Technology Governance Wiki - User contributions [en]

Module 2: Data

2024-10-09T11:21:21Z

Sofijapantic: /* China */

= Cross-border flows of personal data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
== Brazil ==

=== 1. Introduction ===
Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. 
Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. 
Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.
<div>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" | Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>
Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

=== 2. Broader data protection landscape ===
We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. 

==== 2.1 Constitutional / fundamental rights model ====
Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: 
''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' 
''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''
In 2022, the Constitution was amended to include a specific right to data protection: 
''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{|
|-
| '''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>
|}

==== 2.2 The General Data Protection Law (LGPD) ====
The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:
*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  

==== Scope of Application ====
We have considered the scope of application in three ways: personal, material and territorial. 
*Personal Scope
The LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material Scope
The LGDP applies to any processing operation of personal data. 
::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scope
The LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 
***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).

 
===== Processing of Personal Data =====
Controllers and Processors (Articles 5, 37-40, 42-43) 
*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):
*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.
Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :
*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.
The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== 2.3 Interaction of the Law and the Regulation ====
In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 
*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

=== 3. Substantive detail of cross border data flows ===
Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. 
In no hierarchy, there are various mechanisms that permit international data transfers. 
*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

==== 3.1 When are data transfers allowed? ====
The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 
#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

==== 3.2 Adequacy decisions ====
We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====
Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 
*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).
The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:
I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; and
II - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

==== 3.3 Contractual measures ====
===== Standard contractual clauses =====
The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).
Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | CLAUSE 2. Purpose
2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.
*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:
(NOTE: fill in as much detail as possible with information relating to the international transfer)
|}

<div>

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:</div>
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).

===== Equivalent Standard Contractual Clauses =====
Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.

===== Global Corporate Standards (or Binding Corporate Rules) =====
A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).
*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

 
==== 3.4 Transparency Requirements ====
All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 
#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

== '''China''' ==
China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.]
The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

 '''The Cybersecurity Law'''
In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | [https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]
''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''
|}

 Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:
*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''
*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''
*''The associated influence on other industries and sectors.''''''

 
'''The Personal Information Protection Law'''
''''''
The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''
''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''
*''Where the purpose is to provide products or services to natural persons inside the borders;''
*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}
Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:
*''Passing a security assessment by the CAC.''
**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.
*''Obtaining Personal Information Protection Certification (PIPC).''
**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]
*''Concluding a standard contract formulated by the CAC.''
**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.
*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''

 '''The Data Security Law'''
''''''
''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]
The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''
''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''
|}

Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}

The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|}

 
'''Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments'''
''''''
A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. 
The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].
Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].
[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. 

Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.
Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.
Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

 '''The Digital Silk Road'''
''''''
''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

== India ==
== United States ==

Module 2: Data

2024-10-09T11:19:23Z

Sofijapantic: /* China */

= Cross-border flows of personal data =
Cross-border data flows refers to the transferring of personal data between servers across different country borders.
== Brazil ==

=== 1. Introduction ===
Brazil is a signatory to the International Covenant on Civil and Political Rights, which grants the right to privacy under Article 17, as well as the American Convention on Human Rights, which assures the right to privacy in Article 11. 
Brazil has a specific International Data Transfer Regulation which was passed on 23 August 2024 (officially Resolution CD/ANPD No. 19 of August 23, 2024). This International Data Transfer Regulation contains procedures for adequacy decisions and template Standard Contractual Clauses (SCCs). Additional mechanisms for cross-border transfers are prescribed in the Regulation, as compared to the General Data Protection Law (LGPD) from 2018. 
Context for this 2024 Regulation is discussion of creating a "sovereign cloud" as part of Brazil's [https://www.dataguidance.com/news/brazil-ministry-science-technology-and-innovations Artificial Intelligence Plan], which aims to ensure government data is stored within national borders, avoiding reliance on foreign infrastructure.
<div>
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{| style="height: 116px; width: 958px; margin-left: 25px;" width="962"
|- style="height: 109px; margin-left: 25px;"
| style="height: 109px; width: 956px; margin-left: 25px;" | Aside: What is Brazil’s AI Plan? 
On August 7, 2024, the Ministry of Science, Technology and Innovations published a proposal for the Brazilian Artificial Intelligence Plan 2024-2028. 
The plan provides for a total of BRL 23 billion (approx. € 3.8 billion) in investments in artificial intelligence (AI) in four years, aiming to promote human-centric, transparent, responsible, and fair AI.
|}</div>
|}
</div>
Before we jump into details of the new cross-border personal data flows regulation, the below first steps through Brazil’s regulatory framework. 

=== 2. Broader data protection landscape ===
We have not identified any laws that regulate cross-border data flows that apply to non-personal data, such as the EU’s Data Governance Act. We focus here on personal data. 

==== 2.1 Constitutional / fundamental rights model ====
Brazil has a federal constitution from 1988 which enshrines the [https://www.stf.jus.br/arquivo/cms/legislacaoConstituicao/anexo/brazil_federal_constitution.pdf right to privacy] in two ways: 
''Article X – personal intimacy, private life, honor and reputation are inviolable; the right to compensation for pecuniary loss or emotional distress due to their breach is ensured;'' 
''Article XII – the secrecy of correspondence and of telegraphic, data and telephone communications is inviolable; except, in the latter case, by a court order, in the cases and as provided by law for the purposes of criminal investigation or finding of evidence in criminal proceedings.''
In 2022, the Constitution was amended to include a specific right to data protection: 
''Article LXXIX: the right to protection of personal data is ensured, including in digital media. ''

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | <div>

{|
|-
| '''National context for Brazil:''' 
Brazil is a federation of 26 states. The current [https://en.wikipedia.org/wiki/Federative_units_of_Brazil Constitution] dates from 1988, giving effect to the “New Republic” that dates from 1985 and which replaces the autocratic 1967 constitution capping 21 years of military dictatorship. 
Each state has its only legislative (unicameral) and judicial system. The federal system is overlaid on top, with the Federal Constitution being the supreme law.
[http://www.jstor.org/stable/23045695 Constitutional law] in Brazil is a hybrid system that combines:
*decentralised, incidental judicial review like in the United States; with
*centralised, abstract judicial review like in Germany and Italy.
|}</div>
|}

==== 2.2 The General Data Protection Law (LGPD) ====
The Brazilian [https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm General Data Protection Law] (LGPD) entered into force in September 2020 and is Brazil’s first  comprehensive data protection regulation. Before LGPD, data privacy regulations in Brazil consisted of various provisions spread across Brazilian legislation:
*Civil Code and consumer protection legislation 
*Brazilian [https://www.dlapiperdataprotection.com/index.html?t=law&c=BR Internet Act]: imposed requirements regarding security and the processing of personal data and other obligations on service provides networks, applications providers and provided rights for internet users.  

