FREEDOM ON THE NET 2021 The Global Drive to Control Big Tech BEST AND WORST PRACTICES FOR TECH REGULATION Some new laws are designed to bolster human rights. Others feature provisions that can be exploited to subdue free expression and increase surveillance. BEST WORST Transparency on content moderation, data use, and advertising practices Requirements to remove political, social, or religious content Robust encryption and privacy standards Obligations to hand over data without judicial oversight Due process safeguards and avenues for appeal Broad rules on data localization and retention Mandates for automated content moderation Strong protections against intermediary liability Obligations tailored to match companies’ type and size Information Protection Law, which draws on the EU’s GDPR framework, is the country’s first comprehensive attempt at limiting how companies collect, store, and use personal data. A regulation introduced in March 2021 limited the types of data that apps can require from users. Regulators subsequently alleged that over 100 apps—including those from Chinese tech giants Tencent and Baidu—violated the rules. In July, authorities asserted that the ride-hailing app Didi illegally collected users’ personal information. Didi was pulled from China-based app stores, and a scheduled initial public offering on a US stock exchange was canceled. Authorities also passed a Data Security Law this year that requires Chinese companies to obtain approval from the state prior to sharing data with a foreign judicial or law enforcement entity. At the same time, China is home to the world’s largest surveillance state. Under its Cybersecurity Law, implemented 18 @freedomonthenet Onerous requirements for registration and in-country representatives in 2017, companies must store users’ data on local servers and decrypt the data on request from the authorities. Vague laws enable state agencies to monitor the population for an expansive list of activities and ideas that are deemed harmful by the one-party regime. In practice, this includes political, social, and religious expression, independent reporting, and the online activities of marginalized groups, for which users can face draconian criminal penalties. Protecting users’ data Some new data protection laws introduced during the coverage period established meaningful constraints and oversight on how private companies access, store, and use personal information, without further empowering the state to monitor its citizens. In Ecuador, nearly two years after a sprawling data breach revealed over 20 million people’s #FreedomOnTheNet