling, violence, murder, terror, or incitement to crime' outlawed.

==== PRC Criminal Law ====
In the era of Internet 2.0, individuals have transformed from passive recipients of information into active participants across various network activities, emphasizing the social dynamics of the internet. This shift has facilitated a surge in traditional crimes now committed online, with criminal activities on the internet continually increasing. To address this, the Standing Committee of the National People’s Congress (NPC) introduced the ''[https://download.e-bookshelf.de/download/0017/6346/90/L-G-0017634690-0076175462.pdf Decision on Guarding Internet Security]'' in 2000, extending the ''Criminal Law'' to cover actions such as spreading obscene information, rumor-mongering, slander, fraud, theft, and the unauthorized dissemination of state secrets online. 
China’s approach to criminalizing fake news took a significant step on August 29, 2015, when the Standing Committee of the NPC adopted the Ninth Amendment to the ''Criminal Law of the People’s Republic of China'' (PRC). This amendment, which included measures aimed at curbing false information, added Article 291a to the Criminal Law, criminalizing the spread of news that 'seriously disturbs public order' via information networks or other media channels. Offenders under this provision face a range of penalties, including criminal detention, public surveillance, or imprisonment for up to three years. For cases where misinformation is found to have severe consequences, penalties escalate to fixed-term imprisonment ranging from three to seven years. [http://www.npc.gov.cn/zgrdw/englishnpc/Law/2007-12/13/content_1384075.htm Paragraph 2 of Article 291a] explicitly targets the dissemination of false information related to critical situations—such as 'dangerous situations, epidemics, disasters, or alerts'—particularly if this dissemination leads to public disorder. This regulation covers both the creation and intentional sharing of known false information, thereby broadening liability to those who knowingly contribute to the spread of misinformation. The legislation reflects the government’s intention to preemptively address disinformation that could incite panic or social instability, framing the spread of false information as a direct threat to public order. This aligns with the state’s broader strategy of [https://maint.loc.gov/law/help/fake-news/china.php social control], where the management of information is paramount, especially regarding matters that could undermine public trust or prompt criticism of government actions.

==== The First Cybersecurity Law ====
On November 7, 2016, the NPC Standing Committee adopted the [http://www.npc.gov.cn/npc/index.html Cybersecurity Law of the PRC], which took effect on June 1, 2017. This law represents China’s first comprehensive legislation focused on cybersecurity and includes provisions that address the dissemination of fake news as part of a broader strategy to maintain social and economic order. Under Article 12, Paragraph 2, it is prohibited to manufacture or spread online fake news that could disturb social stability, harm the economy, or undermine public trust in institutions. 
Article 70 further outlines penalties for violations, stipulating that publication or transmission of prohibited information is subject to fines, shutdowns, and other penalties as defined by the relevant regulations. Article 74 states that violation of the Cybersecurity Law may even result in criminal sanctions, as provided by the Ninth Amendment to the PRC Criminal Law mentioned above. 
Importantly, the Cybersecurity Law empowers authorities to address disinformation not only by penalizing those directly responsible for creating or disseminating fake news but also by holding digital platforms accountable. Pursuant to [https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ Article 47], if a network operator identifies any content that is forbidden by law or regulation, it must promptly suspend its transmission, remove the content, take steps to prevent its further spread, maintain relevant records, and notify the appropriate government authority.

==== Administrative Measures on Internet Information Services ====
===== Licensing Requirements =====
To operate legally in China, social media platforms must hold a valid business license. The ''Administrative Measures on Internet Information Services'', a regulation issued by the State Council on September 25, 2000, applies to any service delivering online information. This regulation requires that commercial internet service providers obtain an operating license from the government, while nonprofit providers must complete a registration process with authorities. The regulation outlines various duties for internet information service providers to ensure cooperation with government authorities. For instance, providers are required to keep records of all published content, along with the exact time of publication, and maintain user information such as account details, IP addresses or domain names, and session durations. These records must be stored for at least sixty days and made available to government authorities upon request.

===== Real-Name Registration =====
Under Chinese law, social media users must provide real-name registration and other identity details to service providers. According to the ''Cybersecurity Law'', providers of information-sharing or messaging services must verify users' identities before granting access to these services. Service providers are prohibited from offering their services to users who have not completed this identity verification.
If service providers fail to enforce real-name registration, authorities may require corrective actions, suspend business operations, shut down websites, revoke licenses, or impose fines ranging from 50,000 to 500,000 yuan on the service providers and between 10,000 and 100,000 yuan on those responsible.

==== Provisions on Internet News Information Services ====
On May 2, 2017, China’s main internet regulatory body, the Cyberspace Administration of China (CAC), introduced the ''Provisions on Administration of Internet News Information Services''.

===== License Requirements =====
According to these provisions, any entity that offers internet news information services to the public—whether via websites, apps, online forums, blogs, microblogs, social media accounts, instant messaging tools, or live broadcasts—must secure an internet news information service license and operate within the license’s authorized scope. Only legal entities established within China's territory are eligible for these licenses, and both the responsible individuals and editors-in-chief must be Chinese citizens. Unauthorized provision of internet news services is subject to fines between 10,000 and 30,000 yuan.

===== Limitations on Reprinting News =====
Providers are restricted to reprinting news that originates from state-approved sources, including central or provincial news organizations, or other specified agencies. Reposted news must include the original source, author, title, and editor to maintain traceability of the information. Violations of these reprint regulations can result in warnings, orders to correct the issue, temporary suspensions, or fines from 5,000 to 30,000 yuan, with potential criminal charges.

===== Prohibited Content =====
The provisions forbid internet news service providers and users from creating, reproducing, publishing, or disseminating content that is barred under relevant laws and regulations. Authorities may issue warnings, enforce corrective measures, suspend services, or levy fines between 20,000 and 30,000 yuan for non-compliance, and violators may also face criminal prosecution.

===== Duties of Service Providers =====
If internet news service providers detect content that violates these provisions or other legal regulations, they are required to immediately halt the transmission, delete the content, maintain relevant records, and report to the appropriate government authorities. Additionally, the provisions reiterate the Cybersecurity Law’s requirement for real-name registration, mandating that service providers verify users' real identities when they access internet news publishing platforms. Non-compliance with these requirements can lead to penalties from state or local internet authorities under the ''Cybersecurity Law''.

==== Provisions on the Administration of Deep Synthesis of Internet-based Information Services (the 'Deep Synthesis Provisions') ====
China’s new Deep Synthesis Provisions, effective January 10, 2023, regulate 'deepfake' technologies—software that creates synthetic media such as text, images, audio, and video using generative models. Jointly issued by the Cyberspace Administration of China (CAC), Ministry of Industry and Information Technology, and Ministry of Public Security, the regulations outline responsibilities for deep synthesis providers and users across data security, transparency, content labeling, and technical security. According to this law, providers must establish criteria for identifying and managing false or harmful content, including user identity verification and algorithm review mechanisms. They must also label synthetic media, such as simulated voices or manipulated images, and report false information to [https://www.ox.ac.uk/event/chinas-deepfake-regulations-navigating-security-misinformation-and-innovation authorities].

==== The Introduction of 'Piyao' in 2018 ====
In 2018, the Chinese government launched 'Piyao', a platform dedicated to countering rumors and disinformation online. The term 'Piyao' itself means 'refute rumors' in Chinese. The platform is managed by the Cyberspace Administration of China (CAC) and serves as an official channel to debunk false information and provide what is claimed to be verified, factual content, particularly on topics deemed sensitive by the Chinese government. The platform distributes [https://tile.loc.gov/storage-services/service/ll/llglrd/2019713404/2019713404.pdf 'authentic'] news drawn from state-run media outlets, party-affiliated local newspapers, and multiple government agencies.

==== Platforms' Self-Regulation ====
In China, major platforms like Weibo and WeChat follow a model of corporate self-regulation that includes internal policies to counter false information, often in cooperation with the Cyberspace Administration of China (CAC). The CAC actively encourages the development of self-regulatory frameworks and industry standards to streamline information control across digital media. This partnership reflects a coordinated approach to information governance, where platforms align their policies with government priorities on sensitive topics. However, this cooperation has a more coercive dimension. On sensitive issues, the Chinese government has a history of employing intimidation tactics, both online and in the real world, to silence dissent and encourage self-censorship. Platforms perceived to deviate from state narratives, particularly on subjects like Xinjiang, Taiwan, or Hong Kong, can face punitive measures, and companies are pressured to comply or face potential repercussions. This extends beyond China's borders: Beijing has leveraged open societies within democratic countries to pursue legal action against critical voices, and it has extended technical censorship to [https://www.state.gov/gec-special-report-how-the-peoples-republic-of-china-seeks-to-reshape-the-global-information-environment/ overseas Chinese-speaking communities], notably on WeChat.

==== The Other Side of the Coin: Censorship in China ====
China’s media landscape is increasingly complex due to growing government intervention in digital spaces. Most Chinese users primarily engage on domestic platforms like WeChat, Weibo, and Toutiao for social interactions and news consumption. Research has shown that censorship and 'astroturfing'—organized efforts by the government or corporations to post comments that appear to be from ordinary users—are widespread on these platforms. The presence and perception of these activities can shape how people interpret content and express themselves online, influencing their views and stifling open dialogue on dominant topics. Censorship practices further restrict information flow, as social media sites are required to follow government directives and often use human moderators to monitor online content. The criteria for what constitutes 'sensitive' content are vague and constantly shifting, prompting platforms to enforce their own, often stricter, content removal policies to ensure compliance. Once content is flagged as sensitive, it is typically removed, with attempts to access it blocked. In some cases, the platform might display a notice explaining the reason for removal, though this depends on the platform's specific policies. This tight control of information creates an environment where counter-narratives are largely absent, allowing misinformation to circulate on key issues and [https://doi.org/10.1145/3313831.3376612 shaping public opinion] accordingly.
Finally, according to a report by the [https://tile.loc.gov/storage-services/service/ll/llglrd/2019713404/2019713404.pdf Global Engagement Center of the United States], the Chinese Government spends billions of dollars every year in order to promote abroad narratives favorable to the Chinese Communist Party (CCP) while stifling critical perspectives on controversial issues such as Taiwan, its human rights practices, and its domestic economy. Through a multifaceted strategy, Beijing aims to establish a global information environment that promotes its viewpoints and discourages criticism. This approach combines propaganda, censorship, digital authoritarianism, strategic partnerships, and influence over Chinese-language media to shape both domestic and international narratives in its favor.

=== India ===
==== Constitution ====
India’s constitution guarantees citizens the right to freedom of speech and expression in Article 19(1)(a). However, the Indian Constitution also says clearly that this right is not absolute; it can be limited by the State in some instances. Article 19(2) says that “reasonable restrictions” can legally be imposed on the freedom of speech and expression in the interests of “the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence.” ([https://cdnbbsr.s3waas.gov.in/s380537a945c7aaa788ccfcdf1b99b5d8f/uploads/2024/07/20240716890312078.pdf source]) Thus, there are a number of avenues for the State to place at least some restrictions on freedom of speech in India.
India is also a ratifying party to the International Covenant on Civil and Political Rights. Article 19 of the Covenant addresses freedom of expression and when it can be regulated. [source: https://www.ohchr.org/en/instruments-mechanisms/instruments/international-covenant-civil-and-political-rights] However, the Convention does not figure prominently in Indian legislation, which focuses on freedom of expression as regulated under India's Constitution.

==== Criminal law ====
In the area of online speech, one of the most important laws that has historically been used to regulate speech is the Indian Penal Code, which applies to all of India. The Indian Penal Code, which was first enacted in 1860, was recently replaced in 2023 by a new criminal law code, the Bharatiya Nyaya Sanhita (BNS) 2023. BNS Section 197(d) criminalizes certain politically oriented disinformation under the Constitutional exceptions to freedom of speech. Specifically, Section 197(d) imposes criminal penalties on anyone who, by spoken or written words, by signs or by visible representations, or through electronic communication or otherwise, “makes or publishes false or misleading information, jeopardising the sovereignty, unity and integrity or security of India.” The offense is punishable by imprisonment up to 3 years or by fine, or both. ([https://www.indiacode.nic.in/bitstream/123456789/20062/1/a2023-45.pdf#search=bharatiya source]) The BNS (and the previous Indian Penal Code) also criminalize certain types of hate speech.