==== Scope of Application ====
We have considered the scope of application in three ways: personal, material and territorial. 
*Personal Scope
The LGDP applies to the processing of personal data by a natural person or legal entity (Article 1).

 
*Material Scope
The LGDP applies to any processing operation of personal data. 
::Processing means any operation performed with personal data, such as those regarding the collection, production, reception, classification, use, access, etc. (Article 5)
::Personal data means information regarding an identified or identifiable natural persons.  
::Excluded from the application of the LGDP is the processing of personal data by natural persons for purely private and non-economic purposes, or journalistic, artistic, or academic purposes (Article 11-12).

 
*Territorial scope
The LGDP applies to any processing operation carried out by a natural person or a legal entity irrespective of (1) the means used for the processing, (2) the country in which the headquarter is located or (3) the country where the data are located. Provided that: 
***the processing is carried out in Brazil
***the purpose of the processing activities is to offer or provide goods or services, or the processing of individuals located in Brazil or
***the personal data was collected in Brazil (Article 3-4).

 
===== Processing of Personal Data =====
Controllers and Processors (Articles 5, 37-40, 42-43) 
*A data controller is defined as the natural or legal person, whether public or private, which is responsible for decisions concerning the processing of personal data 
*A data processor is defined as the natural or legal person, whether public or private, which performs the processing of personal data on behalf of the controller 

 Principles: Processing of personal data in Brazil must be carried out in good faith and based on the following principles (Article 6):
*Purpose
*Suitability
*Necessity
*Free access
*Quality of the data
*Transparency
*Security
*Prevention
*Nondiscrimination, and
*Accountability.
Legal basis: The processing of personal data may only be carried out based on one of the following legal bases (Article 7) :
*With data subject’s consent
*To comply with a legal or regulatory obligation by the controller
*By the public administration, for the processing and shared use of data which are necessary for the execution of public policies provided in laws or regulations or contracts, agreements or similar instruments
*For carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data
*For the execution of a contract or preliminary procedures related to a contract to which the data subject is a party
*For the regular exercise of rights in judicial, administrative or arbitration procedures
*As necessary for the protection of life or physical safety of the data subject or a third party
*For the protection of health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities
*To fulfill the legitimate interests of the controller or a third party, except in the case of prevailing the fundamental rights and freedoms of the data subject, and
*For the protection of credit.
The [https://lawsofbrazil.com/2024/09/24/brazils-data-protection-law/ data processing] must be for legitimate, specific, explicit purposes, which must be informed to the owner. The process must also be compatible with the purposes and limited to the minimum necessary to fulfill its purposes.

==== 2.3 Interaction of the Law and the Regulation ====
In Brazil, a “regulation” is subordinate law or secondary legislation, which means it sits below a “Law” or “Act”. A r[https://guides.library.harvard.edu/law/brazil#s-lg-page-section-8920877 egulation (in Brazil) traditionally offers additional detail or procedural information] relevant to a specific part of a law; hence the General Data Protection Law (LGDP) being supported by a more specific International Data Transfer Regulation (Regulation). 

 The Regulation provides additional detail and requirements of the processes and standards, complementing the superior Data Protection Law. The Regulation (IDTR): 
*establishes special requirements and guarantees for data exports; 
*defines the content of SCCs; 
*outlines the analysis process for specific contractual clauses and binding corporate rules; 
*specifies the adequacy decision assessment process for the data protection equivalence of foreign countries or international organizations;
*outlines procedures for the ANPD's recognition of equivalence for SCCs from other countries or international organizations, with an emphasis on prioritizing approval for widely applicable clauses; and
*proposes a template for SCCs.

=== 3. Substantive detail of cross border data flows ===
Two key features of the Brazilian system for cross-border data flows are adequacy decisions and contractual instruments. For example, cross-border flows are permitted when there is an adequacy decision (but there aren’t any yet) or a contractual instrument. 

 Chapter V of the LGPD addresses international data transfers, establishing a range of guarantees and safeguards designed to protect the rights of individuals whose data is being exported. 
In no hierarchy, there are various mechanisms that permit international data transfers. 
*transfers if the destination country maintains an adequate level of protection, as assessed by the ANPD.
*when the controller offers and proves guarantees of compliance with the principles and the rights of the data subject and the regime of data protection provided in the LGPD. These situations include: 
**controller’s specific contractual clauses for a given transfer; 
**standard contractual clauses (SCCs), prepared and approved by the ANPD establish minimum guarantees and valid conditions for carrying out an international data transfer; 
**binding corporate rules (BCR); or 
**seals, certificates and codes of conduct. 

 The LGPD allows international data transfers only under specific circumstances and through legally defined and independent mechanisms. However, many of these mechanisms were not fully outlined by the LGPD — including the framework for standard contractual clauses — preventing data controllers from effectively implementing them until the ANPD provided necessary guidelines.

==== 3.1 When are data transfers allowed? ====
The transfer of personal data to other jurisdictions must comply with the requirements of the LGPD and may only occur in the following circumstances (Article 33): 
#The transfer is to countries or international organizations with an adequate level of protection of personal data
#There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
*Specific contractual clauses for a given transfer
*Standard contractual clauses
*Global corporate norms, or
*Regularly issued stamps, certificates and codes of conduct
#The transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies
#The transfer is necessary to protect the life or physical safety of the data subject or a third party
#The ANPD has provided authorization
#The transfer is subject to a commitment undertaken through international cooperation
#The transfer is necessary for the execution of a public policy or legal attribution of public service
#The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.

