用戶被賦數據權，加州新法惹風波
洛杰峰（Jeff John Roberts）
2019-12-29
|
2020年，許多美國人將被賦予一項有力的工具，用于保護他們在網絡上的隱私。一項覆蓋廣泛的新法律將要求數百萬的企業，向消費者告知其所收集的用戶數據，并在用戶要求下刪除這些數據。 這條新法被稱為加州消費者隱私保護法案（CCPA），它將會打擊網絡經濟，因為如此多的公司——不論科技巨頭還是普通零售商——都依賴定向廣告。如果人們要求這些公司刪除他們的數據，那么廣告效果就差了。 拿沃爾瑪來說，在新法下，它的在線廣告不會像以往那樣包含個性化推送，因而它的銷售將會下滑。又比如谷歌，有可能損失一大塊營收，因為普通廣告與使用個人數據的定向廣告相比，收費要低得多。 加州新法正在被其他二十多個州復制，因此其效應將是巨大的。但前提是在新法于2020年1月1日生效后，人們要使用他們被賦予的新權利——這就要打個大大的問號，因為歐洲自2018年開始實施類似的隱私保護法，稱為通用數據保護條例（GDPR），但運用這一法律的人相對較少。 “這是件大事嗎？數千人、數十萬人或者數百萬人會拿起法律來用嗎？我們還不知道。” 咨詢企業德勤公司專注于企業風險的克里斯·梅說。 但對于受隱私保護法影響的企業來說，遵守法律的負擔卻是實實在在的。法律要求企業為消費者提供兩種詢問方式，比如在線表格和免費電話號碼，消費者籍此詢問數據和要求刪除個人數據。受加州司法部部長委托的一份超黨派報告指出，加州企業將為此新法支付額外的550億美元費用，包括法律咨詢和設計費，對每家企業來說是額外的55000美元至200萬美元。 由于CCPA是一項加州法律，在加州做生意的大多數公司都會受影響。而很少有企業會為此而撤離美國最大的市場。 |
In 2020, many Americans will get a powerful tool to protect their online privacy. A sweeping new law will require millions of businesses to tell consumers what data they have collected about them and, if asked, to delete it. The law, known as the California Consumer Privacy Act (CCPA), could play havoc with the online economy, since so many companies—from tech giants to ordinary retailers—rely on targeted ads. If people demand that companies delete their data, those ads would be less effective. Walmart, for example, could miss out on sales because its online ads wouldn’t be as personalized as before. Google, meanwhile, risks losing a big chunk of its revenue because generic ads command far lower prices than ones targeted using personal data. The effect of California’s law, which is being copied in nearly two dozen other states, could therefore be enormous. But that’s only if people assert their new rights after the law goes into effect on Jan. 1—which is a big “if” considering that relatively few have taken advantage of a similar privacy law in Europe, called GDPR, that was implemented in 2018. “Is this a big deal for thousands or hundreds of thousands or millions of people? We don’t know yet,” says Chris May, who focuses on corporate risk for consulting firm Deloitte. For businesses affected by the privacy rules, however, the burden of complying is very real. Requirements include giving consumers two ways, such as an online form and a toll-free number, to ask for their data and to demand that it be deleted. A nonpartisan report commissioned by California’s attorney general says the state’s businesses will have to spend an extra $55 billion for upfront costs, such as legal advice and engineering, or an extra $55,000 to $2 million for individual firms. While CCPA is a California law, most major companies do business in the state and, as a result, are impacted. Few of them can afford to pull out of the nation’s biggest market. |
|
少數企業為了表達遵法好意，表示會自愿在全美50個州都遵守這一法律，這其中包括微軟和一些小企業，比如位于波士頓的互聯網服務提供商Starry。Starry的首席執行官洽特·卡諾加說，到目前為止，只有少數客戶要求刪除他們的個人數據，倒是有數十人寫信稱能有這樣的選擇權，要向公司表示感謝。 其他一些人士，比如美國商會的高級副總裁蒂姆·戴，則對CCPA新法表示不那么樂觀。他警告說，新法將會使數以千計的小企業陷入困境，比如花店和酒廠。 加州新法豁免了大多數營業收入少于2500萬美元的公司，但對于擁有至少5萬人數據的公司——收集客戶信息比如電郵地址的企業，很容易達到這一門檻——則需要遵守新法。 “大企業有能力應對，但對于小企業來說，這是個極重的負擔，而小企業是國家經濟的支柱。”蒂姆·戴說。 德勤的克里斯·梅預測，到后來許多中小企業不會遵守新法，要么出于僥幸逃避受罰的盤算，或者遵法成本大過處罰金額。加州司法部負責從7月1日開始執行新法，給了新法生效6個月過渡期，克里斯·梅認為小型花店和酒廠不會成為主要的執法目標。司法部拒絕向《財富》雜志透露執法策略的細節。 “我們被賦予了執法責任，因而我們將有所作為，盡可能地讓消費者和企業都遵守法律要求。”加州司法部部長哈維·貝賽拉在一份電子郵件中說。 但這些還沒有最終算數，因為商會正在游說國會通過一項法律地位優先于CCPA的聯邦法律。此前科技企業也曾經試圖這么做，但失敗了，蒂姆·戴說商會的努力或許結果會不同，因為商會想要保存該法律的主要原則，即要求獲取和刪除個人數據的權利，同時商會又側重于豁免小企業的遵法義務。 在國會，很不尋常的是兩黨一致同意通過這樣一項法律，當然民主黨和共和黨在誰負責執行法律，以及該法律是否應該優先于州隱私保護法方面，是有爭議的。許多人認為在2020年美國總統大選前，不會制定新的法律，但布魯金斯學會的隱私保護專家卡梅倫·克里則相信，美國對于隱私保護的態度已經發生了劇烈的變化，總統大選前出臺新法是有可能的。 克里說，“有這么一種轉變，更多的國會成員花費更多時間在網絡上，并擔心數據隱私的復雜性，會牽涉到他們的孩子和孫輩。” （財富中文網） 本文另一版本登載于《財富》雜志2020年1月刊，標題為《加州隱私新法惹風波》。 譯者：宣峰 |
