FREEDOM ON THE NET 2024 The Struggle for Trust Online 4. SAFEGUARD PERSONAL DATA Comprehensive data-protection regulations and industry policies on data protection are essential for upholding privacy and other human rights online, but they require careful crafting to ensure that they do not contribute to internet fragmentation— the siloing of the global internet into nation-based segments—and cannot be used by governments to undermine privacy and other fundamental freedoms. Governments Democracies should collaborate to create interoperable privacy regimes that comprehensively safeguard user information, while also allowing data to flow across borders to and from jurisdictions with similar levels of protection. Individuals should be given control over their information, including the right to access it, delete it, and easily transfer it to providers of their choosing. Laws should include guardrails that limit the ways in which private companies can use personal data for AI development and in their AI systems, including algorithmic recommendations. Governments should ensure that independent regulators and oversight mechanisms have the ability, resources, and expertise to ensure foreign and domestic companies’ compliance with updated privacy, nondiscrimination, and consumer-protection laws. The US Congress should urgently pass a comprehensive federal law on data privacy that includes data minimization, the principle that personal information should only be collected and stored to the extent necessary for a specific purpose, and purpose limitation, the principle that personal data gathered for one purpose should not later be used for another. This is especially relevant for discussions around generative AI and other technologies that depend on harvesting information online without people’s consent. In the absence of congressional action, the US Federal Trade Commission (FTC) has been working to develop new regulations on commercial surveillance and data security. While an Advance Notice of Proposed Rulemaking was announced over two years ago, the process is still ongoing. The commission should continue to pursue enforcement of existing rules to hold companies accountable, and Congress should ensure that the FTC has sufficient resources to finalize and enforce meaningful new regulations related to data protection. Companies Companies should minimize the collection of personal information, such as health, biometric, and location data, and limit how third parties can access and use it. Companies should also clearly explain to people who use their services what data are being collected and for what purpose, including what information may be collected from user prompts to generative AI services. Finally, companies should ensure that people who use their services have control over their own information, including the right to access it, delete it, and prevent it from affecting an algorithm’s behavior. 5. PROTECT A FREE AND OPEN INTERNET A successful defense of the free, open, and interoperable internet will depend on international cooperation and a shared vision for global internet freedom. If democracies live up to their own values at home, they will serve as more credible advocates for internet freedom abroad. Governments Governments should ensure that digital diplomacy is coordinated among fellow democracies and promotes the protection of internationally recognized human rights. They should identify and utilize regional multilateral forums that are strategically placed 32 @freedomonthenet #FreedomOnTheNet