==== 3.2 Adequacy decisions ====
We have not identified any adequacy decisions from the ANDP. We did find [https://lawsofbrazil.com/2024/09/22/brazils-international-data-transfer-regulations-how-do-they-compare-with-the-eus-gdpr/ a blog post ]dated 22 September 2024 that also indicates no adequacy decisions have yet been issued. 

===== How is the level of protection assessed for adequacy in the recipient country? =====
Considerations for the ANPD (DPA equivalent) when making an adequacy decision include: 
*I the general and sectoral rules of the legislation in force in the country of destination or in the international body;
*II - the nature of the data;
*III - compliance with the general principles of protection of personal data and rights of the holders provided for in this Law;
*IV - the adoption of security measures provided for in the regulation;
*V - the existence of judicial and institutional guarantees to respect personal data protection rights; and
*VI - other specific circumstances relating to the transfer (Article 34).
The new Regulation lists the same considerations for adequacy decisions and provides additional considerations in Articles 11 and 12 of the Regulation:
I - the risks and benefits provided by the adequacy decision, considering, among other aspects, the guarantee of the principles, the rights of the holder and the data protection regime provided for in Law No. 13,709, of August 14, 2018; and
II - the impacts of the decision on the international flow of data, diplomatic relations, international trade and Brazil's international cooperation with other countries and international organizations. 

==== 3.3 Contractual measures ====
===== Standard contractual clauses =====
The ANPD (DPA equivalent) has introduced a [https://iapp.org/news/a/brazil-s-new-regulation-on-international-data-transfers rigid model for SCCs,] drawing inspiration from frameworks in the EU, U.K., New Zealand and Singapore. Brazil's SCCs can be part of a stand-alone contract or attached to a broader agreement, provided they are adopted in full by the parties, with no modifications to the text (Article 15).
Annex II of the Regulation provides template standard contractual clauses. For example, we have copied the below clause two (noting translation via Google Translate and not an official source). The standard contract clauses in Annex II of the Regulation also include drafting notes to assist with implementation in standard form contracts. 

{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | CLAUSE 2. Purpose
2.1. These Clauses apply to International Data Transfers from the Exporter to the Importer, as described below.
*****Description of international data transfer:
*****Main purposes of the transfer:
*****Categories of personal data transferred:
*****Data storage period:
*****Other information:
(NOTE: fill in as much detail as possible with information relating to the international transfer)
|}

<div>

{| style="font-size: 14.4px;"
|-
|
 
|}
Broadly, the template standard contractual clauses include detail about:</div>
*Transparency
*Data holder rights
*Additional protection of children's privacy and sensitive personal data 
*Reporting security incidents within 3 business days 
*Access requests (annex II IDTR).

===== Equivalent Standard Contractual Clauses =====
Notably, the ANPD may recognize the equivalence of foreign SCCs through a procedure initiated by the ANPD board or requested by any interested party (Article 18 IDTR). For the equivalent SCCs to take effect, the ANDP board must approve and publish them on the ANPD website, assessing compatibility with Brazil's SCCs, the Regulation and the Law.

===== Global Corporate Standards (or Binding Corporate Rules) =====
A global corporate standard constitutes a valid mechanism for international transfers of personal data only to organizations or countries covered by the global corporate standards (Article 25 Regulation).
*Global corporate standards are intended for international data transfers between organizations in the same group or conglomerate of companies, and are binding on the members of the group that subscribe to them (Article 25 IDTR).
*Global corporate standards must be linked to the implementation of a privacy governance program that meets the minimum conditions established in the General Data Protection Law (Article 26-27 IDTR).
*Global corporate standards must be submitted for approval by the ANPD (Article 28 IDTR).

 
==== 3.4 Transparency Requirements ====
All contractual instruments (SCCs, equivalent SCCs, and global corporate standards) are subject to additional transparency measures, which impose two obligations on data controllers. 
#Upon the data subject's request, controllers have 15 days to provide the full text of the contractual instruments used for the transfer, excluding any trade secrets. 
#Controllers must also publish information on international data transfers in their privacy notice or another publicly accessible document on their website (Article 17 IDTR).

 These transparency requirements seek to uphold data subjects rights, according to the objectives of the Regulation, which include: “accountability and reporting, through the adoption of effective measures capable of proving observance and compliance with the principles of the rights of the holder and the personal data protection regime provided for in Law No. 13,709, of August 14, 2018 (being the LGPD), including the effectiveness of these measures” (Article 2(4) IDTR).

== '''China''' ==
China’s data protection framework has two strands: personal information protection, and data security. Importantly, the notion of personal information protection is however not tied to privacy, which is mainly limited to a reputational right in Chinese civil law. Additionally, [https://digichina.stanford.edu/work/analyzing-chinas-2021-2025-informatization-plan-a-digichina-forum/ Rogier Creemers] argues that China’s regulatory approach implements their specific perspective and goals of cybersecurity and informatisation, rather than overarching normative conceptions of privacy. [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 Public security is identified as a primary driving force.]

The data protection framework in China developed slowly and in a fragmented manner, partially due to [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ the nature of Chinese lawmaking], wherein legislation includes primarily basic elements whilst obliging government and local departments to develop implementing regulations that involve greater detail. Comments on these implementing regulations are limited for both reasons of scope and of feasibility, as smaller, regional, highly technical, or less relevant implementing regulations have less reliable, accessible information available. Additionally, the fragmented framework has seen certain aspects of data protection integrated in other legal fields, such as competition in China’s Anti-Monopoly Law, or in consumer protection legislation, though elaboration on these aspects is also limited.