==== Technology legislation ====
In the technology law field, another important law in India regulating online speech is the Information Technology Act of 2000 (the “IT Act”), another federal law that applies to all of India. The IT Act includes a list of offences punishable by fines, including offences which specifically deal with issues of speech that may be disfavored (speech that is deemed terrorism or obscene) or which is criminal; as well as false or unauthorized speech, such as fraud, breaches of privacy and unlawful disclosure of information. ([https://www.indiacode.nic.in/handle/123456789/1999?view_type=browse source])

===== Safe harbour framework =====
India’s safe harbor provision took its current form in 2011, in Section 79 of the IT Act, around the same time that India promulgated the Information Technology (Intermediary Guidelines) Rules 2011. To take advantage of the safe harbor, intermediaries must only provide the means of communication and not have a say in the content or who the user are. In addition, intermediaries are required to perform certain due diligence and to follow guidelines promulgated by the central government. If intermediaries aid and abet illegal actions or fail to expeditiously remove or disable access to content that is being used to commit an unlawful act, the safe harbor does not apply. (source: https://www.indiacode.nic.in/handle/123456789/1362/simple-search?query=Information%20Technology%20(Intermediaries%20Guidelines)%20Rules,%202011.&searchradio=rules)
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (the “IT Rules 2021”), which largely replaced the Information Technology (Intermediary Guidelines) Rules of 2011, govern online intermediaries in detail. The IT Rules 2021 were updated in 2023, including as to due diligence obligations for intermediaries. ([https://www.meity.gov.in/writereaddata/files/Information source])

===== Disinformation =====
In regard to disinformation, the IT Rules 2021 impose certain due diligence obligations on all intermediaries in Section 3(1)(b). Section 3(1)(b)(v) requires intermediaries to “make reasonable efforts by itself, and to cause the users of its computer resource to not host, display, upload, modify, publish, transmit, store, update or share any information that … deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates any misinformation or information which is patently false and untrue or misleading in nature or, in respect of any business of the Central Government, is identified as fake or false or misleading by such fact check unit of the Central Government as the Ministry may, by notification published in the Official Gazette, specify; impersonates another person…” Section 3(1)(d) imposes a requirement to take down content that is illegal when notified by an Agency.
When content is taken down, Section 3(1)(g) requires intermediaries to store the content for investigation purposes for at least 180 days or longer if ordered by a court. Section 3(1)(j) requires intermediaries to respond within 72 hours to written requests for information from government agencies which are authorized for investigative, protective or cybersecurity activities, for the purposes of verification of identity, or for the prevention, detection, investigation, or prosecution, of offences under any law for the time being in force, or for cyber security incidents.
Section 3(2) of the IT Rules 2021 requires intermediaries to implement a mechanism for users and victims to file complaints, which the Rules refer to as a “grievance redressal mechanism”. Complaints must be acknowledged within 24 hours and acted upon within 15 days. Section 3A also establishes a grievance appeal mechanism.
India also places additional rules on significant social media intermediaries (“SSMIs”), which are defined as intermediaries that have more than 50 lakh (5 million) registered users in India). ([https://www.meity.gov.in/writereaddata/files/Gazette source]) Section 4 of the IT Rules 2021 requires SSMIs (as well as online gaming intermediaries) to comply with additional due diligence obligations, including:
*appoint a Chief Compliance Officer who shall be responsible for ensuring compliance with the Act and who can be liable for failure to comply in some situations;
*appoint a nodal contact person for 24x7 coordination with law enforcement agencies and officers to ensure compliance to their orders or requisitions;
*appoint a Resident Grievance Officer who is responsible for the grievance redressal mechanism;
*publish monthly compliance reports of complaints received and actions taken, the number of links or parts of information removed or disabled in pursuance of any proactive monitoring via automated tools or other relevant information as may be specified.
*SSMIs also must enable the identification of the first originator of the information on its computer resource as may be required by judicial order in some cases (under certain constitutional exceptions to free speech, in cases of rape, sexually explicit material or child sex abuse material), subject to certain limitations on when such a judicial order can be issued and the scope of the order and what must be revealed.
When a SSMI disables or takes down material, including disinformation, it must ensure that prior to that time, it has provided the user whose information is coming down or being disabled with a notice explaining the reasons for the action, ensure a reasonable opportunity to dispute the action, and ensure the Resident Grievance Office has oversight. SSMIs also must respond to requests for other information from the government that the government may consider necessary for Section 4. Note that under Section 6 of the IT Rules 2021, social media intermediaries that do not meet the 5 million user threshold can still become subject to these higher obligations for SSMIs if they permit the publication or transmission of information in a manner that may create a material risk of harm to the sovereignty and integrity of India, security of the State, friendly relations with foreign States or public order.

===== News and publishers =====
Section 5 requires social media intermediaries to conduct additional due diligence for news and current affairs content. These intermediaries must put publishers of news and current affairs content under additional terms of service that requires the publishers to furnish the publisher’s user account information to the Ministry of Information and Broadcasting. Publishers can then receive a mark of verification.
Failure to comply with the IT Rules 2021 can result in loss of the safe harbor for the intermediary.
The IT Rules 2021 also contain a Code of Ethics and Procedure and Safeguards in Relation to Digital Media in Part III, which regulates publishers of news and current affairs content and online curated content that operate in India. The Code of Ethics imposes rules to prevent many types of problematic content, including hate speech, illegal content, content that may be harmful to children, etc. Through application of the existing journalistic and broadcasting codes, the Code also promotes the practice of providing accurate and reliable content and discourages sensationalism and fake news. ([https://mib.gov.in/sites/default/files/FAQs%20on%20Digital%20Media%20Ethics%20Code.pdf Source])

=== United States ===
==== Definitions ====
According to the European Commission’s High Level Group (HLEG), [https://digital-strategy.ec.europa.eu/en/library/final-report-high-level-expert-group-fake-news-and-online-disinformation disinformation] is defined as ‘false, inaccurate, or misleading information, designed, presented and promoted to intentionally cause public harm or for profit’. [https://digital-strategy.ec.europa.eu/en/policies/online-disinformation Misinformation] is defined as ‘misleading or inaccurate information shared by the people who don’t recognize it as such’.
In the U.S, clear definitions for "misinformation" and "disinformation" are not fully codified across all statutes. However, governmental agencies like the Cybersecurity and Infrastructure Security Agency (CISA) provide generally accepted definitions. [https://www.cisa.gov/topics/election-security/foreign-influence-operations-and-disinformation#:~:text=Disinformation%20is%20deliberately%20created%20to,mislead%2C%20harm%2C%20or%20manipulate Misinformation] is typically understood as false or inaccurate information shared without the intent to deceive. It occurs when incorrect information is spread inadvertently, often due to misunderstandings or mistakes, rather than a purposeful intent to mislead. [https://www.cisa.gov/topics/election-security/foreign-influence-operations-and-disinformation#:~:text=Disinformation%20is%20deliberately%20created%20to,mislead%2C%20harm%2C%20or%20manipulate Disinformation], by contrast, is false information deliberately crafted and disseminated with the intent to mislead, manipulate, or cause harm. Disinformation is frequently used in contexts involving political, social, or economic influence campaigns, such as [https://www.tandfonline.com/doi/full/10.1080/17577632.2024.2362483 election interference or propaganda efforts].

==== Freedom of Speech and Legal Protection ====
In [https://www.thefire.org/research-learn/john-stuart-mills-enduring-arguments-free-speech On Liberty], John Stuart Mill makes the case in favour of freedom of speech arguing that truth and ideas can only be achieved if both true and false statements and opinions are allowed to remain uncensored. Indeed, in the United States, false statements are often granted legal protection so as to protect other values and avoid a chilling effect on public discourse. As will be discussed below, the guarantee of free speech in the First Amendment also implements the values that underpin it, which include facilitating representative democracy and self-government, advancing knowledge and truth in the marketplace of ideas, promoting individual autonomy, self-expression and self-fulfilment.
Under the First Amendment to the U.S. Constitution:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.''
|}

As a general rule, the government may not regulate speech “because of its message, its ideas, its subject matter, or its content.” [Police Dep’t of Chicago v. Mosle, 408 U.S. 92, 95 (1972)].
The Congressional Research Service (CRS) published an In Focus [https://crsreports.congress.gov/product/pdf/IF/IF12180 report] in 2022 that says: 
*The Supreme Court has said the Free Speech Clause protects false speech when viewed as a broad category, but the government may restrict limited subcategories of false speech without violating the First Amendment.
*Defamation, fraud, political advertising, and broadcast speech are subject to special consideration. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | '''Case note: New York Times Co. v. Sullivan, 376 U.S. 254 (1964)'''
|-
| style="width: 100%;" | New York Times Co. v. Sullivan was a landmark U.S Supreme Court ruling on freedom of speech protections under the First Amendment to the U.S Constitution to restrict the ability of public officials to sue for defamation. The Court held that, in order to prove libel, a public official must show that what was said against them was made with actual malice – "that is, with knowledge that it was false or with reckless disregard for the truth."
This imposes a high threshold as it only applies to defamatory speech against public officials and only if actual malice is shown.The reasons are twofold. Protection of false speech is based on the concern of a chilling effect, where regulation of false speech would also chill true speech through fear of breaking the law. The Supreme Court has recognized that false statements may not add much value to the marketplace of ideas. Even so, there is a concern that by prohibiting false speech, the government would also “chill” more valuable speech, meaning it would cause people to self-censor out of fear of violating the law. Consequently, the First Amendment creates “breathing space” protecting the false statements and hyperbole that are “inevitable in free debate.” In the words of Justice Brennansaid: ‘even a false statement may be deemed to make a valuable contribution to a public debate’.
|}

==== Strict Scrutiny in Content-Based Legislation ====
As a general rule, if a US law targets speech based on its expressive content, that content-based regulation will trigger strict scrutiny analysis. Under strict scrutiny, a law is presumptively unconstitutional unless the government can show the challenged law is the least restrictive means of targeting speech while also serving a compelling governmental interest.  
{| class="wikitable" style="border-collapse: collapse; width: 100%; height: 46px;"
|- style="height: 23px;"
| style="width: 100%; height: 23px;" | '''Case note: United States v. Alvarez, 567 U.S. 709 (2012)''' 
|- style="height: 23px;"
| style="width: 100%; height: 23px;" |
In United States v. Alvarez, the U.S Supreme Court ruled that the Stolen Valor Act of 2005, a federal law prohibiting false statements about receiving military decorations or medals, was violating the First’s Amendment guarantee of the right to free speech.

The four-Justice plurality opinion clarified “that falsity alone may not suffice to bring the speech outside the First Amendment.” Thus, the plurality opinion applied strict scrutiny to the Stolen Valor Act as a content-based law.  Moreover, the Court held that the law was not sufficiently narrowly tailored because it punished false statements regardless of the context or purpose. Accordingly, there was no “direct causal link” showing the law’s broad scope was necessary to the government’s goal of protecting the integrity of the military honors system. 
|}

==== Election Speech ====
False, misleading, and intimidating speech has proliferated in both online and real world spaces, particularly as it relates to elections. Although the right to free speech is generally protected by the First Amendment, that right does not extend to saying anything, anywhere, in any manner. When governments identify efforts to intimidate, deter, or otherwise interfere with voters, the First Amendment allows them to safeguard the fundamental right of citizens to vote freely without fear, threat, or undue influence. Governments can also take steps to prevent, suppress, or remove false and misleading speech that seeks to disrupt the process of voting. 

{| class="wikitable" style="border-collapse: collapse; width: 100%; height: 122px;"
|- style="height: 76px;"
| style="width: 32.1782%; height: 76px;" | Are election related false statements Protected by the first Amendment?
| style="width: 67.8218%; height: 76px;" | Generally, yes, but [https://www.law.georgetown.edu/icap/wp-content/uploads/sites/32/2024/08/Fact-Sheet-False-Misleading-and-Intimidating-Election-Information.pdf not if they interfere with the voting process]. The Constitution protects lies, especially if they are not under oath and can be easily countered (United States v. Alvarez). However, false statements can be regulated in contexts such as fraud, defamation, libel, statements to government officials, perjury, misrepresentation as a government official, and misleading advertising or commercial speech.
|- style="height: 23px;"
| style="width: 32.1782%; height: 23px;" | What types of false statements about elections can be constitutionally prohibited?
| style="width: 67.8218%; height: 23px;" | [https://www.law.georgetown.edu/icap/wp-content/uploads/sites/32/2024/08/Fact-Sheet-False-Misleading-and-Intimidating-Election-Information.pdf Regulation allowed for misleading voting process information]: Governments can prohibit false or misleading speech about voting logistics, like when, where, or how to vote, to protect voter access (Minn. Voters All. v. Mansky). The government’s interest in protecting voting rights is emphasized, especially during election campaigns when false statements can have adverse public consequences (McIntyre v. Ohio Elections Comm’n).
|- style="height: 23px;"
| style="width: 32.1782%; height: 23px;" | Can the government regulate other types of election-related speech?
| style="width: 67.8218%; height: 23px;" | Yes, [https://www.law.georgetown.edu/icap/wp-content/uploads/sites/32/2024/08/Fact-Sheet-False-Misleading-and-Intimidating-Election-Information.pdf when necessary to protect voting integrity]. The Supreme Court has recognized that government has compelling interests in protecting voters “from confusion and undue influence,”and in “preserving the integrity of its election process” [Burson v. Freeman].  “Preventing voter intimidation and election fraud” is “necessary,” and “ensuring that every vote is cast freely, without intimidation or undue influence, is  a valid and important state interest” [Brnovich v. Democratic Nat’l Comm.]  Thus, where it is necessary to regulate speech about elections—a content-based category of speech that is subject to strict scrutiny—the government can take steps that are the least restrictive means necessary to protect this compelling interest.
|}
{| class="wikitable" style="border-collapse: collapse; width: 100%; height: 276px;"
|- style="height: 23px;"
| style="width: 100%; height: 23px;" | '''Case note: Social Media Influencer Sentenced for Election Interference in 2016 Presidential Race'''
|- style="height: 253px;"
| style="width: 100%; height: 253px;" | In a recent case, the [https://www.justice.gov/opa/pr/social-media-influencer-sentenced-election-interference-2016-presidential-race Department of Justice] successfully prosecuted a social media influencer who made online posts ahead of the 2016 election to “disseminate fraudulent messages that encouraged supporters of presidential candidate Hillary Clinton to ‘vote’ via text message or social media, which was legally invalid”.  Although the defendant challenged his prosecution by claiming that his deceptive posts were “political speech,” a federal court found that his speech was “merely a single element within a course of criminal conduct”—namely, a conspiracy to interfere with the right to vote [[https://harvardlawreview.org/print/vol-137/united-states-v-mackey/ United States v. Mackey]]. Accordingly, the speech was “integral to criminal conduct” and thus unprotected by the First Amendment. The court also found that intentionally false speech about voting procedures did not fall within the core of political speech and that it could be regulated by the government where it did not address the substance of what was on the ballot but instead dealt with access to the ballot. Thus, speech that harms the integrity of the election process—such as misinformation about where, when, or how to vote—can be regulated even where speech about a candidate or a candidate’s views, even if false, could not be.
|}

 

==== Role of Social Media Platforms ====
Recent events such as the Cambridge Analytics scandal or the allegations of Russian interference into the 2016 elections have shown how important online intermediaries and platforms are.
Online intermediaries and social media platforms have a large amount of freedom when it comes to speech violations. [https://crsreports.congress.gov/product/pdf/R/R46751#:~:text=Section%20230%20of%20the%20Communications,users%20of%20interactive%20computer%20services. Section 230] of title 47 of the U.S. Code, part of a codification of the Communications Act of 1934 (Section 9 of the Communications Decency Act / Section 509 of the Telecommunications Act of 1996) has been interpreted to mean that operators of Internet services are not publishers (and thus not legally liable for the words of third parties who use their services).
*Section 230(c)(1): "No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."
*Section 230 confers full immunity on ‘interactive computer services’, from liability for torts others commit on their websites or online forums, even if the provider fails to take action after receiving notice of the harmful or offensive content.
*Through the so-called Good Samaritan provision, this section also protects ISPs from liability for restricting access to certain material or giving others the technical means to restrict access to that material.

