Zoning Data Flows

This article explores how China is developing a unique location-based data outbound deregulation regime to mitigate the negative effects of its initial security-driven regulations. A major move is repurposing free trade zones with data outbound negative lists. Using an infrastructural-thinking framework, this article examines the evolution of data outbound regulation in China, recent initiatives in the country's free trade zones, and the dynamics between local and central governments. China's data outbound practices are enabled and constrained by its global information and telecommunication (ICT) infrastructural connectivity and domestic distribution. Free trade zones become appealing deregulation testing grounds due to their overlap with critical ICT hub locations and their role as sites for policy experimentation. The ongoing pilot projects, through the interplay of law and infrastructure, present promising potential to channel China's data outbound activities into specific areas, thereby increasing their visibility, making them more amenable to regulation, and fostering both local and national economies.

Published in Tsinghua China Law Review Vol. 16 No. 2 (2024), pp. 191-223. This paper draws insights from Guarini Global Law & Tech’s Global Data Law Project and Institute for International Law and Justice’s Infrastructure as Regulation Project.

China's Interim Measures for the Management of Generative AI Services

On August 15, 2023, the Interim Measures for the Management of Generative AI Services (Measures) – China’s first binding regulation on generative AI – came into force. The Interim Measures were jointly issued by the Cyberspace Administration of China (CAC), along with six other agencies, on July 10, 2023, following a public consultation on an earlier draft of the Measures that concluded in May 2023. 

This blog post is a follow-up to an earlier guest blog post, “Unveiling China’s Generative AI Regulation” published by the Future of Privacy Forum (FPF) on June 23, 2023, that analyzed the earlier draft of the Measures. This post compares the final version of the regulation with the earlier draft version and highlights key provisions.

Notable changes in the final version of the Measures include:

• A shift in institutional dynamics, with the CAC playing a less prominent role;

• Clarification of the Measures’ applicability and scope;

• Introduction of responsibilities for users;

• Introduction of additional responsibilities for providers, such as taking effective measures to improve the quality of training data, signing service agreements with registered users, and promptly addressing illegal content;

• Assignment of responsibilities to government agencies to strengthen the management of generative AI services; and

• Introduction of a transparency requirement for generative AI services, in addition to the existing responsibilities for providers to increase the accuracy and reliability of generated content.

Published by the Future of Privacy Forum blog. The blog post builds on insights developed in the context of Guarini Global Law & Tech’s conference on “how (not) to regulate generative AI”.

Unveiling China’s Generative AI Regulation

The Cyberspace Administration of China (CAC) released Draft Measures for the Management of Generative AI Services (the “Draft Measures”) on April 11, 2023. The comment period closed on May 10, 2023. Public statements by industry participants and legal experts provided insight into the likely content of their comments. It is now the turn of the CAC as China’s “cyber super-regulator” to consider these comments and likely produce a revised text.

This blog post analyzes the provisions and implications of the Draft Measures. It covers the Draft Measures’ scope of application, how they apply to the development and deployment lifecycle of generative AI systems, and how they deal with the ability of generative AI systems to “hallucinate” (that is, produce inaccurate or baseless output). It also highlights potential developments and contextual points about the Draft Measures that industry and observers should pay attention to.

Published by the Future of Privacy Forum blog. The blog post builds on insights developed in the context of Guarini Global Law & Tech’s conference on “how (not) to regulate generative AI”.

Infrastructural Control Does the Trick: Apple’s Privacy Battles with Facebook and Tencent

Jingxian Zeng presents a comparison of Apple’s battles with Facebook and Tencent over advertising data tracking to argue that current notions of privacy law rest on the misconception that the power of digital platforms is derived from their control over data, rather than their control over the infrastructure that collects and processes data. The article targets the assumption behind the mobilization of data protection and privacy to contest platform power: the enormous power of platforms derives from their control over data such that granting individuals rights to their own data is enough to contest platform power. This approach ignores a fundamental source of platform power—control over the digital infrastructure that enables the collection and processing of data. Failing to account for this aspect of platform power runs the risk that data protection and privacy will be mobilized by platforms to safeguard their “walled gardens,” thus running against the “public” expectation of empowering individuals vis-à-vis platforms. The differing implementation of Apple’s privacy-preserving policy in the U.S. and China, through Facebook and Tencent respectively, offers a vivid illustration of the significance of infrastructural control.

This paper was published by the NYU Journal of Legislation & Public Policy. It originated in the Guarini Colloquium: Regulating Global Digital Corporations convened by Thomas Streinz and Joseph Weiler in Fall 2022.