 '''The Cybersecurity Law'''In 2012, the Chinese government wished to centralise its fragmented data protection framework and aimed to facilitate the process through concentrating digital competences. As a result, the [https://www.cac.gov.cn/2016-11/07/c_1119867116.htm Cyberspace Administration of China (CAC)] was [https://academic.oup.com/cybersecurity/article/8/1/tyac011/6674794 established]. The CSL came into effect 5 years later in 2017, and formed the basis for data protection regulation in China. [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ Whilst the CSL governs a variety of topics, the most relevant] include individual data protection, increased sanctions for data protection infringements, and the notion of “important data” which would be refined in the DSL. The CSL introduced a restriction on cross-border data flows, as Article 37 CSL obliges [https://scholarlycommons.law.northwestern.edu/njilb/vol44/iss1/1/ “critical information infrastructure operators [to] store personal data and important data within mainland China.”] Due to the vague definitions which awaited further elaboration through guidelines and delegated legislation, this had an adverse effect on organisations which transferred data. 
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | [https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/ A translation of Article 37 CSL follows:]''Critical information infrastructure operators that gather or produce personal information or important data during operations within the mainland territory of the People’s Republic of China, shall store it within mainland China. Where due to business requirements it is truly necessary to provide it outside the mainland, they shall follow the measures jointly formulated by the State cybersecurity and informatization departments and the relevant departments of the State Council to conduct a security assessment; where laws and administrative regulations provide otherwise, follow those provisions.''
|}
 Later, a definition of critical information infrastructure operators was delineated in the [https://www.gov.cn/zhengce/content/2021-08/17/content_5631671.htm?mc_cid=da5881cf31&mc_eid=a268621911 Regulations on the Security and Protection of Critical Information Infrastructure] which gives a better idea of which organisations should be such operators. Article 8 of the aforementioned regulations states that relevant authorities should create lists of critical information infrastructure operators, considering the following factors (unofficially) [https://digichina.stanford.edu/work/translation-critical-information-infrastructure-security-protection-regulations-effective-sept-1-2021/ translated as follows]:
*''The degree of importance of the network infrastructure, information system, etc., for the critical and core activities within the industry or sector;''

*''The degree of harm that might result from the network infrastructure, information system, etc., if it is destroyed, loses functionality, or has its data leaked;''

*''The associated influence on other industries and sectors.''
'''The Personal Information Protection Law'''

The PIPL came into force in 2021 established the Chinese personal protection framework, partly modelled on EU GDPR. The PIPL also has an extraterritorial scope similar to the GDPR, found in Article 3 PIPL, [https://digichina.stanford.edu/work/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021/ with a (unofficial) translation as follows]: 
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to the activities of handling the personal information of natural persons within the borders of the People’s Republic of China.''''Where one of the following circumstances is present in handling activities outside the borders of the People’s Republic of China of personal information of natural persons within the borders of the People’s Republic of China, this Law applies as well:''
*''Where the purpose is to provide products or services to natural persons inside the borders;''

*''Where analyzing or assessing activities of natural persons inside the borders;''
*''Other circumstances provided in laws or administrative regulations.''
|}
'''' Chapter III provides rules on the cross-border transfers of personal information and it particularly provides restrictions on providing personal information collected within China to overseas parties. Article 38 PIPL outlines a legal basis under which a personal information processor can provide [http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_2.htm “personal information for a party outside the territory of the People's Republic of China,”] which includes:
*''Passing a security assessment by the CAC.''

**[https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdee5dd9820a71 Meng Chen] provides an additional explanation of the guidelines further saying that “transfer of personal information involving more than 1 million people or when data processors that have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year provide personal information abroad” requires a security assessment.

*''Obtaining Personal Information Protection Certification (PIPC).''

**PIPC is suitable for Chinese entities that carry out large amounts of personal information processing activities, as well as data-driven businesses, as described by [https://www.cac.gov.cn/2022-11/18/c_1670399936658129.htm CAC on the Implementation Rules for Personal Information Protection Certification, 2022 NO. 37.]

*''Concluding a standard contract formulated by the CAC.''

**Such a standard contract is adopted when the amount of personal information is not big enough to trigger the security assessment requirement.
**The CAC published the “Standard Contract for the Outbound Transfer of Personal Information” and its annexes of the “Measures for the Standard Contract on Outbound Transfers” provides complaint mechanisms to overseas recipients and joint liability between domestic information operators and overseas recipients. [https://intellectual-property-helpdesk.ec.europa.eu/news-events/news/brief-analysis-measures-standard-contract-outbound-transfer-personal-information-2023-04-24_en European Innovation Council and SMEs Executive Agency] wrote an analysis, inter alia, of such measures.

*''Meeting other conditions such as [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8cfdefbe081d0a71 “individuals' separate consent, data localization, judicial and enforcement assistance, and countermeasure to malicious oversea data infringement.”]''
 '''The Data Security Law'''

''''''The DSL came into force in 2021 and [https://academic.oup.com/book/56342?login=false aims to address Chinese national security concerns] on access to data, such as those arising from foreign governments. The DSL classifies data by category and assigns differing levels of protections, and [https://link.springer.com/article/10.1365/s43439-021-00038-3 carries on the idea of “important data” present in the CSL. ]

The DSL has an [https://www.sciencedirect.com/science/article/pii/S0267364924000645?ref=pdf_download&fr=RR-2&rr=8ccd8152383fb8f6 extraterritorial component]. Article 2 DSL states that the Law may also apply to data processing activities outside of mainland China if it harms national security, the public interest, or the rights of Chinese citizens. An unofficial translation is as follows:
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''This Law applies to data handling activities and their security regulation within the mainland territory of the People’s Republic of China (PRC).''''When data handling activities outside the mainland territory of the PRC harm the national security, the public interest, or the lawful rights and interests of citizens or organizations of the PRC, legal liability is to be pursued according to the law.''
|}
Additionally, the DSL fills a perceived regulatory gap in the CSL regarding the cross-border transfer of important data. Article 37 CSL mandates important data collected and generated by critical infrastructure information operators, when transferred outside of China, to be subject to a security assessment. The DSL expands the scope of this obligation by mandating that all important data to be transferred undertake this security assessment regardless of its source being a critical infrastructure information operator or not.[https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ This obligation is found in Article 31 DSL, with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The provisions of the Cybersecurity Law of the PRC apply to the outbound security management of important data collected or produced by critical information infrastructure operators operating within the mainland territory of the PRC; outbound security management measures for other data handlers collecting or producing important data within the mainland territory of the PRC are to be jointly formulated by the national cybersecurity and informatization department and relevant departments of the State Council.''
|}
The DSL also regulates cross-border data transfer at the request of foreign governments. Article 36 DSL mandates any such potential transfer to be approved by the People’s Republic of China, [https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/ with a (unofficial) translation as follows:]
{| class="wikitable" style="border-collapse: collapse; width: 100%;"
|-
| style="width: 100%;" | ''The competent authorities of the PRC are to handle foreign justice or law enforcement institution requests for the provision of data, according to relevant laws and treaties or agreements concluded or participated in by the PRC, or in accordance with the principle of equality and reciprocity. Domestic organizations and individuals must not provide data stored within the mainland territory of the PRC to the justice or law enforcement institutions of foreign countries without the approval of the competent authorities of the PRC.''
|}
 '''Regulation of Cross-Border Data Flows: Changing Approaches and Recent Developments'''