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | '''Case note: Murthy v Missouri, 603 U.S (2024)'''
|-
| style="width: 100%;" | In [https://www.supremecourt.gov/opinions/23pdf/23-411_3dq3.pdf Murthy v. Missouri], the Supreme Court rejected a suit brought by two states and several social media users against Executive Branch officials and agencies, claiming that government officials’ contacts with social media companies about misinformation related to the COVID-19 pandemic and the 2020 election violated First Amendment guarantees against government censorship [Murthy v. Missouri].
The Court emphasized that social media companies already had policies against misinformation and disinformation, which they enforced by “exercising their independent judgment” even after consulting with government officials as well as outside experts. The Court held that the plaintiffs lacked standing, in part because they could not “link past social media restrictions” imposed by the social media companies to the government officials’ communications in which they identified potential misleading and false speech. Most major social media companies have in place policies against election-related misinformation and disinformation. After Murthy, social media companies remain free to enforce these policies on their own platforms by exercising their own judgment and conferring with outside experts, including government officials who may reach out to alert them to potential false statements. Unless there is “evidence of continued pressure” from government officials to interfere with companies’ independent application of their content- moderation policies, companies are “free to enforce, or not enforce, those policies,” even if those decisions are informed by contacts with government actors.
|}

==== State Legislation ====
The federal government does not regulate false statement about the subject-matter of elections, but many states do. These laws impose liability for a number of different types of false claims.
[https://medialaw.unc.edu/wp-content/uploads/2021/08/State-Regulation-of-Election-Related-Speech.08.04.2021.pdf Thirty-eight states] have statutes that directly target the content of election-related speech:
*Sixteen states have statutes that prohibit false statements about a candidate for public office. 
*Fourteen states have statutes that prohibit false statements about a ballot measure, proposal, referendum, or petition before the electorate. 
*Thirteen states have statutes that prohibit false statements about voting requirements or procedures.
* Eleven states have statutes that prohibit false statements about the source, authorization, or sponsorship of a political advertisement or about a speaker’s affiliation with an organization, candidate, or party. 
*Nine states have statutes that prohibit false statements that a candidate, party, or ballot measure has the endorsement or support of a person or organization. 
*Seven states have statutes that prohibit false statements about incumbency.
A number of states have false statement laws that explicitly apply to online actions and that can be applied to election deception.
*California law prohibits “political cyber-fraud,” which includes intentionally causing visitors to believe advocacy or information posted on a political website represents the views of candidate or someone in favor or opposed to a ballot measure, when it does not [Cal. Penal Code 18320-18323).
*[http://www.theguardian.com/technology/ng-interactive/2019/jun/22/the-rise-of-the-deepfake-and-the-threat-to-democracy Texas law] (and California law until 2022) prohibits distribution of election-related “deepfakes,” which use artificial intelligence to create highly realistic videos that appear to portray real people when they do not.

=== South Africa ===
</div>

Module 2: Data

2025-09-30T15:21:28Z

NadineWalsh: /* Comparison between PoPIA and GDPR */

= Transfer of Data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.=== Council of Europe / Convention 108+=== Convention 108: Nature   ===
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

 
=== Council of Europe ===

=== Convention 108: Nature ===
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

=== Convention 108: Scope and Provisions ===
Chapter 3 of the Convention engages with the topic of transborder data flows. To be precise, article 12 aims to ‘reconcile the requirements of effective data protection with the principle of free flow of information, regardless of frontiers’. Essentially, it aims to balance the existence of strong data protection for personal data protections along with the free flow of information across borders, which is directly linked to article 10 of the European Convention on Human Rights. 

 The idea of transborder data flows, in paragraph 1, has been worded in broad terms to encompass the multitude of ways in which data can be transferred and stored. As such, these rules will apply regardless of the variety of factors determining data transfers, specifically concerning data collection for purposes of avoiding data being gathered in one state and processed in another. Next, the paragraph specifies that the article applies only to transfer of personal data, however if contracting states have decided to include data on legal persons, then those will also fall under these rules. Importantly, the article is only focused on the export of data, not the import. Imports are not considered an issue as the receiving state’s data protection rules will become applicable. As such, it is the exporting state which has the duty to take necessary measures as laid down in article 12. 

 According to the Explanatory Report, the main rule is that Parties may not require special authorizations for data transfers for the sole purpose of protecting privacy, as all parties are already expected to provide a minimum standard of protection. However, parties may request declarations from data controllers to stay informed on data traffic between its territory on another party to the Convention. Additionally, Parties may lay down in their domestic data protection laws certain restrictions on transfers in certain situations, however this exception is not further specified. Importantly, the exporting Party must have proof of such behavior and in case the non-party has satisfactory data protection, the exporting Party may waive its restrictions.   

 Lastly, a Party may derogate from the main rule in two instances. In case a Party has a higher level of protection for certain categories of personal data than another, this may block the data from being transferred or additional authorizations may be required. If the receiving Party has an equivalent level of protection, this exception cannot be relied upon. The second exception pertains to circumstances in which a Party merely acts as an intermediary destination, for the data to finally arrive in the territory of a non-Party, for purposes of circumvention. 

 Finally, the Additional Protocol provides rules on the transfer of personal data to non-parties to the Convention. Parties may only transfer data to a non-party ‘if that State or organisation ensures an adequate level of protection’. However, in case the receiving state does not offer adequate protections, a Party may still authorise a transfer if domestic law provides for it due to specific interests of the data subject or legitimate prevailing interests, especially public interest. Additionally, data may still be sent if the controller provides for adequate safeguards, which are considered appropriate by the competent authorities under domestic law.  

===

=== Brazil ===

==== Introduction ====Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.<div>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" |Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

==== Broader data protection landscape ====We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. '''Constitutional / fundamental rights model'''Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: ''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' ''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''In 2022, the Constitution was amended to include a specific right to data protection: ''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{|
|-
|'''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>

|}

==== The General Data Protection Law (LGPD) ====The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:

*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  '''Scope of Application'''We have considered the scope of application in three ways: personal, material and territorial. 

*Personal ScopeThe LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material ScopeThe LGDP applies to any processing operation of personal data. 

::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scopeThe LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 

***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).'''Processing of Personal Data'''Controllers and Processors (Articles 5, 37-40, 42-43) 

*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):

*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :

*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== Interaction of the Law and the Regulation ====In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 

*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

==== Substantive detail of cross border data flows ====Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. In no hierarchy, there are various mechanisms that permit international data transfers. 

*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

===== When are data transfers allowed? =====The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 

#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

===== Adequacy decisions =====We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 

*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; andII - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

===== Contractual measures ====='''Standard contractual clauses'''The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |CLAUSE 2. Purpose2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.

*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:(NOTE: fill in as much detail as possible with information relating to the international transfer)

|}

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).'''Equivalent Standard Contractual Clauses'''Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.'''Global Corporate Standards (or Binding Corporate Rules)'''A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).

*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

===== Transparency Requirements =====All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 

#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

=== China ===China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

==== The Cybersecurity Law ====In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |[https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''

|}Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:

*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

==== The Personal Information Protection Law ====''''''The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''

*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:

*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

==== The Data Security Law ====''''''

''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''

|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|}
==== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ====''''''A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].

[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

==== The Digital Silk Road ====''''''

''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

=== India ===
==== Introduction ====In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the [https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.

==== Information Technology Act, 2000 ====Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.'Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 

==== Digital Personal Data Protection Act, 2023 ====
===== Scope of Application =====The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.

===== Cross-Border Data Transfer =====Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.

*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

=== United States ===

The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

==== Federal level ====

===== Privacy Act (1974) =====
The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal informationThis Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

===== Executive Order 14117 (February 28, 2024) =====
A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

===== PADFA (HR 815, Pub. L. 118-50) =====
Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.

===== Examples of federal sectorial legislation =====
'''Health and medical data (HIPAA)'''The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').

''''''''Financial data privacy'''

The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.   The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].

''''''''Data protection for children (COPPA)'''

In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation. COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees. 

==== US State Laws ====In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

=== South Africa ===
== South Africa’s Regulatory Framework ==
=== Data protection- legal framework and nature ===
South Africa’s regulatory framework concerning cross-border data transfers is based on the constitutional right to privacy, enshrined in Section 14 of the country’s constitution. The protection of personal Information Act 4 of 2013 (POPIA) purpose is to give effect to this constitutional right to privacy (Section 2 (1) POPIA).The act aims to achieve this by regulating the way in which a public or private body, named by the act as the “Responsible Party” (Section 1, Section 3 (1) POPIA, see also) may process personal information in harmony with international standards, while providing “persons” with rights and remedies (Section 2 (2-3) POPIA) . Interestingly, the act defines a “person” as a “natural person or a juristic person”, unlike the GDPR or convention 108, thus including legal entities within its scope and eligible for protection (Section 1, POPIA). The act does not apply to personal information processing conducted in purely personal or household activity (Section 6 POPIA)The act also establishes the Information Regulator as the dedicated independent supervisory authority to promote, enforce and fulfil the rights protected by this Act (Section 2 (4), Section 39, Section 55 POPIA). As part of the Information regulator’s responsibility, is the publishing of an annual report regarding meant to increase transparency and privacy protection (Annual report of 2023-2024)
=== Cross border data transfer- specific provision and conditions ===
Within POPIA, cross data transfers, or “transfers of personal information”, are subject to the conditions laid out in Section 72 (1) of the Act. A responsible party may not transfer personal information to a third party who is in a foreign country unless one of the specific provisions in Section 72 (1) applies.The first condition is that the protection to personal data provided by the recipient should be substantially similar to the conditions under the POPIA (Section 72(1)(a)). The protection can be provided by the law to which the recipient is subject, by binding corporate rules, or by binding agreements.The second condition is data subjects’ consent to the transfer (Section 72(1)(b)). If special personal information or children’s personal information is transferred to a jurisdiction providing no adequate protection, prior authorisation must be requested from the information regulator (Section 57(1)(d)).The third condition is the necessity for performing a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject’s request (Section 72(1)(c)). One example is transfers of personal information to reserve an airline ticket for a passenger.The fourth condition is the necessity of concluding or performing a contract between the responsible party and the recipient in the interest of the data subject (Section 72(1)(d)), for example, where a data subject is the beneficiary of a payment to be made by another to the responsible party.The last condition is the benefit of the data subject (Section 72(1)(e)). This happens where it is not reasonably practicable to obtain the data subject’s consent for the transfer, and the data subject would be likely to give consent if it were reasonably practicable, for example, where an unconscious South African needs medical assistance in a foreign country and his medical record in South Africa is requested.

==== Malabo Convention & AfCFTA Protocol on Digital Trade ====
South Africa has signed but not ratified the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention). The Convention forbids a data controller from transferring personal data to a non-Member State of the African Union ensuring no adequate protection, unless prior authorization from the national protection authority is obtained.(Article 14(6))
South Africa is also a party to the Protocol to the Agreement Establishing the African Continental Free Trade Area on Digital Trade, which has not come into force as the Annexes are still under negotiation.
The Protocol addresses “digital trade”, i.e., digitally enabled transactions of trade in goods and services that can either be digitally or physically delivered, and that involve natural and juridical persons (Article 1(g)). State Parties shall, subject to the Annex on Cross-Border Data Transfers, allow cross-border transfer of data, including personal data, by electronic means, provided the activity is for conducting digital trade by a person of a State Party (Article 20(1)). The Annex requires State Parties to provide equivalent protection (Article 7). General exceptions include public policy, lack of equivalent protection, and restrictions on sensitive personal data (Articles 24, 25, 26).
Notably, the Protocol to the Agreement Establishing the African Continental Free Trade Area on Digital Trade and the Annex on Cross-Border Data Transfers covers non-personal data, as “data” refers to any information and data, other than personal data as defined in Article 1(q) of the Protocol, required, stored, used, processed, or collected by a person of a State Party (Article 1(e) of the Annex).

<h4 class="mwt-heading" >National Policy on Data and Cloud</h4>
In 2024 South Africa published the National Policy on Data and Cloud. The Policy points out that the government “might be approached by other countries and organisations that seek data-sharing arrangements in certain areas, such as health, environment, fauna and flora”, and that any agreement on transfer of such data should respect South Africa’s security and sovereignty (Section 15.4).
The Policy requires that the government data incorporating content pertaining to the protection and preservation of national security and sovereignty must be stored only in digital infrastructure located in South Africa, and cross-border data transfer agreements must meet the criteria of promoting national interests, complying with data protection and security laws, and enhancing mutually beneficial cooperation, etc. (Section 15.4.3)

=== Comparison between PoPIA and GDPR ===
In a comparative approach between section 72 of PoPIA and the provisions in the European GDPR, Coetzee emphasises the difference in breadth that both pieces of legislation offer to regulate the transfer of personal information across the borders of the respective [https://www.saflii.org/za/journals/PER/2024/48.html jurisdictions].

 A closer read of these conditions give rise to a number of concerns, namely the limited meaning of the terms “responsible party” in Article 72(1) of PoPIA, which can be understood as giving operators or processors of data, acting on behalf of a responsible party, free reign, as section 72 does not apply. In the comparison with the equivalent GDPR article (44), PoPIA falls short of regulating the “transfer of personal information by an operator in the Republic to a third party outside the [https://www.saflii.org/za/journals/PER/2024/48.pdf Republic]”.
Other sections of PoPIA could be employed here, however, to ensure that personal information remains protected, namely section 20 and 21, which address situations of operators processing information on behalf of a responsible party. The regulation requires processors of information, on behalf of a third party / responsible party, to have the knowledge / authority of such party; this should be captured in a contract, outlining that secure measures are in place to safeguard such [https://www.saflii.org/za/journals/PER/2024/48.pdf information]. This speaks for the fact that, although PoPIA is modelled on the GDPR, it has a relatively loose approach.

 Section 72 provides several exceptions, i.e. it allows third parties to not require compliance with the provisions for the transfer of data. The first one being where the data subject has provided consent and the second one where the transfer of data is in the interest of the data subject. The fact that these situations should always be in the interest of public policy and are therefore to be read and interpreted “restrictively” is [https://www.saflii.org/za/journals/PER/2024/48.pdf paramount].

