Looking at Global CyberLaw

Involved with this some time ago, continues to increase in complexity. 

Cyberlaw: Where We Are and What's On the Horizon  in ACM News

By Karen Emslie,     Commissioned by CACM Staff, November 29, 2022

Talita Dias said viewing cyberspace as a new 'space' is misleading.

Around 120 countries have adopted data protection and privacy legislation and many have introduced new laws or amended existing ones to apply to cyberspace, often modelling them on Europe's General Data Protection Regulation.

Cyberlaw deals with the legalities of our interactions with technologies and one another in cyberspace. It is an umbrella term that encompasses matters as diverse as cybersecurity, data privacy, social media, artificial intelligence, autonomous weapons, and cryptocurrency.

New products, platforms, capabilities, and threats are constantly emerging. It is the job of lawmakers to determine how they fit into existing legal frameworks, and to create new legislation when they do n0t. However, establishing agreements has proven challenging at the country level and internationally alike, and it is an area of law that is increasingly impacted by geopolitics.

Here, we look at some existing and upcoming cyber legislation and lay out what remains up for discussion and debate.

Leading the way: data privacy, cybersecurity

One of the most developed areas of cyberlaw pertains to data and privacy. In 2018, the European Union (EU) passed the General Data Protection Regulation (GDPR) to regulate data use, processing, and privacy across the EU and the European Economic Area (EEA). The GDPR builds on the Council of Europe's 1981 legally binding Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, or Convention 108.

Today, around 120 countries have adopted data protection and privacy legislation and many have introduced new laws or amended existing ones to apply to cyberspace, often modelling them on the GDPR. They include South Korea's Personal Information Protection Act (PIPA), Japan's Act on the Protection of Personal Information (APPI), Brazil's General Data Protection Law, and South Africa's Protection of Personal Information Act (POPI).

In the U.S., the American Data Privacy and Protection Act was introduced in the House in June 2022 and is currently pending. According to Scott J. Shackelford, an expert in business law at Indiana University and executive director of the university's Center for Applied Cybersecurity Research, the U.S. has adopted a more "freewheeling model" than other countries, including "a lighter-touch regulatory, both for privacy and cybersecurity."

Individual U.S. states, however, have adopted tougher measures, such as the California Consumer Privacy Act of 2018 and its 2020 amendment, the California Consumer Privacy Act (CCPA), or Proposition 24.

For the most part, there is "a little bit of a transatlantic divide" on privacy, said Shackelford, but he sees some convergence on cybersecurity, due in part to initiatives like the United Nations' norms for Responsible State Behavior in Cyberspace, and the National Institute for Standards and Technology's Cybersecurity Framework.

Cybersecurity laws within the U.S. often vary by state. However, in March 2022, President Biden signed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) into law. This federal legislation requires critical infrastructure companies to report cybersecurity incidents, including ransomware attacks, to the Cybersecurity and Infrastructure Security Agency (CISA). .... ' 

Internet Law and Moderation Transparency

 Happened on the Stanford Cyberlaw Center, and notably Transparency laws.  Here an excerpt, which leads to more  ...  Had not taken a look there for some time.   Note the mention and criticism of Facebook's rules.   Worth covering.

The Center for Internet and Society at Stanford Law School is a leader in the study of the law and policy around the Internet and other emerging technologies.

State abuse of Transparency Laws and How to Stop it  By Daphne Keller on September 19, 2022 at 3:49 pm

Around the world, new laws are requiring improved transparency from major Internet platforms about their content moderation. This is generally a very positive development. But it also raises important questions about what kinds of disclosures we expect from platforms -- and what kinds of enforcement we expect from governments. This post uses five concrete examples to illustrate the complexity of these disclosures. The examples also illustrate what I think is a very real risk: that state enforcers may abuse transparency laws, using them to reshape platforms’ actual policies. That is a threat not only to platforms’ editorial and speech rights, but to the rights of all their users. I think it should be possible to mitigate this risk. But we can only do so if we recognize it.  

I have written before about the complexity of counting content moderation actions for aggregate transparency reports. This post addresses the seemingly simpler task of describing speech policies or enforcement decisions. This is also complicated, in ways that should come as no surprise to lawyers, parents of young children, or anyone else who has tried to explain and apply rules to disputatious parties. The degree of detail that platforms could include in their explanations is vast -- perhaps not as infinite as the diversity of human misbehavior on the Internet, but the two are certainly correlated. Facebook’s rules, for example, run to over a hundred pages   , but are widely criticized as insufficiently clear or detailed.  ... '