A key tool in China’s regulation of cross-border data flows are security assessment obligations, as it impacts personal data protection and data security considerations in the Chinese legal framework. As a result, the [https://www.sciencedirect.com/science/article/pii/S0267364924000645 CAC put forward] three drafts that elaborated on such national security assessments: the Measures for the Security Assessment of Outbound Personal Information and Important Data Transfer, Measures for the Security Assessment of Outbound Personal Information Transfer, and Measures for the Security Assessment of Outbound Data Transfer (MSA), in 2017, 2019, and 2021, respectively. 

The proliferation of drafts shows the difficulty and significance of relegating elaboration of such legislation to authorities like the CAC. [https://www.sciencedirect.com/science/article/pii/S0267364924000645 Meng Chen] argues that concepts such as “important data” remain in debate and the strict rules, lack of clarity, and introduction of monetary sanctions limits China’s integration into international data governance structures and competitiveness in the data economy. For example, the definitions of critical information infrastructure operators, alongside the definition of a new category of “critical data” refer to high-level concepts of [http://journal.yiil.org/home/archives_v17n1_06 national security and the public interest].

Consequently, China has recently [https://www.sciencedirect.com/science/article/pii/S0267364924000645 switched approaches] to cross-border data flows, recognising that a loosening of requirements is necessary to facilitate Chinese growth and development; as a result, the CAC proposed draft Provisions on Regulating and Promoting Cross-Border Data Flow, which were published as the [https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm Provisions on Promoting and Regulation Cross-Border Data Flow (PPR)] in [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do early 2024].

[https://www.sciencedirect.com/science/article/pii/S0267364924000645#sec0007 The PPR tightens the vague], general scope of previous cross-border data transfer rules in the CSL, DSL, and PIPL by reducing thresholds wherein cross-border data transfer measures apply, particularly in the case of personal data, and significantly loosening cross-border data transfers occurring from Chinese free-trade zones. 

Thresholds have been lowered particularly for the cross-border transfer of personal data. Firstly, transferring non-sensitive personal information of less than 100,000 individuals does not require a transfer mechanism such as a security assessment. Secondly, transferring personal information of 100,000-1,000,000 people or sensitive personal information of <10,000 people no longer requires a security assessment by the CAC, but either a standard contract or a PIPC. Transfers exceeding these numbers however still require a CAC-directed security assessment.

Transferring important [https://iapp.org/news/a/chinas-new-cross-border-data-transfer-regulations-what-you-need-to-know-and-do data still requires a CAC security assessment], however. The definition of important data has not been clarified and has caused significant legal uncertainty for many companies. PPR alleviates some of this burden by making data “nonimportant” by default, meaning organisations handling data do not have to consider their data important unless it is either identified as such, they fall under a category of important data as announced by relevant authorities, or they are notified by regulators themselves.

Additionally, free-trade zones are allowed to establish a negative list – cross-border data transfers falling under this list must undertake relevant measures, whether a security assessment, PIPC, or standard contract; however, cross-border data transfers falling outside this list require no measures. This is a significant liberalisation and provides greater legal certainty than the previous framework.

 '''The Digital Silk Road'''''''''

''''''On an international level, [http://journal.yiil.org/home/archives_v17n1_06 Ye Liu] argues that China promotes cooperation and builds consensus with their cross-border data flow regulations through its Digital Silk Road Initiative, wherein it signed a Memorandum of Understanding on cooperation with 16 countries and established other cooperation mechanisms, such as the Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area, which aims to establish a security system.

== India ==
== United States ==

Module 1: Infrastructures

2024-09-25T16:42:06Z

Sofijapantic: /* India */

== Net Neutrality and Zero-ratings ==
[https://eur-lex.europa.eu/EN/legal-content/glossary/open-internet-and-net-neutrality.html#:~:text=Net%20neutrality%20is%20the%20principle,%2C%20blocking%2C%20throttling%20or%20prioritisation Net neutrality] is the principle that internet service providers (ISPs) treat all online traffic equally and openly, without discrimination, blocking, throttling or prioritisation. [https://www.berec.europa.eu/en/what-is-zero-rating Zero-rating] is a commercial practice whereby an internet access provider applies a zero tariff, or a tariff that is more advantageous, to all or part of the data traffic associated with an application or category of specific applications, offered by partners of that access provider.
=== Brazil ===
=== China ===

China follows a governmental control model for internet and telecommunications regulation. Under this model, the government has control of all aspects of the internet, including who is allowed access, what content is accessible, and the rate of delivery of that content. China can be considered as the most controlling jurisdiction of internet content and is not in support of network neutrality. Access to the internet in China from the outside world is limited and all Internet traffic in China must pass through one of three large computer centers in Beijing, Shangai and Guangzhou. The Chinese government maintains control over China’s gateways to the global internet, giving authorities the ability to cut off cross-border information requests in order to restrict connectivity or access to content hosted on servers outside the country. This arrangement is the foundation for the ‘Great Firewall’, which is considered the world’s most sophisticated internet censorship program.

Another strategy for control of the internet in China is that state-owned companies dominate the ISP sector of the mobile market: China Mobile, China Telecom, and China Unicom. In 2019, British Telecom (BT) became the first foreign telecommunications company to receive permission to provide internet services across the country. Authorities exercise tight control over cybercafes and other public access points, which are licensed by the Ministry of Culture in cooperation with other state entities.