 Ferracane outlines the “conditional flow regime” a term she coined to describe the level of restrictiveness of cross border movement of data as being the basis of both the European GDPR and the South African PoPIA legislation.
Strict restrictions being neither desirable nor planned by South Africa as it practises the conditional data flow regime. Neither it is likely to see restrictions being imposed on any local storage and processing requirements, providing relative freedom to data processors and operators.
Three options are outlined for South Africa to “position itself in the international discussions on data flows”, namely maintaining the status quo, further liberalisation, and imposing new restrictions on data [https://saiia.org.za/wp-content/uploads/2018/04/GA_Th3_DP-Ferracane_20180411.pdf flows].

=== An African Solution ===
This is also one of the essences of Babalola’s article, titling personal data as being the “life blood of economic [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl development]”.
Babalola provides us with a number of recommendations, part of this is what he calls an “African Solution”. The notion of ‘borrowed concepts’ of privacy, data protection, and data localisation come also into play in this article, meaning not inherently African or of similar importance as in Europe. Especially, as the African Charter on Human and People’s Rights does not provide any focus on privacy. Babalola therefore declares that by this function, privacy is “not a fundamental right at regional level”. Hence, the author advises African countries to enter into multi-party agreements for the regulation of Transborder Data Flows (TDF), with the aim to create uniformity not only on purpose but also to enforce TDF within as well as outside of the African [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl region].

 By using the European example, not only for the implementation of PoPIA in South Africa but also for the collaboration between countries within the region, African nations can device bespoke standards of data protection for the safeguarding of rights and freedoms and therefore create a more cohesive level of rule systems for citizens and residents, whilst anchoring this in the African context of trade and economy.
The limitations to these recommendations are due to the fact that not all nations of the African Union have data protection rules in place, which in most cases is linked to a “lack of political will, competing priorities, and financial constraints” but the remaining countries have the power, the knowledge, and the experience to be regulation on behalf of the wider [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl union].

Module 2: Data

2025-09-30T15:21:10Z

NadineWalsh: /* An African Solution */

= Transfer of Data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.=== Council of Europe / Convention 108+=== Convention 108: Nature   ===
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

 
=== Council of Europe ===

=== Convention 108: Nature ===
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

=== Convention 108: Scope and Provisions ===
Chapter 3 of the Convention engages with the topic of transborder data flows. To be precise, article 12 aims to ‘reconcile the requirements of effective data protection with the principle of free flow of information, regardless of frontiers’. Essentially, it aims to balance the existence of strong data protection for personal data protections along with the free flow of information across borders, which is directly linked to article 10 of the European Convention on Human Rights. 

 The idea of transborder data flows, in paragraph 1, has been worded in broad terms to encompass the multitude of ways in which data can be transferred and stored. As such, these rules will apply regardless of the variety of factors determining data transfers, specifically concerning data collection for purposes of avoiding data being gathered in one state and processed in another. Next, the paragraph specifies that the article applies only to transfer of personal data, however if contracting states have decided to include data on legal persons, then those will also fall under these rules. Importantly, the article is only focused on the export of data, not the import. Imports are not considered an issue as the receiving state’s data protection rules will become applicable. As such, it is the exporting state which has the duty to take necessary measures as laid down in article 12. 

 According to the Explanatory Report, the main rule is that Parties may not require special authorizations for data transfers for the sole purpose of protecting privacy, as all parties are already expected to provide a minimum standard of protection. However, parties may request declarations from data controllers to stay informed on data traffic between its territory on another party to the Convention. Additionally, Parties may lay down in their domestic data protection laws certain restrictions on transfers in certain situations, however this exception is not further specified. Importantly, the exporting Party must have proof of such behavior and in case the non-party has satisfactory data protection, the exporting Party may waive its restrictions.   

 Lastly, a Party may derogate from the main rule in two instances. In case a Party has a higher level of protection for certain categories of personal data than another, this may block the data from being transferred or additional authorizations may be required. If the receiving Party has an equivalent level of protection, this exception cannot be relied upon. The second exception pertains to circumstances in which a Party merely acts as an intermediary destination, for the data to finally arrive in the territory of a non-Party, for purposes of circumvention. 

 Finally, the Additional Protocol provides rules on the transfer of personal data to non-parties to the Convention. Parties may only transfer data to a non-party ‘if that State or organisation ensures an adequate level of protection’. However, in case the receiving state does not offer adequate protections, a Party may still authorise a transfer if domestic law provides for it due to specific interests of the data subject or legitimate prevailing interests, especially public interest. Additionally, data may still be sent if the controller provides for adequate safeguards, which are considered appropriate by the competent authorities under domestic law.  

===

=== Brazil ===

==== Introduction ====Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.<div>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" |Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

==== Broader data protection landscape ====We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. '''Constitutional / fundamental rights model'''Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: ''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' ''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''In 2022, the Constitution was amended to include a specific right to data protection: ''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{|
|-
|'''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>

|}

==== The General Data Protection Law (LGPD) ====The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:

*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  '''Scope of Application'''We have considered the scope of application in three ways: personal, material and territorial. 

*Personal ScopeThe LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material ScopeThe LGDP applies to any processing operation of personal data. 

::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scopeThe LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 

***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).'''Processing of Personal Data'''Controllers and Processors (Articles 5, 37-40, 42-43) 

*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):

*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :

*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== Interaction of the Law and the Regulation ====In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 

*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

==== Substantive detail of cross border data flows ====Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. In no hierarchy, there are various mechanisms that permit international data transfers. 

*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

===== When are data transfers allowed? =====The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 

#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

===== Adequacy decisions =====We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 

*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; andII - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

===== Contractual measures ====='''Standard contractual clauses'''The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |CLAUSE 2. Purpose2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.

*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:(NOTE: fill in as much detail as possible with information relating to the international transfer)

|}

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).'''Equivalent Standard Contractual Clauses'''Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.'''Global Corporate Standards (or Binding Corporate Rules)'''A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).

*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

===== Transparency Requirements =====All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 

#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

=== China ===China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

==== The Cybersecurity Law ====In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |[https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''

|}Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:

*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

==== The Personal Information Protection Law ====''''''The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''

*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:

*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

==== The Data Security Law ====''''''

''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''

|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|}
==== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ====''''''A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].

[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

==== The Digital Silk Road ====''''''

''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

=== India ===
==== Introduction ====In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the [https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.

==== Information Technology Act, 2000 ====Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.'Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 

==== Digital Personal Data Protection Act, 2023 ====
===== Scope of Application =====The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.

===== Cross-Border Data Transfer =====Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.

*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

=== United States ===

The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

==== Federal level ====

===== Privacy Act (1974) =====
The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal informationThis Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

===== Executive Order 14117 (February 28, 2024) =====
A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

===== PADFA (HR 815, Pub. L. 118-50) =====
Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.

===== Examples of federal sectorial legislation =====
'''Health and medical data (HIPAA)'''The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').

''''''''Financial data privacy'''

The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.   The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].

''''''''Data protection for children (COPPA)'''

In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation. COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees. 

==== US State Laws ====In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

=== South Africa ===
== South Africa’s Regulatory Framework ==
=== Data protection- legal framework and nature ===
South Africa’s regulatory framework concerning cross-border data transfers is based on the constitutional right to privacy, enshrined in Section 14 of the country’s constitution. The protection of personal Information Act 4 of 2013 (POPIA) purpose is to give effect to this constitutional right to privacy (Section 2 (1) POPIA).The act aims to achieve this by regulating the way in which a public or private body, named by the act as the “Responsible Party” (Section 1, Section 3 (1) POPIA, see also) may process personal information in harmony with international standards, while providing “persons” with rights and remedies (Section 2 (2-3) POPIA) . Interestingly, the act defines a “person” as a “natural person or a juristic person”, unlike the GDPR or convention 108, thus including legal entities within its scope and eligible for protection (Section 1, POPIA). The act does not apply to personal information processing conducted in purely personal or household activity (Section 6 POPIA)The act also establishes the Information Regulator as the dedicated independent supervisory authority to promote, enforce and fulfil the rights protected by this Act (Section 2 (4), Section 39, Section 55 POPIA). As part of the Information regulator’s responsibility, is the publishing of an annual report regarding meant to increase transparency and privacy protection (Annual report of 2023-2024)
=== Cross border data transfer- specific provision and conditions ===
Within POPIA, cross data transfers, or “transfers of personal information”, are subject to the conditions laid out in Section 72 (1) of the Act. A responsible party may not transfer personal information to a third party who is in a foreign country unless one of the specific provisions in Section 72 (1) applies.The first condition is that the protection to personal data provided by the recipient should be substantially similar to the conditions under the POPIA (Section 72(1)(a)). The protection can be provided by the law to which the recipient is subject, by binding corporate rules, or by binding agreements.The second condition is data subjects’ consent to the transfer (Section 72(1)(b)). If special personal information or children’s personal information is transferred to a jurisdiction providing no adequate protection, prior authorisation must be requested from the information regulator (Section 57(1)(d)).The third condition is the necessity for performing a contract between the data subject and the responsible party, or for the implementation of pre-contractual measures taken in response to the data subject’s request (Section 72(1)(c)). One example is transfers of personal information to reserve an airline ticket for a passenger.The fourth condition is the necessity of concluding or performing a contract between the responsible party and the recipient in the interest of the data subject (Section 72(1)(d)), for example, where a data subject is the beneficiary of a payment to be made by another to the responsible party.The last condition is the benefit of the data subject (Section 72(1)(e)). This happens where it is not reasonably practicable to obtain the data subject’s consent for the transfer, and the data subject would be likely to give consent if it were reasonably practicable, for example, where an unconscious South African needs medical assistance in a foreign country and his medical record in South Africa is requested.

==== Malabo Convention & AfCFTA Protocol on Digital Trade ====
South Africa has signed but not ratified the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention). The Convention forbids a data controller from transferring personal data to a non-Member State of the African Union ensuring no adequate protection, unless prior authorization from the national protection authority is obtained.(Article 14(6))
South Africa is also a party to the Protocol to the Agreement Establishing the African Continental Free Trade Area on Digital Trade, which has not come into force as the Annexes are still under negotiation.
The Protocol addresses “digital trade”, i.e., digitally enabled transactions of trade in goods and services that can either be digitally or physically delivered, and that involve natural and juridical persons (Article 1(g)). State Parties shall, subject to the Annex on Cross-Border Data Transfers, allow cross-border transfer of data, including personal data, by electronic means, provided the activity is for conducting digital trade by a person of a State Party (Article 20(1)). The Annex requires State Parties to provide equivalent protection (Article 7). General exceptions include public policy, lack of equivalent protection, and restrictions on sensitive personal data (Articles 24, 25, 26).
Notably, the Protocol to the Agreement Establishing the African Continental Free Trade Area on Digital Trade and the Annex on Cross-Border Data Transfers covers non-personal data, as “data” refers to any information and data, other than personal data as defined in Article 1(q) of the Protocol, required, stored, used, processed, or collected by a person of a State Party (Article 1(e) of the Annex).

<h4 class="mwt-heading" >National Policy on Data and Cloud</h4>
In 2024 South Africa published the National Policy on Data and Cloud. The Policy points out that the government “might be approached by other countries and organisations that seek data-sharing arrangements in certain areas, such as health, environment, fauna and flora”, and that any agreement on transfer of such data should respect South Africa’s security and sovereignty (Section 15.4).
The Policy requires that the government data incorporating content pertaining to the protection and preservation of national security and sovereignty must be stored only in digital infrastructure located in South Africa, and cross-border data transfer agreements must meet the criteria of promoting national interests, complying with data protection and security laws, and enhancing mutually beneficial cooperation, etc. (Section 15.4.3)

==== Comparison between PoPIA and GDPR ====
In a comparative approach between section 72 of PoPIA and the provisions in the European GDPR, Coetzee emphasises the difference in breadth that both pieces of legislation offer to regulate the transfer of personal information across the borders of the respective [https://www.saflii.org/za/journals/PER/2024/48.html jurisdictions].

 A closer read of these conditions give rise to a number of concerns, namely the limited meaning of the terms “responsible party” in Article 72(1) of PoPIA, which can be understood as giving operators or processors of data, acting on behalf of a responsible party, free reign, as section 72 does not apply. In the comparison with the equivalent GDPR article (44), PoPIA falls short of regulating the “transfer of personal information by an operator in the Republic to a third party outside the [https://www.saflii.org/za/journals/PER/2024/48.pdf Republic]”.
Other sections of PoPIA could be employed here, however, to ensure that personal information remains protected, namely section 20 and 21, which address situations of operators processing information on behalf of a responsible party. The regulation requires processors of information, on behalf of a third party / responsible party, to have the knowledge / authority of such party; this should be captured in a contract, outlining that secure measures are in place to safeguard such [https://www.saflii.org/za/journals/PER/2024/48.pdf information]. This speaks for the fact that, although PoPIA is modelled on the GDPR, it has a relatively loose approach.

 Section 72 provides several exceptions, i.e. it allows third parties to not require compliance with the provisions for the transfer of data. The first one being where the data subject has provided consent and the second one where the transfer of data is in the interest of the data subject. The fact that these situations should always be in the interest of public policy and are therefore to be read and interpreted “restrictively” is [https://www.saflii.org/za/journals/PER/2024/48.pdf paramount].

 Ferracane outlines the “conditional flow regime” a term she coined to describe the level of restrictiveness of cross border movement of data as being the basis of both the European GDPR and the South African PoPIA legislation.
Strict restrictions being neither desirable nor planned by South Africa as it practises the conditional data flow regime. Neither it is likely to see restrictions being imposed on any local storage and processing requirements, providing relative freedom to data processors and operators.
Three options are outlined for South Africa to “position itself in the international discussions on data flows”, namely maintaining the status quo, further liberalisation, and imposing new restrictions on data [https://saiia.org.za/wp-content/uploads/2018/04/GA_Th3_DP-Ferracane_20180411.pdf flows].
=== An African Solution ===
This is also one of the essences of Babalola’s article, titling personal data as being the “life blood of economic [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl development]”.
Babalola provides us with a number of recommendations, part of this is what he calls an “African Solution”. The notion of ‘borrowed concepts’ of privacy, data protection, and data localisation come also into play in this article, meaning not inherently African or of similar importance as in Europe. Especially, as the African Charter on Human and People’s Rights does not provide any focus on privacy. Babalola therefore declares that by this function, privacy is “not a fundamental right at regional level”. Hence, the author advises African countries to enter into multi-party agreements for the regulation of Transborder Data Flows (TDF), with the aim to create uniformity not only on purpose but also to enforce TDF within as well as outside of the African [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl region].

