Lei Gangzhen from Aofei Temple
Quantum Bit Report | Public Account QbitAI

The CEO should go to jail for leaking private data.

I just want to ask you whether you support it or not?

Today, this US senator's proposal has caused a stir in public opinion, and many netizens have gathered on Hacker News to discuss it.

Some support severe punishment to deal with the chaos of privacy data leakage, while others believe that similar plans are difficult to set standards and cannot be implemented. Some even believe that it is useless for large companies - they have strong legal teams - so it will only restrict innovation of small and medium-sized startups.

However, since there are such voices, we might as well watch and see "Should the CEO go to jail if privacy data is leaked?"

New proposal by U.S. senators

The incident originated from a new proposal by US Senator Ron Lee Wyden.

The Democratic congressman believes that the leakage of private data is a crisis of survival.

In the past three years, you may have been a victim of a Yahoo email account leak; or an innocent victim of a Facebook privacy data leak; or even unknowingly, your private data was tracked, sold, and leaked, and then used for profit.

However, in every case, only the victims and those who bear the responsibility are left in the end.

Apart from individual companies facing class action lawsuits, the actual controllers and senior executives represented by the CEO of those companies have not learned any lesson at all.

It's time to use legal weapons to make them respect their privacy data.

How to be in awe?

Fines. Jail.

In Senator Wyden's new proposal, if the company you work for secretly collects private data, leaks private data (whether intentionally or unintentionally), buys and sells private data, or even conceals and lies about the leak, the company will be severely punished.

For example, a fine of 4% of annual revenue may be imposed, and core executives such as CEOs may face up to 20 years in prison.

I won’t say much about jail time.

What does 4% mean?

According to Facebook's 2017 annual report data, 4% of revenue is approximately US$1.6 billion (RMB 10.8 billion).

Quite heavy indeed.

Moreover, the specific terms are clearly listed in this 38-page bill proposal.

We briefly summarize the core terms as follows:

• Establish a "Do Not Track" option for people using online services, allowing their search history, social media collections and online behavior not to be sold to advertisers. Users can pay to have their privacy protected.

• Authorize relevant departments to develop privacy and cybersecurity standards, and require large companies to disclose their privacy systems and circumstances annually.

• Penalize companies that falsify information in their annual privacy reports with fines of 4% of annual revenue and up to 20 years in prison for CEOs.

• Require companies to assess their algorithms for accuracy, fairness, and discrimination.

Congressman Wyden said this is to implement Internet privacy data regulation in the same way as financial company regulation.

The United States has had a similar regulatory program for large financial companies since 2002, and it has worked very well.

Now, it's time to bring such solutions to Internet technology companies.

In fact, Congressman Wyden’s plan had been “publicized” before, but the specific implementation effect was not good, and there was a polarized situation at the level of large companies.

They actively support companies like Apple and Intel that do not rely on Internet advertising revenue.

But for giants like Google and Facebook, whose entire fortune depends on advertising revenue, the company has always "refused to comment."

Wouldn’t it be tantamount to killing Google and Facebook if personal privacy data were used strictly?

Support or not support

Although such bills are mainly aimed at large companies, if you ask netizens whether it is justified or not?

They don't all agree.

On Haceker News, there are generally three views.

First, the majority of people are on the fence, believing that the bill is too utopian, that the idea is beautiful but difficult to implement in reality.

First, the standards for privacy data:

Can personal information really be calculated as property? If so, then if I ask someone on the street for his name, phone number and location, does that count as "recording his data" - and controlling his property? If I use his "property" for commercial purposes, will I also face criminal penalties under the law?

Privacy data standards are difficult to identify in advance.

Some netizens also commented that the law can be enforced after the fact.

If the concepts and boundaries cannot be fully clarified beforehand, or if they are clarified but there are still a lot of gray and marginal areas, can we use the ex post legal method? However, there are still challenges in standards.

Especially as AI becomes popular, it is difficult to explain how some data are used.

Second, supportive netizens believe that it is the lack of strict laws that allows companies like Facebook to "actively" make the world a worse place.

So taking a step like this now - huge fines and jail time for executives - may ease the current situation.

However, such voices were quickly refuted by the opposition .

There are two core viewpoints:

First of all, even if there is a bill, it cannot solve the core problem.

Since the privacy data bill is aimed at large companies, the luxurious legal teams of giants like Facebook and Google will certainly not sit idly by. They will definitely find reasonable and legal ways after the law is implemented. In the end, the only ones who will be unable to move forward will be small and medium-sized startups that have no legal power.

And this argument is not alarmist. In the financial industry, relevant regulatory bills were introduced after the 2008 subprime mortgage crisis, but in the end they further consolidated the position of large banks, making it even more difficult for small and medium-sized banks to move forward.

In addition, after the implementation of the European GDPR, there are specific data showing that although it has weakened many advertising tracking companies, large companies like Google are not affected - isn't this just forgetting why they started?

Secondly, once private data becomes “scarce”, it will become a black market asset.

Some netizens gave an example, according to the logic that privacy data should be protected as property, supply and demand determine the market, severe laws and regulations can make the open market cautious, but will also make black market transactions more prevalent.

Highly recommended

Of course, amid the heated discussion, there are also many highly praised and executable suggestions:

• 1) There should be reminders to keep users informed.

  Users know that their private data has been "tracked" and can choose "yes" or "no".

• 2) Be sure to obtain consent when sharing with third parties.

  As long as user privacy is shared with a third party, users should be allowed to decide whether to agree or not.

  Netizens said they had no objection to an app keeping records of their interaction information, and that it might even be helpful for convenience, but they were disgusted by the data being shared with other third parties.

• 3) The cost of non-compliance can be considered.

  The cost of violations can be set in advance, and once a company violates the rules, it will pay a corresponding price. This will ensure that these companies that hold private data are not only subject to self-moral constraints, but also to constraints through market economic behavior.

• 4) Credit mechanism.

  If some companies already have a bad record of data leaks, we will limit their privacy data collection through one year of credit monitoring to raise their awareness.

Finally, the unanswered question: Should CEOs and other senior executives go to jail?

Netizens who support the imprisonment said that the CEO should be imprisoned, otherwise he would not pay attention to privacy data.

Netizens who are against jailing believe that the company is big and the CEO may not know every business. It is not fair to restrict the personal freedom of the CEO. In addition, there are some companies whose CEOs are just puppets.

Cast a vote

However, the above discussion all comes from the other side of the Pacific Ocean.

The national conditions are also different.

But I believe that Global also attaches great importance to privacy data .

So I wonder what you, who just celebrated the Spring Festival and participated in various interactions involving authorized personal information, think about the issue of privacy data?

Vote and let others know the attitude on this side of the Pacific.