Another key part of the regulation of the telecommunications sector in China is content management, or censorship. This is not the focus of this Wiki. We address elements of cybersecurity or censorship laws as they relate to the infrastructure elements of the telecommunications sector in China (such as from the Cybersecurity Law 2017). Accordingly, the law we focus on here is the '''Telecommunications Regulation 2000'''. Before we jump into the legal framework, we explain first the policy context and then the market structures.

===== Policy Context =====
Chinese internet policy shows distinct features at different stages, heavily influenced by the political thinking and outlook of the leadership at the time as well as China’s social, economic and political conditions.

The early phase, before a period of reform in the 1980s, saw telecommunications under strict state control, with limited infrastructure and services primarily serving governmental needs. Post-1980s economic reforms introduced a gradual liberalisation, allowing room for infrastructural growth and services expansion. This led to the implementation of the Telecommunications Regulation in 2000, establishing a legal framework that aimed to separate government functions from business operations, reduce monopolistic practices, and promote competition and innovation (Article 4). The turn of the millennium saw a rapid acceleration in policy evolution market competition, marked by China's accession to the World Trade Organization ('''WTO''') in 2001.

Before 1998, the telecommunications regulator was the Ministry of Posts and Telecommunication (MPT). Until 1994, the MPT was instrumental in promoting the development of the Chinese telecommunications sector. During this period, the telecoms industry was monopolized and there was no clear distinction between the functions of government and enterprises. From 1998, competition has been introduced into the telecom market, with the creation of a second communications network operator, China Unicom. The second stage started with the establishment of Ministry of Information Industry (MII) in 1998. It became the principal regulator of the telecommunications and information industry and was initially granted operational control over both China Telecom and China Unicom. During 1999 and 2000, China Telecom and China Unicom were restructured to promote greater competition, creating a total of seven distinct Chinese state-owned telecommunications providers each with primary operations in a different functional aspect. Yet, given the relatively low accessibility of telecommunications to the Chinese population, Chinese telecommunications policy remained oriented towards the development of telecommunications infrastructures. With the adoption of the Telecommunications Regulation in 2000, telecommunications regulation entered the stage of regulation according to laws, and a regulatory framework has been established.

The situation shifted in in 2001 with China admission to the WTO. Obligations under the WTO required China to adopt telecommunications regulations to introduce and promote market competition, to protect the rights and interests of consumers and to increase the welfare of consumers. This era led to further reforms, including the restructuring of state-owned enterprises (SOEs), the introduction of foreign investment in the telecommunications sector, and an emphasis on digitalisation. Establishment of MIIT (ministry of Information Technology in 2008, the Antimonopoly Law (AML) was finally adopted in 2007 and became effective in 2008. Similar to competition rules in other jurisdictions, the AML also prohibits anti-competitive agreements (Chapter II), abusing dominant positions (Chapter III), and anticompetitive mergers (Chapter IV).

===== Net Neutrality in China and the Great Firewall =====
A key part of the regulatory framework of the internet in China is the Great Firewall. Although the Great Firewall is inherently content moderation, not specifically related to net neutrality, it is important to understand in order to view internet regulation through the norms of the Chinese political framework.

The Great Firewall controls how internet content is distributed to citizens; what they can and cannot access. While the principle of net neutrality suggests citizens should be able to access different products on the internet without discrimination, the Great Firewall imposes this discrimination as government policy. In other words, net neutrality is not a principle considered in Chinese internet policy, and the policy position is pro-discrimination via content management in the name of national security.

The Great Firewall means that any new domain or platform which wants to enter Chinese cyberspace must adhere to domestic regulations. Consequently, domains that do not adhere to domestic regulations are banned; Facebook, Twitter, YouTube, Wikipedia, and Instagram.

Technologically, the Great Firewall is made up of two software’s:
# Last mile providers of internet services to consumers automatically filter suspicious references, also considered access requests; and
# ISPs implement filters that blocked Chinese websites, also called interconnecting networks.

The GFW relies on filtering methods like blocking Internet Protocol (IP) address, Transmission Control Protocol (TCP) packet filtering and forging, Domain Name System (DNS) spoofing, redirection, and filtering Uniform Resource Locator (URL) by transparent proxies.

The implication of this system is that net neutrality - the equality of access by citizens to different parts of the internet - is not a consideration, as discrimination of content to “advance the dissemination of core socialist values” (Art 6, CSL) is inherent in the internet policy of the state in the name of cyber security.

==== Telecoms Regulation in China ====
The Chinese government structures its regulations to control political risks through carefully designed institutional arrangements, control of network operation, and tight regulations on end-users.
The legal foundation of telecommunication regulation is stated in China’s State Council Order 195, ‘Interim Regulations on International Interconnections of Computer Information Networks in the PRC’. (PRC meaning People’s Republic of China.) Order 195 granted the Steering Committee on National Information Infrastructure, part of the Ministry of Information Industry, primary regulatory responsibility for China’s internet, which includes determining and coordinating important issues of international interconnections.

:: ''Primary telecoms regulator: Steering Committee on National Information Infrastructure''

In the internet server provision sector, Order 195 divides China’s Internet networks into two categories:
# interconnecting networks and
# access networks.

====== ''Interconnecting networks'' ======
: Interconnecting networks are directly linked to the global internet through international leased lines and must have the approval of the State Council in order to operate. These interconnecting networks assume heavy and important responsibilities of internet regulation, including responsibility for online content blocking and filtering.
: In this area, only four licences have been granted - CERNet and CSTNet and ChinaNet and ChinaGBN. These four interconnecting networks are tied closely to government agencies. ChinaNet is operated by China Telecom, which falls under control of the Ministry of Information Industry (MIIT).

====== ''Access networks'' ======
: The Chinese access networks are the equivalent of internet service providers (ISPs), providing access and content services but no direct global interconnection. An access network provider has to be licenced by and gain global access through one of the four interconnecting networks. ISPs are key to filtering the huge number of sensitive words on the blacklist. In such circumstances, Chinese ISPs are more political than commercial.