 By using the European example, not only for the implementation of PoPIA in South Africa but also for the collaboration between countries within the region, African nations can device bespoke standards of data protection for the safeguarding of rights and freedoms and therefore create a more cohesive level of rule systems for citizens and residents, whilst anchoring this in the African context of trade and economy.
The limitations to these recommendations are due to the fact that not all nations of the African Union have data protection rules in place, which in most cases is linked to a “lack of political will, competing priorities, and financial constraints” but the remaining countries have the power, the knowledge, and the experience to be regulation on behalf of the wider [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl union].

Module 2: Data

2025-09-30T15:10:38Z

NadineWalsh: /* Title - ROM */

= Transfer of Data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.=== Council of Europe / Convention 108+=== Convention 108: Nature   ===
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

 
=== Council of Europe ===

=== Convention 108: Nature ===
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

=== Convention 108: Scope and Provisions ===
Chapter 3 of the Convention engages with the topic of transborder data flows. To be precise, article 12 aims to ‘reconcile the requirements of effective data protection with the principle of free flow of information, regardless of frontiers’. Essentially, it aims to balance the existence of strong data protection for personal data protections along with the free flow of information across borders, which is directly linked to article 10 of the European Convention on Human Rights. 

 The idea of transborder data flows, in paragraph 1, has been worded in broad terms to encompass the multitude of ways in which data can be transferred and stored. As such, these rules will apply regardless of the variety of factors determining data transfers, specifically concerning data collection for purposes of avoiding data being gathered in one state and processed in another. Next, the paragraph specifies that the article applies only to transfer of personal data, however if contracting states have decided to include data on legal persons, then those will also fall under these rules. Importantly, the article is only focused on the export of data, not the import. Imports are not considered an issue as the receiving state’s data protection rules will become applicable. As such, it is the exporting state which has the duty to take necessary measures as laid down in article 12. 

 According to the Explanatory Report, the main rule is that Parties may not require special authorizations for data transfers for the sole purpose of protecting privacy, as all parties are already expected to provide a minimum standard of protection. However, parties may request declarations from data controllers to stay informed on data traffic between its territory on another party to the Convention. Additionally, Parties may lay down in their domestic data protection laws certain restrictions on transfers in certain situations, however this exception is not further specified. Importantly, the exporting Party must have proof of such behavior and in case the non-party has satisfactory data protection, the exporting Party may waive its restrictions.   

 Lastly, a Party may derogate from the main rule in two instances. In case a Party has a higher level of protection for certain categories of personal data than another, this may block the data from being transferred or additional authorizations may be required. If the receiving Party has an equivalent level of protection, this exception cannot be relied upon. The second exception pertains to circumstances in which a Party merely acts as an intermediary destination, for the data to finally arrive in the territory of a non-Party, for purposes of circumvention. 

 Finally, the Additional Protocol provides rules on the transfer of personal data to non-parties to the Convention. Parties may only transfer data to a non-party ‘if that State or organisation ensures an adequate level of protection’. However, in case the receiving state does not offer adequate protections, a Party may still authorise a transfer if domestic law provides for it due to specific interests of the data subject or legitimate prevailing interests, especially public interest. Additionally, data may still be sent if the controller provides for adequate safeguards, which are considered appropriate by the competent authorities under domestic law.  

===

=== Brazil ===

==== Introduction ====Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.<div>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" |Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

==== Broader data protection landscape ====We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. '''Constitutional / fundamental rights model'''Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: ''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' ''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''In 2022, the Constitution was amended to include a specific right to data protection: ''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{|
|-
|'''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>

|}

==== The General Data Protection Law (LGPD) ====The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:

*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  '''Scope of Application'''We have considered the scope of application in three ways: personal, material and territorial. 

*Personal ScopeThe LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material ScopeThe LGDP applies to any processing operation of personal data. 

::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scopeThe LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 

***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).'''Processing of Personal Data'''Controllers and Processors (Articles 5, 37-40, 42-43) 

*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):

*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :

*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== Interaction of the Law and the Regulation ====In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 

*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

==== Substantive detail of cross border data flows ====Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. In no hierarchy, there are various mechanisms that permit international data transfers. 

*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

===== When are data transfers allowed? =====The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 

#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

===== Adequacy decisions =====We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 

*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; andII - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

===== Contractual measures ====='''Standard contractual clauses'''The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |CLAUSE 2. Purpose2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.

*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:(NOTE: fill in as much detail as possible with information relating to the international transfer)

|}

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).'''Equivalent Standard Contractual Clauses'''Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.'''Global Corporate Standards (or Binding Corporate Rules)'''A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).

*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

===== Transparency Requirements =====All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 

#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

=== China ===China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

==== The Cybersecurity Law ====In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |[https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''

|}Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:

*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

==== The Personal Information Protection Law ====''''''The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''

*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:

*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

==== The Data Security Law ====''''''

''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''

|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|}
==== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ====''''''A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].

[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

==== The Digital Silk Road ====''''''

''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

=== India ===
==== Introduction ====In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the [https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.

==== Information Technology Act, 2000 ====Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.'Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 

==== Digital Personal Data Protection Act, 2023 ====
===== Scope of Application =====The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.

===== Cross-Border Data Transfer =====Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.

*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

=== United States ===

The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

==== Federal level ====

===== Privacy Act (1974) =====
The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal informationThis Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

===== Executive Order 14117 (February 28, 2024) =====
A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

===== PADFA (HR 815, Pub. L. 118-50) =====
Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.

===== Examples of federal sectorial legislation =====
'''Health and medical data (HIPAA)'''The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').

''''''''Financial data privacy'''

The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.   The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].

''''''''Data protection for children (COPPA)'''

In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation. COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees. 

==== US State Laws ====In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

=== South Africa ===
==== Title - ROM ====
==== Title - Xiaoli ====

==== Comparison between PoPIA and GDPR ====
In a comparative approach between section 72 of PoPIA and the provisions in the European GDPR, Coetzee emphasises the difference in breadth that both pieces of legislation offer to regulate the transfer of personal information across the borders of the respective [https://www.saflii.org/za/journals/PER/2024/48.html jurisdictions].

 A closer read of these conditions give rise to a number of concerns, namely the limited meaning of the terms “responsible party” in Article 72(1) of PoPIA, which can be understood as giving operators or processors of data, acting on behalf of a responsible party, free reign, as section 72 does not apply. In the comparison with the equivalent GDPR article (44), PoPIA falls short of regulating the “transfer of personal information by an operator in the Republic to a third party outside the [https://www.saflii.org/za/journals/PER/2024/48.pdf Republic]”.
Other sections of PoPIA could be employed here, however, to ensure that personal information remains protected, namely section 20 and 21, which address situations of operators processing information on behalf of a responsible party. The regulation requires processors of information, on behalf of a third party / responsible party, to have the knowledge / authority of such party; this should be captured in a contract, outlining that secure measures are in place to safeguard such [https://www.saflii.org/za/journals/PER/2024/48.pdf information]. This speaks for the fact that, although PoPIA is modelled on the GDPR, it has a relatively loose approach.

 Section 72 provides several exceptions, i.e. it allows third parties to not require compliance with the provisions for the transfer of data. The first one being where the data subject has provided consent and the second one where the transfer of data is in the interest of the data subject. The fact that these situations should always be in the interest of public policy and are therefore to be read and interpreted “restrictively” is [https://www.saflii.org/za/journals/PER/2024/48.pdf paramount].

 Ferracane outlines the “conditional flow regime” a term she coined to describe the level of restrictiveness of cross border movement of data as being the basis of both the European GDPR and the South African PoPIA legislation.
Strict restrictions being neither desirable nor planned by South Africa as it practises the conditional data flow regime. Neither it is likely to see restrictions being imposed on any local storage and processing requirements, providing relative freedom to data processors and operators.
Three options are outlined for South Africa to “position itself in the international discussions on data flows”, namely maintaining the status quo, further liberalisation, and imposing new restrictions on data [https://saiia.org.za/wp-content/uploads/2018/04/GA_Th3_DP-Ferracane_20180411.pdf flows].
==== An African Solution ====
This is also one of the essences of Babalola’s article, titling personal data as being the “life blood of economic [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl development]”.
Babalola provides us with a number of recommendations, part of this is what he calls an “African Solution”. The notion of ‘borrowed concepts’ of privacy, data protection, and data localisation come also into play in this article, meaning not inherently African or of similar importance as in Europe. Especially, as the African Charter on Human and People’s Rights does not provide any focus on privacy. Babalola therefore declares that by this function, privacy is “not a fundamental right at regional level”. Hence, the author advises African countries to enter into multi-party agreements for the regulation of Transborder Data Flows (TDF), with the aim to create uniformity not only on purpose but also to enforce TDF within as well as outside of the African [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl region].

 By using the European example, not only for the implementation of PoPIA in South Africa but also for the collaboration between countries within the region, African nations can device bespoke standards of data protection for the safeguarding of rights and freedoms and therefore create a more cohesive level of rule systems for citizens and residents, whilst anchoring this in the African context of trade and economy.
The limitations to these recommendations are due to the fact that not all nations of the African Union have data protection rules in place, which in most cases is linked to a “lack of political will, competing priorities, and financial constraints” but the remaining countries have the power, the knowledge, and the experience to be regulation on behalf of the wider [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl union].

Module 2: Data

2025-09-30T15:09:42Z

NadineWalsh: /* South Africa */

= Transfer of Data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.=== Council of Europe / Convention 108+=== Convention 108: Nature   ===
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

 
=== Council of Europe ===

=== Convention 108: Nature ===
=== Convention 108: Nature ===
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

=== Convention 108: Scope and Provisions ===
Chapter 3 of the Convention engages with the topic of transborder data flows. To be precise, article 12 aims to ‘reconcile the requirements of effective data protection with the principle of free flow of information, regardless of frontiers’. Essentially, it aims to balance the existence of strong data protection for personal data protections along with the free flow of information across borders, which is directly linked to article 10 of the European Convention on Human Rights. 

 The idea of transborder data flows, in paragraph 1, has been worded in broad terms to encompass the multitude of ways in which data can be transferred and stored. As such, these rules will apply regardless of the variety of factors determining data transfers, specifically concerning data collection for purposes of avoiding data being gathered in one state and processed in another. Next, the paragraph specifies that the article applies only to transfer of personal data, however if contracting states have decided to include data on legal persons, then those will also fall under these rules. Importantly, the article is only focused on the export of data, not the import. Imports are not considered an issue as the receiving state’s data protection rules will become applicable. As such, it is the exporting state which has the duty to take necessary measures as laid down in article 12. 

 According to the Explanatory Report, the main rule is that Parties may not require special authorizations for data transfers for the sole purpose of protecting privacy, as all parties are already expected to provide a minimum standard of protection. However, parties may request declarations from data controllers to stay informed on data traffic between its territory on another party to the Convention. Additionally, Parties may lay down in their domestic data protection laws certain restrictions on transfers in certain situations, however this exception is not further specified. Importantly, the exporting Party must have proof of such behavior and in case the non-party has satisfactory data protection, the exporting Party may waive its restrictions.   

 Lastly, a Party may derogate from the main rule in two instances. In case a Party has a higher level of protection for certain categories of personal data than another, this may block the data from being transferred or additional authorizations may be required. If the receiving Party has an equivalent level of protection, this exception cannot be relied upon. The second exception pertains to circumstances in which a Party merely acts as an intermediary destination, for the data to finally arrive in the territory of a non-Party, for purposes of circumvention. 

 Finally, the Additional Protocol provides rules on the transfer of personal data to non-parties to the Convention. Parties may only transfer data to a non-party ‘if that State or organisation ensures an adequate level of protection’. However, in case the receiving state does not offer adequate protections, a Party may still authorise a transfer if domestic law provides for it due to specific interests of the data subject or legitimate prevailing interests, especially public interest. Additionally, data may still be sent if the controller provides for adequate safeguards, which are considered appropriate by the competent authorities under domestic law.  

===

=== Brazil ===

==== Introduction ====Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.<div>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" |Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

==== Broader data protection landscape ====We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. '''Constitutional / fundamental rights model'''Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: ''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' ''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''In 2022, the Constitution was amended to include a specific right to data protection: ''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{|
|-
|'''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>

|}

==== The General Data Protection Law (LGPD) ====The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:

*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  '''Scope of Application'''We have considered the scope of application in three ways: personal, material and territorial. 

*Personal ScopeThe LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material ScopeThe LGDP applies to any processing operation of personal data. 

::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scopeThe LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 

***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).'''Processing of Personal Data'''Controllers and Processors (Articles 5, 37-40, 42-43) 

*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):

*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :

*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== Interaction of the Law and the Regulation ====In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 

*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

==== Substantive detail of cross border data flows ====Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. In no hierarchy, there are various mechanisms that permit international data transfers. 

*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

===== When are data transfers allowed? =====The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 

#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

===== Adequacy decisions =====We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 

*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; andII - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

===== Contractual measures ====='''Standard contractual clauses'''The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |CLAUSE 2. Purpose2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.

*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:(NOTE: fill in as much detail as possible with information relating to the international transfer)

|}

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).'''Equivalent Standard Contractual Clauses'''Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.'''Global Corporate Standards (or Binding Corporate Rules)'''A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).

*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

===== Transparency Requirements =====All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 

#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

=== China ===China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

==== The Cybersecurity Law ====In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |[https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''

|}Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:

*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

==== The Personal Information Protection Law ====''''''The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''

*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:

*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

==== The Data Security Law ====''''''

''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''

|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|}
==== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ====''''''A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].

[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

==== The Digital Silk Road ====''''''

''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

=== India ===
==== Introduction ====In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the [https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.

==== Information Technology Act, 2000 ====Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.'Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 

==== Digital Personal Data Protection Act, 2023 ====
===== Scope of Application =====The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.

===== Cross-Border Data Transfer =====Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.

