[Economist] 他们掌握了什么？（上）

What do they know?

他们掌握了什么？

The EU guarantees its citizens’ data rights, in theory
欧盟保证其区域内公民的数据隐私权，理论上而言

IN THE wake of the scandal over the unauthorised use of Facebook data by Cambridge Analytica, a campaign consultant, some Americans are looking enviously at the European Union, whose privacy laws are the global gold standard. Rights over personal data are enshrined in the EU’s Charter of Fundamental Rights. European citizens have the right to have their data processed fairly, to know what data an organisation holds about them and what it is doing with those data. The General Data Protection Regulation (GDPR), a law strengthening data protection across the EU, goes into force at the end of May (see Business section). Yet in practice, when European citizens try to exercise such rights, they tend to end up mired in bureaucracy.

在脸书将其用户数据提供给一家竞选分析机构也即剑桥分析，从而导致愈演愈烈的丑闻中，许多美国人开始羡慕于欧盟地区拥有世界顶尖的隐私保护法律。公民对其个人信息所拥有的权利已经被欧盟认可为神圣不可侵犯的基础性权利。欧盟地区的公民有权让其个人数据合理的被使用，以及获知其个人数据的保有者，并有权知晓这些数据被如何使用。一部用于增强欧盟地区数据保护的法律，也即一般数据保护法案（GDPR），将于五月底开始生效。然而在实践中，当欧盟公民去行使这些权利的时候，却会因官僚主义而陷入泥潭。

Take the case of Paul-Olivier Dehaye. In December 2016 Mr Dehaye, a Belgian mathematician, e-mailed Facebook asking for a copy of the data it had gathered about him through an advertising tool called Pixel. Organisations based in the EU or which process data of EU residents are required to answer questions like this, known as subject-access requests. Yet it took106 days for Facebook to do so. The firm acknowledged the existence of Mr Dehaye’s Pixel data, but declined to provide them, stating that doing so would involve “disproportionate effort”. The data were buried too deep inside Facebook’s data-analytics ware house, known as Hive. When Mr Dehaye appealed to the Irish Data Protection Commissioner (DPC),which regulates Facebook’s data processing in Europe, he entered a similar maze of e-mails. The DPC is still assessing the case.

以 Paul-Olivier Dehaye 的案件为例。在 2016 年十二月，一位比利时数学家 Dehaye 先生通过邮件告知脸书公司，希望该公司能提供一个名为 Pixel 的广告工具所收集的 Dehaye 先生个人数据的副本。注册在欧盟地区或者在欧盟地区处理相关数据的组织机构有义务来回复这些问题，这被称为数据主体查阅请求。然而脸书公司的回复却花了 106 天。脸书承认 Pixel 工具确实存有 Dehaye 先生的个人数据，但却拒绝提供这些数据，因为这么做将会导致”不相称的成本开支“。这些数据被深藏在脸书一个被称为蜂巢的数据分析仓库。当 Dehaye 先生申诉于规制脸书在欧盟地区数据处理的爱尔兰数据保护委员会（DPC）时，同样遇见了无尽的邮件往来。DPC 目前人在评估这一案件。