: In summary, the provision of internet to consumers resembles:

:: Global internet ➡ Interconnecting network ➡ Access Network ➡ Consumer

==== Telecommunications Regulations ====
The Telecommunications Regulations, first issued in 2000 and then revised in 2016, covers licensing, fee collection, interconnectivity, operation and regulation of telecoms services in mainland China. The Classified Catalogue of Telecommunications Services, effective from 1 March 2016, sets out the specific and categories of services that are regulated under the telecommunications licensing regime. These regulations provides general regulations on domestic telecommunication services, including the licensing of telecommunication services, the provision of telecommunication services, the construction of telecommunications facilities and telecommunications security.

The aim of these regulations are to regulate the order of the telecommunications market, safeguard the legitimate rights and interests of telecommunications subscribers and operators, ensure the safety of telecommunications networks and information, and to promote the sound development of telecommunication industry (article 1). The regulations are addressed to anyone that engage in telecommunications activities or telecommunications-related activities (article 2). Article 4 provides that the supervision and regulation of the telecommunications industry shall be based on the principles of separation of government administration from enterprise management, elimination of monopoly, encouragement of competition and innovation, as well as principle of openness, fairness and impartiality. Under article 5, telecommunications operators shall provide telecommunication subscribers with services that are fast, accurate, secure, convenient and reasonably-priced.

The Telecommunications Regulation is mainly comprised of two substantial chapters for the purpose of promoting competition.

====== ''Licencing scheme'' ======
: As far as market entry is concerned, a two-layer authorisation mechanism is established based firstly on services and secondly on geographic coverage. In terms of services, Category I of basic telecom services and satellite facilities (Category II of basic telecom services) are exclusively licensed by the Ministry of Industry and Information Technology (MIIT), and are so far only awarded to the three SOEs. With regard to other telecom services, intra-provincial operation licenses are administered by provincial-level telecom authorities while inter-provincial ones are authorised by the MIIT.

====== ''Cybersecurity Law'' ======
: The Cybersecurity Law (CSL) establishes the overarching security framework relevant to internet traffic in China, including the governing of internet infrastructure (Art 2 CSL). To safeguard data sovereignty, the CSL imposes data localisation requirements on critical information infrastructure operators. Other relevant obligations in the CSL are:

:: * Article 9: Network operators shall, when conducting business operations and providing services abide by laws and administrative regulations, respect social morality, observe business ethics, operate in good faith, perform their obligations to safeguard cybersecurity, accept supervision by the government and the public, and undertake social responsibilities.
:: * Article 12: The State shall protect the rights of citizens, legal persons and other organisations to use networks in accordance with the law, promote improved network access, provide better network services, provide the public with secure and convenient network services, and guarantee the lawful, orderly and free circulation of network-based information.

: It is unclear what is meant by reference to ‘social morality’ and ‘business ethics’, but that we view this through the prism of Chinese international relations and our understanding of societal values - essentially connecting these ideas to community, state-first control of information. This is not translatable to European norms associated with fundamental rights and the single internal market.

==== Other related legislation ====
Other related legislation includes:
* State Council - Regulations on Security Protection of Computer Information Systems, Administrative Measures for Internet Information Services
* The national intelligence law
* Ministry of Public Security - Administrative Measures for Prevention and Treatment of Computer Viruses
* Ministry of Public Security and five other ministries - Administrative Measures for Hierarchical Protection of Information Security
* NPC Standing Committee - Law on Guarding State Secrets

==== Sources ====

The above information is based on our consideration of the Telecommunications Regulations, Cybersecurity Law and the following secondary sources:
* Hu, Henry L. “The Political Economy of Governing ISPs in China: Perspectives of Net Neutrality and Vertical Integration.” The China Quarterly, Volume no. 207 (2011) 523–40. Available here: http://www.jstor.org/stable/41305255
* Pranavnayar 'The Legality of China’s Great Firewall: How Does the International Law Fare' Metacept 6 June 2021 <https://metacept.com/the-legality-of-chinas-great-firewall-how-does-the-international-law-fare/
* Christine M. Stover, ‘Network Neutrality: A Thematic Analysis of Policy Perspectives Across the Globe’ [2010] Global Media Journal Volume 3(1) pp. 75-86
* Bernd Holzenagel, Xu Junqi and Thomas Hart, ‘Regulating Telecommunications in the EU and China: What Lessons to be Learned?’ Arbeitsberichte Zum Informations-, Telekommunikations- Und Medienrecht Volume 16 [2009]
* Martyn Taylor, ‘Reforming China’s telecommunications law: lessons from the Australian experience’, International Journal of Communications Law and Policy Issue 7 [Winter 2002/2003]
* Becky P Y Loo, ‘Telecommunications reforms in China: Towards an analytical framework’ Telecommunications Policy 28 [2004] pp 679-714
* Report from US Embassy Beijing [2024] Available at: https://irp.fas.org/world/china/netreg.htm
* Zixiang Alex Tan, ‘Regulating China’s Internet: convergence toward a coherent regulatory regime’ Telecommunications Policy Volume 23, Issues 3-4, [1999] pp. 261-276
* Grace Wang, ‘Telecoms regulations in China’ Lexology [2022] Available at: https://www.lexology.com/library/detail.aspx?g=c8e8fd3d-4989-4db0-8887-45fd7a86f1a5
* Liyang Hou, ‘When competition law meets telecom regulation: the Chinese context’ Computer Law and Security Review 31(5) [2015]

== India ==

The Indian regulatory framework currently features a strong commitment to net neutrality and a ban on zero rating. The development of this framework, however, cannot be understood without due attention paid to the legislative players in India and the context of the proliferation of zero rating services in 2015. Consequently, this section outlines the regulatory authorities responsible for telecommunications regulation in India, the resulting regulatory framework relating to net neutrality and zero-rating, and further challenges to net neutrality and food for thought.
India has a Department of Telecommunications (DoT) which is responsible for setting out its telecommunications policy. Under section 3 of the Telecom Regulatory Authority of India Act by the DoT, the Telecom Regulatory Authority of India (TRAI) was established as a statutory body of the DoT.