*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

=== United States ===

The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

==== Federal level ====

===== Privacy Act (1974) =====
The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal informationThis Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

===== Executive Order 14117 (February 28, 2024) =====
A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

===== PADFA (HR 815, Pub. L. 118-50) =====
Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.

===== Examples of federal sectorial legislation =====
'''Health and medical data (HIPAA)'''The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').

''''''''Financial data privacy'''

The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.   The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].

''''''''Data protection for children (COPPA)'''

In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation. COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees. 

==== US State Laws ====In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

=== South Africa ===
==== Title - ROM ====
==== Comparison between PoPIA and GDPR ====
In a comparative approach between section 72 of PoPIA and the provisions in the European GDPR, Coetzee emphasises the difference in breadth that both pieces of legislation offer to regulate the transfer of personal information across the borders of the respective [https://www.saflii.org/za/journals/PER/2024/48.html jurisdictions].

 A closer read of these conditions give rise to a number of concerns, namely the limited meaning of the terms “responsible party” in Article 72(1) of PoPIA, which can be understood as giving operators or processors of data, acting on behalf of a responsible party, free reign, as section 72 does not apply. In the comparison with the equivalent GDPR article (44), PoPIA falls short of regulating the “transfer of personal information by an operator in the Republic to a third party outside the [https://www.saflii.org/za/journals/PER/2024/48.pdf Republic]”.
Other sections of PoPIA could be employed here, however, to ensure that personal information remains protected, namely section 20 and 21, which address situations of operators processing information on behalf of a responsible party. The regulation requires processors of information, on behalf of a third party / responsible party, to have the knowledge / authority of such party; this should be captured in a contract, outlining that secure measures are in place to safeguard such [https://www.saflii.org/za/journals/PER/2024/48.pdf information]. This speaks for the fact that, although PoPIA is modelled on the GDPR, it has a relatively loose approach.

 Section 72 provides several exceptions, i.e. it allows third parties to not require compliance with the provisions for the transfer of data. The first one being where the data subject has provided consent and the second one where the transfer of data is in the interest of the data subject. The fact that these situations should always be in the interest of public policy and are therefore to be read and interpreted “restrictively” is [https://www.saflii.org/za/journals/PER/2024/48.pdf paramount].

 Ferracane outlines the “conditional flow regime” a term she coined to describe the level of restrictiveness of cross border movement of data as being the basis of both the European GDPR and the South African PoPIA legislation.
Strict restrictions being neither desirable nor planned by South Africa as it practises the conditional data flow regime. Neither it is likely to see restrictions being imposed on any local storage and processing requirements, providing relative freedom to data processors and operators.
Three options are outlined for South Africa to “position itself in the international discussions on data flows”, namely maintaining the status quo, further liberalisation, and imposing new restrictions on data [https://saiia.org.za/wp-content/uploads/2018/04/GA_Th3_DP-Ferracane_20180411.pdf flows].
==== An African Solution ====
This is also one of the essences of Babalola’s article, titling personal data as being the “life blood of economic [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl development]”.
Babalola provides us with a number of recommendations, part of this is what he calls an “African Solution”. The notion of ‘borrowed concepts’ of privacy, data protection, and data localisation come also into play in this article, meaning not inherently African or of similar importance as in Europe. Especially, as the African Charter on Human and People’s Rights does not provide any focus on privacy. Babalola therefore declares that by this function, privacy is “not a fundamental right at regional level”. Hence, the author advises African countries to enter into multi-party agreements for the regulation of Transborder Data Flows (TDF), with the aim to create uniformity not only on purpose but also to enforce TDF within as well as outside of the African [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl region].

 By using the European example, not only for the implementation of PoPIA in South Africa but also for the collaboration between countries within the region, African nations can device bespoke standards of data protection for the safeguarding of rights and freedoms and therefore create a more cohesive level of rule systems for citizens and residents, whilst anchoring this in the African context of trade and economy.
The limitations to these recommendations are due to the fact that not all nations of the African Union have data protection rules in place, which in most cases is linked to a “lack of political will, competing priorities, and financial constraints” but the remaining countries have the power, the knowledge, and the experience to be regulation on behalf of the wider [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl union].

Module 2: Data

2025-09-30T14:59:20Z

NadineWalsh: /* South Africa */

= Cross-border flows of personal data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
=== Council of Europe / Convention 108+
=== Convention 108: Nature ===
The Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), aims to offer adequate protections for the data of persons present in a party territory. Currently, there are 55 states which have ratified the Convention, including nine non-members of the Council of Europe. It opened for signature on 28 January 1981 and it was the first legally binding international instrument in the field of data protection. In 2018, the Convention underwent a modernization, primarily due to privacy challenges resulting from the ‘increasing use of new information and communication technologies, the globalisation of processing operations and the ever greater flows of personal data’. However, transborder flows of personal data had already been addressed in the first version. The drafters realized that cross-border flows of personal data bring many benefits to individuals, however they considered the risks attached to varying degrees of data protection within different states. In response to this, countries have imposed export controls however this did conflict with the primary principle of free international data flows. The Convention was drafted as it was desirable for states to have leveled mechanisms in terms of data protection, specifically concerning personal data.

 
=== Convention 108: Scope and Provisions ===
Chapter 3 of the Convention engages with the topic of transborder data flows. To be precise, article 12 aims to ‘reconcile the requirements of effective data protection with the principle of free flow of information, regardless of frontiers’. Essentially, it aims to balance the existence of strong data protection for personal data protections along with the free flow of information across borders, which is directly linked to article 10 of the European Convention on Human Rights. 

 The idea of transborder data flows, in paragraph 1, has been worded in broad terms to encompass the multitude of ways in which data can be transferred and stored. As such, these rules will apply regardless of the variety of factors determining data transfers, specifically concerning data collection for purposes of avoiding data being gathered in one state and processed in another. Next, the paragraph specifies that the article applies only to transfer of personal data, however if contracting states have decided to include data on legal persons, then those will also fall under these rules. Importantly, the article is only focused on the export of data, not the import. Imports are not considered an issue as the receiving state’s data protection rules will become applicable. As such, it is the exporting state which has the duty to take necessary measures as laid down in article 12. 

 According to the Explanatory Report, the main rule is that Parties may not require special authorizations for data transfers for the sole purpose of protecting privacy, as all parties are already expected to provide a minimum standard of protection. However, parties may request declarations from data controllers to stay informed on data traffic between its territory on another party to the Convention. Additionally, Parties may lay down in their domestic data protection laws certain restrictions on transfers in certain situations, however this exception is not further specified. Importantly, the exporting Party must have proof of such behavior and in case the non-party has satisfactory data protection, the exporting Party may waive its restrictions.   

 Lastly, a Party may derogate from the main rule in two instances. In case a Party has a higher level of protection for certain categories of personal data than another, this may block the data from being transferred or additional authorizations may be required. If the receiving Party has an equivalent level of protection, this exception cannot be relied upon. The second exception pertains to circumstances in which a Party merely acts as an intermediary destination, for the data to finally arrive in the territory of a non-Party, for purposes of circumvention. 

 Finally, the Additional Protocol provides rules on the transfer of personal data to non-parties to the Convention. Parties may only transfer data to a non-party ‘if that State or organisation ensures an adequate level of protection’. However, in case the receiving state does not offer adequate protections, a Party may still authorise a transfer if domestic law provides for it due to specific interests of the data subject or legitimate prevailing interests, especially public interest. Additionally, data may still be sent if the controller provides for adequate safeguards, which are considered appropriate by the competent authorities under domestic law.  

===

=== Brazil ===

==== Introduction ====Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.<div>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" |Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

==== Broader data protection landscape ====We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. '''Constitutional / fundamental rights model'''Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: ''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' ''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''In 2022, the Constitution was amended to include a specific right to data protection: ''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{|
|-
|'''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>

|}

==== The General Data Protection Law (LGPD) ====The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:

*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  '''Scope of Application'''We have considered the scope of application in three ways: personal, material and territorial. 

*Personal ScopeThe LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material ScopeThe LGDP applies to any processing operation of personal data. 

::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scopeThe LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 

***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).'''Processing of Personal Data'''Controllers and Processors (Articles 5, 37-40, 42-43) 

*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):

*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :

*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== Interaction of the Law and the Regulation ====In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 

*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

==== Substantive detail of cross border data flows ====Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. In no hierarchy, there are various mechanisms that permit international data transfers. 

*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

===== When are data transfers allowed? =====The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 

#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

===== Adequacy decisions =====We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 

*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; andII - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

===== Contractual measures ====='''Standard contractual clauses'''The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |CLAUSE 2. Purpose2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.

*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:(NOTE: fill in as much detail as possible with information relating to the international transfer)

|}

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).'''Equivalent Standard Contractual Clauses'''Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.'''Global Corporate Standards (or Binding Corporate Rules)'''A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).

*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

===== Transparency Requirements =====All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 

#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

=== China ===China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

==== The Cybersecurity Law ====In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |[https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''

|}Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:

*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

==== The Personal Information Protection Law ====''''''The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''

*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:

*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

==== The Data Security Law ====''''''

''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''

|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|}
==== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ====''''''A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].

[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

==== The Digital Silk Road ====''''''

''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

=== India ===
==== Introduction ====In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the [https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.

==== Information Technology Act, 2000 ====Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.'Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 

==== Digital Personal Data Protection Act, 2023 ====
===== Scope of Application =====The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.

===== Cross-Border Data Transfer =====Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.

*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

=== United States ===

The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

==== Federal level ====

===== Privacy Act (1974) =====
The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal informationThis Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

===== Executive Order 14117 (February 28, 2024) =====
A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

===== PADFA (HR 815, Pub. L. 118-50) =====
Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.

===== Examples of federal sectorial legislation =====
'''Health and medical data (HIPAA)'''The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').

''''''''Financial data privacy'''

The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.   The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].

''''''''Data protection for children (COPPA)'''

In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation. COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees. 

==== US State Laws ====In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

=== South Africa ===
==== Comparison between PoPIA and GDPR ====
In a comparative approach between section 72 of PoPIA and the provisions in the European GDPR, Coetzee emphasises the difference in breadth that both pieces of legislation offer to regulate the transfer of personal information across the borders of the respective [https://www.saflii.org/za/journals/PER/2024/48.html jurisdictions].

 A closer read of these conditions give rise to a number of concerns, namely the limited meaning of the terms “responsible party” in Article 72(1) of PoPIA, which can be understood as giving operators or processors of data, acting on behalf of a responsible party, free reign, as section 72 does not apply. In the comparison with the equivalent GDPR article (44), PoPIA falls short of regulating the “transfer of personal information by an operator in the Republic to a third party outside the [https://www.saflii.org/za/journals/PER/2024/48.pdf Republic]”.
Other sections of PoPIA could be employed here, however, to ensure that personal information remains protected, namely section 20 and 21, which address situations of operators processing information on behalf of a responsible party. The regulation requires processors of information, on behalf of a third party / responsible party, to have the knowledge / authority of such party; this should be captured in a contract, outlining that secure measures are in place to safeguard such [https://www.saflii.org/za/journals/PER/2024/48.pdf information]. This speaks for the fact that, although PoPIA is modelled on the GDPR, it has a relatively loose approach.

 Section 72 provides several exceptions, i.e. it allows third parties to not require compliance with the provisions for the transfer of data. The first one being where the data subject has provided consent and the second one where the transfer of data is in the interest of the data subject. The fact that these situations should always be in the interest of public policy and are therefore to be read and interpreted “restrictively” is [https://www.saflii.org/za/journals/PER/2024/48.pdf paramount].

 Ferracane outlines the “conditional flow regime” a term she coined to describe the level of restrictiveness of cross border movement of data as being the basis of both the European GDPR and the South African PoPIA legislation.
Strict restrictions being neither desirable nor planned by South Africa as it practises the conditional data flow regime. Neither it is likely to see restrictions being imposed on any local storage and processing requirements, providing relative freedom to data processors and operators.
Three options are outlined for South Africa to “position itself in the international discussions on data flows”, namely maintaining the status quo, further liberalisation, and imposing new restrictions on data [https://saiia.org.za/wp-content/uploads/2018/04/GA_Th3_DP-Ferracane_20180411.pdf flows].
==== An African Solution ====
This is also one of the essences of Babalola’s article, titling personal data as being the “life blood of economic [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl development]”.
Babalola provides us with a number of recommendations, part of this is what he calls an “African Solution”. The notion of ‘borrowed concepts’ of privacy, data protection, and data localisation come also into play in this article, meaning not inherently African or of similar importance as in Europe. Especially, as the African Charter on Human and People’s Rights does not provide any focus on privacy. Babalola therefore declares that by this function, privacy is “not a fundamental right at regional level”. Hence, the author advises African countries to enter into multi-party agreements for the regulation of Transborder Data Flows (TDF), with the aim to create uniformity not only on purpose but also to enforce TDF within as well as outside of the African [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl region].

 By using the European example, not only for the implementation of PoPIA in South Africa but also for the collaboration between countries within the region, African nations can device bespoke standards of data protection for the safeguarding of rights and freedoms and therefore create a more cohesive level of rule systems for citizens and residents, whilst anchoring this in the African context of trade and economy.
The limitations to these recommendations are due to the fact that not all nations of the African Union have data protection rules in place, which in most cases is linked to a “lack of political will, competing priorities, and financial constraints” but the remaining countries have the power, the knowledge, and the experience to be regulation on behalf of the wider [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl union].

Module 2: Data

2025-09-29T18:41:07Z

NadineWalsh: /* ====== Comparison between PoPIA and GDPR ====== */

= Cross-border flows of personal data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
=== Council of Europe / Convention 108+ ===

=== Brazil ===

==== Introduction ====Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.<div>

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" |Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

==== Broader data protection landscape ====We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. '''Constitutional / fundamental rights model'''Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: ''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' ''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''In 2022, the Constitution was amended to include a specific right to data protection: ''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |<div>
{|
|-
|'''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>

|}

==== The General Data Protection Law (LGPD) ====The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:

*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  '''Scope of Application'''We have considered the scope of application in three ways: personal, material and territorial. 

*Personal ScopeThe LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material ScopeThe LGDP applies to any processing operation of personal data. 