To create goodwill, a handful of big companies, like Microsoft, and small ones, including Boston-based Internet service provider Starry, have said they would voluntarily comply with the new law in all 50 states. So far, Starry CEO Chet Kanojia says, only a handful of customers have asked for their data to be deleted, while several dozen more have written to thank the company for giving them the option to do so. Others, like Tim Day, a senior vice president at the U.S. Chamber of Commerce, are less sanguine about CCPA. He warns that the law will ensnare thousands of smaller enterprises, such as florists and wineries. California’s law exempts most firms with less than $25 million in sales. But companies that have data for at least 50,000 people—a threshold that’s easily reached for businesses that collect customer email addresses, for instance—are subject to new rules. “Large businesses have the capacity to figure this out, but it’s an extreme burden for small ones, which are the backbone of this nation’s economy,” says Day. As a result, Deloitte’s May predicts that many small and midsize companies may not comply with the law, calculating that they won’t be punished or that any penalty will be cheaper than jumping through CCPA’s hoops. California’s Justice Department is tasked with enforcing the law, starting July 1, following a six-month grace period, and May suggests it’s unlikely that small florists and wineries will be top targets. The agency declined to provide details about its enforcement strategy to Fortune. “We were given the responsibility to enforce, and so that’s what we’re going to do, working as much as we can with consumers and businesses to make sure they’re complying with the law,” California Attorney General Xavier Becerra says in an email. This may not be the final word, however, because the Chamber of Commerce is lobbying Congress to pass a federal law to preempt CCPA. An earlier attempt by the tech industry fell short, but Day says the Chamber’s push is different in that the organization wants to preserve the law’s broad principles, notably the right to demand and delete most personal data, while doing more to spare smaller businesses. In Congress, there has been unusual bipartisan agreement to pass such a law, although Democrats and Republicans disagree about who should enforce it and whether it should preempt state privacy laws. While many think new legislation is unlikely until after the 2020 presidential election, Cameron Kerry, a privacy expert at the Brookings Institution, believes U.S. attitudes about privacy have changed so dramatically that a law may pass before then. Says Kerry: “There’s been a shift as more members of Congress spend more time online and worry about the implications of data privacy for their children and grandchildren.” A version of this article appears in the January 2020 issue of Fortune with the headline “California Sets Off Privacy Scramble.” |
