Three Models of Regulating the Network

In one line

There are three ways to regulate a network, and a country's choice between them explains almost everything else about its cyber law.

In the wording a student can write in an exam: legal systems regulate information networks on one of three models, namely the single comprehensive code in which one statute governs electronic transactions, offences and State powers together, as in India; the sectoral patchwork in which there is no general statute and particular harms are addressed by particular laws, as in the United States; and the sovereign-control model in which the network is treated as territory over which the State exercises the authority it exercises on the ground, as in China; with the European Union representing a fourth, rights-led variant in which regulation proceeds from a constitutionalised set of individual rights.

Model one: the single comprehensive code

One statute does everything. It gives legal effect to electronic records and signatures, creates the offences, confers the State's powers, and provides for a regulator and an appellate forum.

India is the clearest example. The Information Technology Act, 2000 contains Chapters II to V on recognition, Chapters VI to VIII on the trust infrastructure, Chapters IX to XI on penalties and offences, Chapter XII on intermediaries and, inside Chapter XI, the State powers in sections 69 to 70B. Chapter 120 maps it.

Its advantages. A single place to look. One set of definitions, so "computer resource" means the same thing in section 43 and section 69. And a legislature that can extend the statute as technology changes, which is what happened in 2008.

Its disadvantages, and chapter 170 states them. The statute's stated purposes describe less than half of what it now does. The offences chapter borrows its conduct from a civil compensation provision, which is what section 66 does with section 43. And a statute drafted for electronic data interchange between businesses has had social media, cloud computing and machine-generated content grafted onto it.

Other systems on this model include most of the countries that enacted the UNCITRAL Model Law and then added their own penal and regulatory chapters, which is a very large part of Asia and Africa.

Model two: the sectoral patchwork

No general statute; particular harms addressed by particular laws.

The United States is the example. There is no federal statute corresponding to the Information Technology Act. Instead: the Computer Fraud and Abuse Act for unauthorised access; the Electronic Communications Privacy Act for interception and stored communications; section 230 of the Communications Decency Act for platform liability; section 512 of the Copyright Act for copyright takedown; the Health Insurance Portability and Accountability Act for health data; the Gramm-Leach-Bliley Act for financial data; the Children's Online Privacy Protection Act for children; and, in the absence of a federal data protection law, State statutes such as the California Consumer Privacy Act. Chapters 620 to 650 work the ones this syllabus needs.