::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scopeThe LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 

***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).'''Processing of Personal Data'''Controllers and Processors (Articles 5, 37-40, 42-43) 

*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):

*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :

*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== Interaction of the Law and the Regulation ====In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 

*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

==== Substantive detail of cross border data flows ====Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. In no hierarchy, there are various mechanisms that permit international data transfers. 

*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

===== When are data transfers allowed? =====The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 

#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

===== Adequacy decisions =====We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 

*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; andII - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

===== Contractual measures ====='''Standard contractual clauses'''The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |CLAUSE 2. Purpose2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.

*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:(NOTE: fill in as much detail as possible with information relating to the international transfer)

|}

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).'''Equivalent Standard Contractual Clauses'''Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.'''Global Corporate Standards (or Binding Corporate Rules)'''A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).

*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

===== Transparency Requirements =====All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 

#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

=== China ===China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.] The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

==== The Cybersecurity Law ====In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |[https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''

|}Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:

*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

==== The Personal Information Protection Law ====''''''The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''

*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:

*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

==== The Data Security Law ====''''''

''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" |''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''

|}Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|}
==== Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments ====''''''A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].

[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

==== The Digital Silk Road ====''''''

''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

=== India ===
==== Introduction ====In 2017, the Supreme Court in Justice ''K. S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors''. unanimously held, that ‘the right to privacy is protected as an intrinsic part of the right to life and personal liberty under '''Article 21''' [...] '''of the Constitution [of India]'''’ (''emphasis added'') – overruling previous judgments in ''M. P. Sharma & Ors. vs. Satish Chandra, District Magistrate, Delhi & Ors.'' (1954), and ''Kharak Singh vs. State of Uttar Pradesh & Ors.'' (1964).In addition to cementing the place of the right to privacy as a fundamental right, the Court emphasised its negative and positive content, where the State is not only prohibited from interfering with the right to privacy, but is also obliged to take the necessary measures to protect it. Thus, the government of India has made several legislative efforts between 2018 and 2022 to establish a comprehensive legal framework to safeguard the right to privacy, culminating in the [https://egazette.gov.in/WriteReadData/2023/248045.pdf Digital Personal Data Protection Act, 2023] (DPDPA). As the DPDPA’s date of entering into force is yet to be announced by the government, the [https://www.meity.gov.in/content/information-technology-act-2000 Information Technology Act, 2000 (IT Act)] and the rules notified thereunder – most notably the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules) – currently form the basis around which the data protection framework revolves.

==== Information Technology Act, 2000 ====Yet, the IT Act provides only sparse regulations on data protection, which are limited in scope and only become relevant in the context of data breaches – furthermore, they are poorly enforced. Central to the IT Act, as amended in 2008, is Section 43A.‘Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, not exceeding five crore rupees, to the person so affected.'Central to the cross-border transfer of data or information under the current legal framework is Section 7 of the SPDI Rules.‘A body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules. The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.’The prevailing market practice is to gather extensive data based on wide-ranging, inconsistent, and bundled consents, as well as [https://law.nirmauni.ac.in/data-privacy-protection-in-india-technology-vis-a-vis-law/ to process and transfer this data widely]. 

==== Digital Personal Data Protection Act, 2023 ====
===== Scope of Application =====The DPDPA is  ‘to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.’The DPDPA revolves around the fiduciary relationship between data principals – defined as natural persons to whom the personal data relate, regardless of their residency or citizenship – and data fiduciaries – defined as persons who determine the purpose and means of the processing of personal data. Central to the provisions of the DPDPA is the processing of digital personal data, where personal data means ‘any data about an individual who is identifiable by or in relation to such data’, digital personal data ‘personal data in digital form’, and processing ‘a wholly or partly automated operation or set of operations performed on digital personal data [...]’.Consequently, non-personal data, and personal data that is not collected in digital form, or collected in non-digital form and not digitised subsequently, fall outside the scope. Unlike the outgoing data protection framework, there are no sub-categories of personal data, such as sensitive personal data or critical personal data. Expressly excluded from the scope of application is personal data processed by an individual for any personal or domestic purpose, or deliberately made publicly accessible by a person entitled or obliged to do so. In its territorial scope of application, the DPDPA not only extends to the processing of digital personal data within India but also processing undertaken outside India if it is ‘in connection with any activity related to the offering of goods or services to data principals within [...] India’.

===== Cross-Border Data Transfer =====Under the DPDPA, the cross-border transfer of personal data by a data fiduciary for the purpose of processing is permitted unless the government restricts the transfer to certain countries or territories by issuing a notification. Yet, the DPDPA does not provide further clarity as to what the relevant factors for such a restriction are, nor what the restrictions would entail. Such restrictions could include additional requirements for the cross-border data transfer or exclude or limit certain types of data as sensitive personal data or critical personal data. Alternatively, the government could ‘blacklist’ countries or territories, entirely prohibiting the transfer of personal data. It is interesting to note that this distinction between personal data and sensitive personal data and critical personal data was actually made in previous iterations of a comprehensive data protection law, with sensitive personal data and critical personal data being subject to higher compliance standards and data localisation requirements.It should be noted, however, that certain sector-specific laws already impose data localisation requirements and restrict the cross-border transfer of certain data.

*The [https://www.rbi.org.in/ Reserve Bank of India] (RBI) has [https://www.rbi.org.in/commonperson/English/Scripts/FAQs.aspx?Id=2995 advised] all payment system providers and their service providers, intermediaries, third party vendors and other entities in the payment ecosystem to ensure that the entire data relating to payment systems operated by them is stored in a system only in India.
*The [https://www.sebi.gov.in/ Securities Exchange Board of India] (SEBI) has issued an [http://aibi.org.in/Circulars/SEBI_Circular_dated_Nov_03_2020_Advisory_for_Financial_Sector_Organizations_regarding_Software_as_a_Service_(SaaS)_based_solutions.pdf advisory] for financial sector organisations, which are availing or thinking of availing software as a service based solution for managing their governance, risk and compliance functions so as to improve their cyber security posture, to store certain critical data sets in India.These are just two examples of recent efforts by India to promote the local storage of ‘its’ data, in the name of ‘data sovereignty’, and driven by the belief that unfettered access to data from developing countries disproportionately benefits a few global corporations from and the economies of developed countries and creates a dependency of the former on the latter and an [https://www.goethe.de/ins/in/en/kul/fmd/afu/25298606.html economical imbalance given the value of the data].Yet, by permitting cross-border data transfers by default, Section 16 (1) seems to thwart these efforts, but Section 16 (2) addresses this potential conflict with sectoral laws by declaring that it does not restrict  ‘the applicability of any law [...] that provides for a higher degree of protection for or restriction on [cross-border] transfer of personal data [...] in relation to any personal data [...] or class thereof’. Thus, Section 16 (1) only serves as the baseline protection to regulate cross-border data transfers. Section 17 prescribes as general exemptions from compliances that cross-border transfers (including transfers to notified countries and territories) should not be restricted under certain circumstances.In conclusion, the DPDPA provides a skeletal framework for a comprehensive data protection regime, yet creates uncertainty regarding cross-border data transfers. It remains to be seen how the government’s extensive discretionary powers pertaining to restricting transfers to certain jurisdictions will play out in practice once such notifications are issued.

=== United States ===

The United States of America (US) does not currently have a federal general consumer law for privacy and data protection, such as the General Data Protection Regulation (GDPR) for the European Union (EU) and European Economic Area. However, this does not mean the US is the Wild West when it comes to privacy and data protection. At the federal level, there are [https://epic.org/issues/privacy-laws/united-states/ approximately 30 laws governing privacy] in the United States. The 50 states generally also each have laws touching on privacy; for example, California has [https://calawyers.org/section/privacy-law/privacy-law-guide/ approximately 18 different laws] that govern privacy in different contexts such as education, electronic communications, financial information, etc.In this section, we discuss selected examples from America’s legislative framework on the federal level, including representative examples of specific sector legislation.

==== Federal level ====

===== Privacy Act (1974) =====
The US’ oldest data protection law, the [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], stems from 1974. It governs how federal government institutions have to handle people’s personal data. US federal agencies collect information about citizens in their ''systems of records'', which is the grouping of information. Such info is retrievable by people’s personal identifiers (e.g. name or social security number. US federal agencies cannot Americans’ personal information without their consent. [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and Some exceptions] may apply. The Privacy Act grants individuals the following rights:
*request their records (again, subject to [https://osc.gov/Pages/Privacy-Act.aspx#:~:text=The%20Privacy%20Act%20provides%20protections,relevant%2C%20timely%20or%20complete%3B%20and some exceptions])
*change inaccurate, irrelevant, outdated or incomplete records
*be protected against “unwarranted invasion of their privacy” resulting from the collection, maintenance, use, and disclosure of their personal informationThis Privacy Act of 1974 was amended by the [https://www.congress.gov/bill/100th-congress/senate-bill/496/text Computer Matching and Privacy Protection Act of 1988]. It expanded the scope of the Privacy Act to individuals whose records are processed by automated matching programs.The scope of the Privacy Act is limited to Federal agencies, and not to court records, various executive bodies or non-agency government organisations. Moreover, President Trump [https://trumpwhitehouse.archives.gov/presidential-actions/executive-order-enhancing-public-safety-interior-united-states/ limited the scope of the Privacy Act] further to only include ‘''United States citizens or lawful permanent residents’''. Before President Trump’s Executive Order, the Privacy Act applied to the records of every ‘individual,’ defined as ‘a citizen of the United States or an alien lawfully admitted for permanent residence’ (See [https://www.govinfo.gov/content/pkg/STATUTE-88/pdf/STATUTE-88-Pg1896.pdf#page=1 Privacy Act], Section 3, Title 552a sub (a)(1))

===== Executive Order 14117 (February 28, 2024) =====
A more recent development related to data transfers from the US to third countries is [https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/ President Biden’s Executive Order 14117] (EO 14117), which aims to prevent access to Americans’ bulk sensitive personal data and US government-related data to ‘countries of concern’. With this EO, signed on February 28, 2024, Biden expands the scope of the national emergency declared in [https://www.federalregister.gov/executive-order/13873 Executive Order 13873] of May 15, 2019 (Securing the Information and Communications Technology and Services Supply Chain).The goal of EO 14117 is to strengthen America’s national security interests, rather than safeguarding individual privacy and data protection. The US explicitly still supports the [https://www.oecd.org/en/about/programmes/data-free-flow-with-trust.html Free Flow With Trust] concepts and does not wish to impose measures that may hinder the commercial transactions of data. EO 14117 aims to set out [https://www.federalregister.gov/d/2024-04594/p-36 six defined categories] of U.S. sensitive personal data, mostly related to finances, health, biometrics, etc. Such sensitive data would be in ‘bulk’ when it reaches the [https://www.federalregister.gov/d/2024-04594/p-93 threshold of 1000 persons].Important to remember is that an EO is '''not''' legally binding, it merely sets guidelines for agencies to make regulations. Consequently, the Attorney General issued an [https://www.federalregister.gov/documents/2024/03/05/2024-04594/national-security-division-provisions-regarding-access-to-americans-bulk-sensitive-personal-data-and Advance Notice of Proposed Rulemaking] (ANPRM). This means the Department of Justice (DoJ) is collecting commentary before drafting a Proposed Rule that, once finalized, will implement EO 14117 into actual administrative regulations. During the implementation of EO 13873 from 2019, the [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data identified ‘countries of concern’] were China, Russia, Iran, North Korea, Cuba, and Venezuela. In the [https://www.federalregister.gov/d/2024-04594/p-179 questions set out for commentary] in the ANPRM for EO 14177, the DoJ indicates that, in addition to (re-)establishing a list of countries of concern, they are looking to create a [https://regulatorystudies.columbian.gwu.edu/provisions-regarding-access-americans-bulk-sensitive-personal-data-and-government-related-data process for adding or removing countries to that list].

===== PADFA (HR 815, Pub. L. 118-50) =====
Even more recent is law [https://www.congress.gov/bill/118th-congress/house-bill/815/text H.R. 815], signed by President Biden on April 24th 2024, called the Protecting Americans’ Data from Foreign Adversaries Act (or [https://www.congress.gov/bill/118th-congress/house-bill/815/text#H3954D39129FA4D099436402B9DE6D8AB PADFA]). This legislation is separate from EO 14117, but it does align with the ANRPM set out for the EO 14117. In general, PADFA covers a broader scope of data and transactions than EO 14117. It is mostly focused on preventing data brokers from selling Americans’ data to ‘foreign adversary countries’. This sounds similar to the ‘countries of concern’ under EO 13873 and possible EO 14117, but they only encompass China, Russia, Iran and North Korea (see [https://www.congress.gov/bill/118th-congress/house-bill/815/text#HB5A44FBE333A4AC48DA1BF1CDFC181E4 Sec.2(4) of PADFA] which refers to [https://www.govinfo.gov/content/pkg/USCODE-2023-title10/pdf/USCODE-2023-title10-subtitleA-partV-subpartI-chap385-subchapIII-sec4872.pdf section 4872(d)(2) of title 10, United States Code], under ‘(1) covered foreign country’). The ‘sensitive data’ covered by PADFA relates to health data, financial information, government issued IDs, information about race, ethnicity, information about minors (<17y), private communications, geolocation information, biometric and genetic information (See Sec.2 (5)-(7) of PADFA). As briefly stated above, PADFA is aimed at data brokers (with some exceptions of, for instance service provides or news agencies, see Sec.2 (3)(B) of PADFA). However, PADFA also covers ‘entities controller by a foreign adversary’. In practice this means an entity (legal or natural person), that has strong financial, business or legal organizational ties to such a country, or an entity that is at least 20% owned by a (combination of) foreign person(s).While PADFA will be enforced by the Federal Trade Commission, EO 14117 will be enforced by the DoJ. It is not clear how these two entities will cooperate on any similarities and overlap in scope of the sensitive data.

