Photo of Diana Lee

Diana Lee

Diana Lee is an associate in the technology regulatory group. She counsels clients on a range of regulatory and litigation matters involving electronic surveillance, government demands for data, national security, and data privacy and cybersecurity issues, with a particular focus on cross-border and multi-jurisdictional concerns.

Before rejoining the firm, Diana clerked for the Honorable Victor A. Bolden on the U.S. District Court for the District of Connecticut.

Diana is a member of the Bars of New York and the District of Columbia.

Contact:Read more about Diana LeeEmail

Governor Gavin Newsom of California signed over 20 AI-related bills into law in the final days of September. Several of these bills address topics such as frontier model and generative AI oversight, AI transparency, and new requirements for use of AI in particular industries, described below. In addition to these bills, Governor Newsom also signed into law a sweeping set of AI bills relating to minors’ safety and privacy, which are described in our prior blog post, and novel frameworks related to the use of ADMT in the workplace, which we previously summarized here.

These newly passed laws include the following:

Continue Reading California Governor Signs Over 20 AI-related Bills into Law

On April 28, the House of Representatives voted 409-2 to pass the Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (“TAKE IT DOWN Act”), which criminalizes the publication of nonconsensual intimate visual depictions (“NCII”), and requires online platforms to establish a notice and takedown process for NCII.  The Act…

Continue Reading U.S. Congress Passes Bill Establishing Notice and Takedown Regime for Publication of Nonconsensual Intimate Visual Depictions

On Tuesday, March 11, 2025, in the first Senate Judiciary subcommittee hearing of the 119th Congress, the Senate Subcommittee on Crime and Counterterrorism held a hearing entitled “Ending the Scourge: The Need for the STOP CSAM Act.”  Subcommittee Chair Senator Josh Hawley (R-MO), who convened the hearing, and Ranking Member Dick Durbin (D-IL) announced in February that they intended to reintroduce the Strengthening Transparency and Obligations to Protect Children Suffering from Abuse and Mistreatment Act or “STOP CSAM Act”, a comprehensive bill that seeks to combat the online sexual exploitation of children.  First introduced in 2023, the Act did not receive a vote on the Senate floor last Congress, despite being unanimously advanced by the Senate Judiciary Committee. 

The STOP CSAM Act, as written in 2023, contains multiple provisions that would impose new requirements on online platforms.  The Act would:

  • Remove Section 230 immunity for civil claims against online platforms for CSAM-related harms;
  • Create a private right of action for victims to file civil lawsuits against online platforms that fail to timely remove CSAM material;
  • Create a Child Online Protection Board at the Federal Trade Commission that would be responsible for enforcing the removal of CSAM material and related images and authorized to fine platforms that fail to comply;
  • Remove technology companies’ discretion as to whether to report planned or imminent child sexual exploitation offenses of which the provider has actual knowledge;
  • Require that online platforms include certain additional information in NCMEC CyberTipline reports; and
  • Mandate that certain online platforms issue annual transparency reports related to child protection efforts.
Continue Reading Senate Judiciary Subcommittee Holds Hearing on the STOP CSAM Act

The U.S. Supreme Court is expected to issue opinions in the coming months in two highly-anticipated cases — Moody v. NetChoice, L.L.C. (11th Cir.) and NetChoice, L.L.C. v. Paxton (5th Cir.) — that could potentially have significant implications for how companies moderate content on their platforms.

Continue Reading U.S. Supreme Court Expected to Rule on NetChoice Cases in the Coming Months

On July 10, 2023, the European Commission adopted its adequacy decision on the EU-U.S. Data Privacy Framework (“DPF”). The decision, which took effect on the day of its adoption, concludes that the United States ensures an adequate level of protection for personal data transferred from the EEA to companies certified to the DPF. This blog summarizes the key findings of the decision, what organizations wishing to certify to the DPF need to do and the process for certifying, as well as the impact on other transfer mechanisms such as the standard contractual clauses (“SCCs”), and on transfers from the UK and Switzerland.

Continue Reading European Commission Adopts Adequacy Decision on the EU-U.S. Data Privacy Framework