===== Zero rating: Facebook's "Free Basics Ban" =====

The debate on net neutrality followed primarily from the debate on the zero rating due to the proliferation of zero rating packages in 2015, the most notorious of which included Facebook’s “Free Basics” service and Airtel’s zero rating platform for app developers. In India, only around 50% of the population purchased data plans for their smartphones, and out of those who used it, it was shown that the average data package used was around 80MB per month in 2015. Therefore, due to the small data packages, zero rating was an attractive and reliable service.
The problem arose with the introduction of Facebook's zero rating model with Internet Access Providers, which included a service called Internet.org, which despite its misleading name offered exclusively Facebook services free of charge under the “Free Basics” model. Internet.org was meant to be an open platform that gives Indian developers additional services offered for free, used by those users who could not afford traditional internet access. Nevertheless, only partner websites and applications would be able to be included, ultimately going against the principles of net neutrality.
As a result of the misleading and untransparent, in 2016, TRAI published the “Prohibition of Discriminatory Tariffs for Data Services Regulations, 2016” which prohibited zero rating. Article 3 of the aforementioned regulation outlines this prohibition, whilst Article 4 stipulates a potential derogation for providing emergency services “or at times of grave public emergency.” However, the telecom provider must notify this reduced tariff to TRAI and the authority’s decision on its compliance with the Discriminatory Tariffs Regulation is final.

===== Net neutrality =====

The ban on zero rating was followed up with an overarching debate on net neutrality. Both TRAI and a Committee under the DoT consequently released papers advocating for the adoption of net neutrality principles throughout telecommunication legislation. As a result, the DoT signed off on TRAI’s recommendation to wholly support net neutrality principles and amended numerous parts of its core telecommunication legislation to integrate such principles. In 2018, the DoT amended the “Unified License for Telecom Service Providers (TSPs) and Unified License (Virtual Network Operators) and Unified Access License Agreement to incorporate the principles of non-discriminatory treatment of content.” In 2019, further amendments occurred regarding the Internet Service Provider License for Regulatory Framework. Some exemptions are present regarding the principles of non-discriminatory treatment of content and/or traffic for when “quality of service is essential,” such as in the cases of autonomous vehicles.
Despite these net neutrality principles, there remains the problem of the Indian government’s ability to legally order ISPs to block access to certain content, either for its own purposes or due to court orders. Whilst India’s net neutrality principles do not presuppose such government requests as violations per se, the problem lies in the perceived clash between the legislative provisions. For example, such government orders would be permissible as long as the measures adopted by the ISP are “proportionate, transient, and transparent;” however, the rules regarding the blocking of content stipulate a legal requirement to maintain the confidentiality of blocking requests and subsequent actions.

==== Opposition to net neutrality ====

Additionally, some scholars critique India’s strict approach to net neutrality due to the rapid developments in the internet space. For example, “complexities such as vertical partnerships between [internet service providers (ISPs)] and [content and application providers],” content delivery networks, and the deployment of 5G show the limits of India’s ex-ante net neutrality approach. As a result, further ex-post enforcement may be necessary to bolster net neutrality in India.

In sum, India’s regulatory framework started with a ban on zero rating as a result of controversy arising from the proliferation of zero rating with services such as Facebook’s “Free Basics.” This later erupted in a political debate on whether India should, as a result, commit fully to net neutrality, which was ultimately answered in the positive when the DoT implemented TRAI’s recommendations throughout India’s various telecommunications regulations. However, criticisms remain about the limited exceptions to net neutrality rules, and the Indian government’s eager censorship through blocking requests to ISPs may still pose threats to a free internet in India.

==== Sources: ====

* The Telecom Regulatory Authority of India Act [1997] 199724 <https://www.indiacode.nic.in/handle/123456789/1929>.

* Jon Russel, ‘Under Fire In India, Facebook’s Internet.org Launches In Indonesia’ (TechCrunch, 2015) <https://techcrunch.com/2015/04/20/internet-dot-org-indonesia/>.

* Parmy Olson, ‘This App Is Cashing in on Giving the World Free Data’ (Forbes, 29 July 2015) <https://www.forbes.com/sites/parmyolson/2015/07/29/jana-mobile-data-facebook-internet-org/>, cited in Luca Belli, ‘Net Neutrality Reloaded: Zero Rating, Specialised Service, Ad Blocking and Traffic Management’ (2016) Annual Report of the UN IGF Dynamic Coalition on Net Neutrality.

* Lok Sabha Secretariat, ‘Net Neutrality: India's Position,’ (Parliament Library And Reference, Research, Documentation And Information Service, 2016) Reference note No.6/RN/Ref./February/2016.

* Prohibition of Discriminatory Tariffs for Data Services Regulations [2016] <https://trai.gov.in/sites/default/files/Regulation_Data_Service.pdf>.

* Ministry of Communications, ‘Net Neutrality in India’ (Press Release 1884064, 2022) <https://pib.gov.in/PressReleasePage.aspx?PRID=1884064>.

* Shruti Dhapola, ‘Net Neutrality rules approved by government; Internet to remain free and open in India’ (The Indian Express, 2018)<https://indianexpress.com/article/technology/tech-news-technology/net-neutrality-rules-now-approved-by-telecom-commission-india-internet-timeline-5256139/>

* BBC, ‘India adopts 'world's strongest' net neutrality norms’ (BBC, 2018) <https://www.bbc.com/news/world-asia-india-44796436>.

* The Wire Staff, ‘India Approves New Net Neutrality Rules, Signs off on New Telecom Policy’ (The Wire, 2018) <https://thewire.in/tech/india-approves-new-net-neutrality-rules-signs-off-on-new-telecom-policy>.

* Smriti Parsheera, ‘Net neutrality in India: From rules to enforcement’ (Medianama, 2020) <https://www.medianama.com/2020/05/223-net-neutrality-india-rules-enforcement/>.

* Raghuvansh Seth, ‘Fleeting neutrality: The inadequacies of the ex-ante net neutrality regulations in India’ (2022) 23 Competition and Regulation in Network Industries 1.

=== South Africa ===
=== United States ===

=== International Organizations ===