===== Examples of federal sectorial legislation =====
'''Health and medical data (HIPAA)'''The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the most signficant law at the federal level addressing privacy of personal health information in the US. The law includes implementing regulations issued by the US Department of Health and Human Services (HHS). The law covers many subjects, including the HIPAA Privacy Rule ([https://www.hhs.gov/sites/default/files/privacysummary.pdf summarized here]), as well as a cybersecurity rule (the Security Rule).The Privacy Rule addresses the use and disclosure of all ‘individually identifiable health information’ (‘protected health information’ or ‘PHI’)  held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. It also sets standards for individuals' rights to understand and control how their PHI is used. The law permits use and disclosure of PHI either [https://www.hhs.gov/sites/default/files/privacysummary.pdf with an individual’s consent, or under a limited and regulated list of purposes or situations:] (1) To the individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.With regard to [https://www.hhs.gov/hipaa/for-professionals/faq/2083/do-the-hipaa-rules-allow-a-covered-entity-or-business-associate-to-use-a-csp-that-stores-ephi-on-servers-outside-of-the-united-states/index.html moving data outside of the United States], the Privacy Rule does allow a covered entity (or business associate) to move data outside of the US, so long as that entity enters into an agreement with the entity holding data outside the US, and the entity outside the US otherwise complies with HIPAA Rules. There is no additional special requirement specific to protection of electronic protected health information processed or stored outside of the United States, but HHS notes that the risks may vary greatly depending on the data’s geographic location. Thus, when a covered entity conducts the risk analysis and risk management required by the HIPAA Security Rule, risks that arise with storing or transmitting data outside the US must be taken into account. For example, if PHI is maintained in a country where there are documented increased attempts at hacking or other malware attacks, such risks should be considered, and reasonable and appropriate technical safeguards must be implemented.Within HHS, the Office for Civil Rights implements and enforces the Privacy Rule. Civil penalties for violations of HIPAA include fines [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html over USD $1.9 million]. Criminal penalties can include [https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html money penalties and imprisonment up to 10 years in some cases].HIPAA is not the only federal law that protects health information privacy in the United States; another example is the Health Information Technology for Economic and Clinical Health Act of 2009 (the ‘[https://www.govinfo.gov/content/pkg/PLAW-111publ5/pdf/PLAW-111publ5.pdf HITECH Act]').

''''''''Financial data privacy'''

The Gramm-Leach-Bliley Act of 1999 is a federal law that reformed certain aspects of the financial industry in the late 1990s and provided for consumer financial privacy in the United States. The law includes implementing regulations that are promulgated and enforced by the Federal Trade Commission (FTC). The GLB Act includes a [https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313 Privacy of Consumer Financial Information Rule] (also called the “Financial Privacy Rule”).The law applies to non-public personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from the covered institutions. Covered institutions are those whose business is engaging in an activity that is financial in nature or incidental to financial activities described in the Bank Holding Company Act.Under the Privacy Rule, [https://www.ftc.gov/legal-library/browse/rules/financial-privacy-rule) unless an exception applies, a financial institution cannot disclose the consumer’s financial information to a non-affiliated third party before first]: providing particular notices to the consumer in compliance with the law, providing an opt-out notice in compliance with the law, and giving the consumer reasonable opportunity to opt-out before disclosing, and the consumer has not opted out. with certain limitations on disclosure of nonpublic personal information. The exceptions include: the financial institution gives the notice AND enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the information was disclosed; disclosure for processing transactions at a consumer’s request (can include marketing); the consumer consented to not receiving notice and opt-out; to maintain the financial institution’s cybersecurity; as required by law; to be responsive to intitutions that may be rating or auditing compliance of the financial institution; and in connection with a sale or merger of the financial institution.   The Privacy Rule does not specifically prohibit cross-border transfers of consumer data. The GLB Act is not the only legislation regulating consumer financial records in the United States, other examples include laws such as the [https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act Fair Credit Reporting Act].

''''''''Data protection for children (COPPA)'''

In the US, children’s online privacy is protected by the [https://www.govinfo.gov/app/details/USCODE-2023-title15/USCODE-2023-title15-chap91 Children’s Online Privacy Protection Act of 1998] (COPPA). The law also includes [https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa implementing regulations] which were created by and are enforced by the FTC. The FTC updates these regulations over the years to address changes in technology. The most recent [https://www.ftc.gov/system/files/2012-31341.pdf final rulemaking] was in 2013, but the FTC is currently actively reviewing the regulations. In January 2024, the FTC issued a [https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule) Notice of Proposed Rulemaking] soliciting public comments on proposed updates to the COPPA regulations.  Members of Congress are also considering an update to COPPA, a [https://www.congress.gov/bill/118th-congress/senate-bill/1418/text) draft law] entitled ‘Children and Teens Online Privacy Protection Act” was introduced in the House of Representatives and the Senate in 2023 (also referred to as “COPPA 2.0”).As the law currently stands, COPPA prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children under the age of 13 on the Internet. COPPA does this by imposing certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. COPPA also prohibits conditioning a child’s participation in an online activity on the collection of personal information.COPPA applies to a broad swathe of “operators” including commercial websites directed to children or providing goods/services to children, government websites and all government contractors, online gaming platforms, Internet-connected mobile apps and software, Internet-enabled devices such as toys and smart devices, and any technology that can be used to track location via the Internet. Thus, this includes plug-ins and ad networks. It also applies to entities that collect or maintain personal information from or about a child on behalf of an operator, or who benefits by allowing another entity to collect personal information directly from users of websites or online services. There is an exception for nonprofit organizations, unless the nonprofit is collecting and using information about children for commercial purposes.Essentially, COPPA gives children’s parents or legal guardians control over children's data that is collected online from children. Operators are required to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented. Parents also have the right to review and request deletion of information about their child. The implementing regulations contain detailed definitions, rules and guiding principles regarding parental consent, rules for providing sufficient notice to parents and what must be contained in the notice, rules regarding parents’ rights to review information provided by a child, requirements for confidentiality, security and integrity of personal information, enforcement, data retention and deletion of personal information, and a safe harbor provision, among other topics.COPPA does not specifically address the issue of transmitting a child’s personal information outside of the US, but the effect of the parental consent requirement is to prohibit any such transfer without verifiable parental consent that meets the requirements of the law. There are no other mechanisms provided in the law that would permit transmission of children’s personal information, such as legitimate interest or public interest; in this regard COPPA is very strict.The FTC enforces COPPA and can impose fines for violations. The [https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions#B amount of the fines] is updated from time to time, currently it is up to USD $51,744 per violation. COPPA is not the only privacy law specifically protecting children’s personal information. Other federal US laws that protects children’s privacy include the [https://studentprivacy.ed.gov/ Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA)], which the US Department of Education oversees. 

==== US State Laws ====In general, state-level general consumer data privacy laws in the US, such as the California Consumer Privacy Act, do not regulate cross-border transfers of data.

=== South Africa ===
==== Comparison between PoPIA and GDPR ====
In a comparative approach between section 72 of PoPIA and the provisions in the European GDPR, Coetzee emphasises the difference in breadth that both pieces of legislation offer to regulate the transfer of personal information across the borders of the respective [https://www.saflii.org/za/journals/PER/2024/48.html jurisdictions].

 A closer read of these conditions give rise to a number of concerns, namely the limited meaning of the terms “responsible party” in Article 72(1) of PoPIA, which can be understood as giving operators or processors of data, acting on behalf of a responsible party, free reign, as section 72 does not apply. In the comparison with the equivalent GDPR article (44), PoPIA falls short of regulating the “transfer of personal information by an operator in the Republic to a third party outside the [https://www.saflii.org/za/journals/PER/2024/48.pdf Republic]”.
Other sections of PoPIA could be employed here, however, to ensure that personal information remains protected, namely section 20 and 21, which address situations of operators processing information on behalf of a responsible party. The regulation requires processors of information, on behalf of a third party / responsible party, to have the knowledge / authority of such party; this should be captured in a contract, outlining that secure measures are in place to safeguard such [https://www.saflii.org/za/journals/PER/2024/48.pdf information]. This speaks for the fact that, although PoPIA is modelled on the GDPR, it has a relatively loose approach.

 Section 72 provides several exceptions, i.e. it allows third parties to not require compliance with the provisions for the transfer of data. The first one being where the data subject has provided consent and the second one where the transfer of data is in the interest of the data subject. The fact that these situations should always be in the interest of public policy and are therefore to be read and interpreted “restrictively” is [https://www.saflii.org/za/journals/PER/2024/48.pdf paramount].

 Ferracane outlines the “conditional flow regime” a term she coined to describe the level of restrictiveness of cross border movement of data as being the basis of both the European GDPR and the South African PoPIA legislation.
Strict restrictions being neither desirable nor planned by South Africa as it practises the conditional data flow regime. Neither it is likely to see restrictions being imposed on any local storage and processing requirements, providing relative freedom to data processors and operators.
Three options are outlined for South Africa to “position itself in the international discussions on data flows”, namely maintaining the status quo, further liberalisation, and imposing new restrictions on data [https://saiia.org.za/wp-content/uploads/2018/04/GA_Th3_DP-Ferracane_20180411.pdf flows].

==== An African Solution ====
This is also one of the essences of Babalola’s article, titling personal data as being the “life blood of economic [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl development]”.
Babalola provides us with a number of recommendations, part of this is what he calls an “African Solution”. The notion of ‘borrowed concepts’ of privacy, data protection, and data localisation come also into play in this article, meaning not inherently African or of similar importance as in Europe. Especially, as the African Charter on Human and People’s Rights does not provide any focus on privacy. Babalola therefore declares that by this function, privacy is “not a fundamental right at regional level”. Hence, the author advises African countries to enter into multi-party agreements for the regulation of Transborder Data Flows (TDF), with the aim to create uniformity not only on purpose but also to enforce TDF within as well as outside of the African [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl region].

 By using the European example, not only for the implementation of PoPIA in South Africa but also for the collaboration between countries within the region, African nations can device bespoke standards of data protection for the safeguarding of rights and freedoms and therefore create a more cohesive level of rule systems for citizens and residents, whilst anchoring this in the African context of trade and economy.
The limitations to these recommendations are due to the fact that not all nations of the African Union have data protection rules in place, which in most cases is linked to a “lack of political will, competing priorities, and financial constraints” but the remaining countries have the power, the knowledge, and the experience to be regulation on behalf of the wider [https://pdf.sciencedirectassets.com/271884/1-s2.0-S0267364923X00053/1-s2.0-S0267364924000074/main.pdf?X-Amz-Security-Token=IQoJb3JpZ2luX2VjEAwaCXVzLWVhc3QtMSJGMEQCIAKOG6DemNt56VXAy4xwHG8wla4K5eBBWFP8J17rnO88AiAQfIuGGq2uElpv32w5tPbPAmkl5jNl1OumvZuxTv7cqSq8BQiU%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAUaDDA1OTAwMzU0Njg2NSIMH2eSOPZvFvS8IRjFKpAFeX7MAHDLvuU5DxEbUmUoOvRIuZL5gRcxnwm%2FocEmSdtsS85G7%2BS%2B6tHHtVHiptWgIiDb2wYa%2FztyNLa4De%2FFOLS8uQGBUzx5bd%2FGa1r0N2j%2B6VJCAxEbXrAimZzZGcasNU%2Fj6frk4PGnaI1ertjWGwqbbl3b%2BTaF6pCPeOl4AGkgoasAEJ7hqIFfLusj43oZTAOxIG35fHFKZ%2FPqgoJmt%2B%2FpMy5beSNZoSxnZBzTUEw2OpGU5DtW%2B9LsVoKTS7cjv1HTZ3qEjbixWEabhOmd%2FiiXD3z84H4gv2Q4tCp68T6BJ46l2SHCDi%2FaTSd%2F6g8Rdjo2vS%2FSqZe4s6GbKqyv5%2BKLt9jFFSalDvn6HZMzIetrUo1jpPVbdQQKkRfwbbxJOCtha%2FcQtHqp1427HT4%2BCJyQlKVyaXSuqJf9neSX5E7boN1UbKFEK0MVtVfMHDsXDWWF%2FVf6urLfR8PdRKYLpt3Pq28QJPMdB3QYrhNyWiHg266ChhVvcpV7tcjrHl%2BjLE25jdonsw7m5B3c9tVxkRn8avrMTvHfP2QNaxUNAttKCi7auh2IXDbHxiApS2Z3Jpg8dBYN3MQemP96RsOwodfSbyzz6S5Caps8%2FbVqAVtNRC%2BLxVgRqi6iChkPqGGEF7Zug0CzwqJDkVw8yuBZEnSTMgLqHNH7r0C8daUVLLigkZRsotqwz8LhtXD1xfUbkTuPXlqIYrC96wTNIVLye2186i%2BQj2sJ3S%2B3bcM1%2BJ%2BcMXLRdCD2nE8OSNV5S9KO%2BIXK9dJ0iZHgey%2BhXMmXZImrGWCDLz%2BwnBzokhToRT70F4agtQf%2BdaLuXr%2B%2FDapwA9m8oRZFh6bXWKf6i8J4PrK1cfhf2A38RTXzoWOzGs8wrMnbxgY6sgFw1l5gAFfBmcpUJQGyhrWkeFOR66sTHowQMUCKowyaVN9xKB1wB%2B8JTgH3wuKJwb1H9PVTSHUedDvdJicWKn4z6OnQQ5Jd9Tdk0tVZN3ePQpRCE%2BxvYw9TPXj3lB989u0m3npkCy5Xm%2BK2HKZg7DA39aeo0KvvvKZsfCJGVncnwSvpD8EL6h6gOoT7k8pH3FPnPhsGxr9RZH9KuPXHsmvkQqU5OvzdBLqelRXT6dBmbDj3&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20250926T193601Z&X-Amz-SignedHeaders=host&X-Amz-Expires=300&X-Amz-Credential=ASIAQ3PHCVTY22IA7VM3%2F20250926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=36232ee6ecffb51f5cc7fff2ee284176692efb85949cb75cf66f3766c63fb668&hash=14c923e0b1da142e8475a05d57361d9ab476746c5f9880da6e3e8b78611e8c61&host=68042c943591013ac2b2430a89b270f6af2c76d8dfd086a07176afe7c76c2c61&pii=S0267364924000074&tid=spdf-62f1c115-5cd6-4d81-8d20-af326cef802b&sid=e9643fc7742b914bc619bef94766f62d06c7gxrqb&type=client&tsoh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&rh=d3d3LnNjaWVuY2VkaXJlY3QuY29t&ua=14095e57575150555c5554&rr=985535323cb39f66&cc=nl union].