法律翻译 | 《哥大商法评论》第2019卷第2期目录+摘要

译者 | 徐可心，华东政法大学LL.B.

审稿 | 一审：曾梓栩，外交学院法本

          二审：郑晨焕，WUSTL LL.M.

编辑 | 陈远航，美国西北大学LL.M.

责编 | 陈逸漩 中国人民大学法本

A Regulatory Classification of Digital Assets 

Toward an Operational Howey Test for Cryptocurrencies, ICOs, and Other Digital Assets

数字资产的监管分类

对加密货币、ICO 和其他数字资产进行操作豪威测试

作者：M. Todd Henderson

Max Raskin

Digital assets are hot right now. Whether cryptocurrencies, like bitcoin, or initial coin offerings and tokens, this new asset class has captured the imagination of American investors. While it remains to be seen if this phenomenon has staying power, there is no doubt that these assets and their promoters have attracted the attention of the Securities and Exchange Commission. But neither Congress nor the SEC has formally elucidated which digital assets are securities and which are not.

数字资产是当今热点话题。无论是比特币等加密货币，还是首次代币发行和代币，这些不同类别的新型资产都在吸引美国的投资者。虽然这种热度是否还会延续仍待考察，但毫无疑问的是，这些新型资产及其发起人已经引起了美国证券交易委员会的注意。然而，美国国会和美国证券交易委员会都没有对此正式释明哪些数字资产属于证券。

This Article seeks to provide clarity in determining which digital assets are securities. It proposes two tests that operationalize the Supreme Court's test in SEC v. W. J. Howey Co. The first test is the Bahamas Test, which asks whether a digital asset is sufficiently decentralized such that it is not a security. The second test is the Substantial Steps Test which is used to determine whether an investment is made with an expectation of profit. This Article takes a rules-based approach to provide clarity and begin a conversation about crafting more predictable jurisprudence and regulation in this area.

本文旨在界定数字资产中属于证券的范围，并提出了两个测试来实施最高法院在 SEC v. W. J. Howey Co. 案中的测试。第一个测试是巴哈马测试，该测试验证数字资产是否足够去中心化从而证明它不属于证券。第二个测试是实质性步骤测试，该测试用于确定数字资产的投资是否是基于获利预期的目的。本文采用基于规则的方法来提供清晰度，并开始讨论在该领域制定更具可预测性的判例和法规。

A Right to Reasonable Inferences 

Re-Thinking Data Protection Law in the Age of Big Data and AI

合理推论的权利

大数据和人工智能时代的数据保护法的重思

作者：Sandra Wachter

Brent Mittelstadt

Big Data analytics and artificial intelligence (AI) draw non-intuitive and unverifiable inferences and predictions about the behaviors, preferences, and private lives of individuals. These inferences draw on highly diverse and feature-rich data of unpredictable value, and create new opportunities for discriminatory, biased, and invasive decision-making. Data protection law is meant to protect people’s privacy, identity, reputation, and autonomy, but is currently failing to protect data subjects from the novel risks of inferential analytics. The legal status of inferences is heavily disputed in legal scholarship, and marked by inconsistencies and contradictions within and between the views of the Article 29 Working Party and the European Court of Justice (ECJ).

大数据分析和人工智能（AI）对个人的行为、偏好与隐私进行了非直观和无法验证的推论和预测。这些推论利用了高度多样化、功能丰富且不可预测价值的数据，并为具有歧视性、偏见和侵入性的决策进一步创造了条件。数据保护法旨在保护人们的隐私、身份、声誉和自主权，但目前数据保护法未能保护数据主体免受推理分析的新风险。大数据与AI的推论的法律地位在法律学术界存在严重争议，争议体现在《通用数据保护条例》（GDPR）第29条工作组和欧洲法院（ECJ）的观点内部和之间的不一致和矛盾。

This Article shows that individuals are granted little control or oversight over how their personal data is used to draw inferences about them. Compared to other types of personal data, inferences are effectively “economy class” personal data in the General Data Protection Regulation (GDPR). Data subjects’ rights to know about (Articles 13–15), rectify (Article 16), delete (Article 17), object to (Article 21), or port (Article 20) personal data are significantly curtailed for inferences. The GDPR also provides insufficient protection against sensitive inferences (Article 9) or remedies to challenge inferences or important decisions based on them (Article 22(3)).

本文通过呈现个人如何使用其个人数据，可以推断出其情况几乎无法控制或监督。与其他类型的个人数据相比，推论实际上是《通用数据保护条例》（GDPR）中的“经济级”个人数据。数据主体的知情权（第13-15条）、更正权（第16条）、删除权（第17条）、反对权（第21条）或移植权（第20条）因推断而受到严重限制。GDPR还不足以防止敏感推论（第9条）或质疑基于这些推论或重要决定的补救措施（第22（3）条）。

This situation is not accidental. In standing jurisprudence the ECJ has consistently restricted the remit of data protection law to assessing the legitimacy of input personal data undergoing processing, and to rectify, block, or erase it. Critically, the ECJ has likewise made clear that data protection law is not intended to ensure the accuracy of decisions and decision-making processes involving personal data, or to make these processes fully transparent. Current policy proposals addressing privacy protection (the ePrivacy Regulation and the EU Digital Content Directive) and Europe’s new Copyright Directive and Trade Secrets Directive also fail to close the GDPR’s accountability gaps concerning inferences.

这种情况并非偶然。在长期有效的判例中，欧洲法院一直将数据保护法的职权范围限制在评估已收集的个人数据处理的合法性，并对其进行纠正、阻止或删除。至关重要的是，欧洲法院同样明确表示，数据保护法并非旨在确保涉及个人数据的决策及其过程的准确性，或确保这些过程完全透明。目前关于隐私保护的政策提案（电子隐私条例和欧盟数字内容指令）以及欧洲新的版权指令和商业秘密指令也未能弥合GDPR在推论方面的职责失位。

This Article argues that a new data protection right, the “right to reasonable inferences,” is needed to help close the accountability gap currently posed by “high risk inferences,” meaning inferences drawn from Big Data analytics that damage privacy or reputation, or have low verifiability in the sense of being predictive or opinion-based while being used in important decisions. This right would require ex-ante justification to be given by the data controller to establish whether an inference is reasonable. This disclosure would address (1) why certain data form a normatively acceptable basis from which to draw inferences; (2) why these inferences are relevant and normatively acceptable for the chosen processing purpose or type of automated decision; and (3) whether the data and methods used to draw the inferences are accurate and statistically reliable. The ex-ante justification is bolstered by an additional ex-post mechanism enabling unreasonable inferences to be challenged.

本文认为，需要一种新的数据保护权利，即“合理推论权”，来帮助缩小目前由大数据或人工智能的“高风险推论”造成的责任差距。换而言之，是从大数据分析中得出损害隐私或声誉的推论，或者在用于重要决策时具有低可验证性或基于意见的可验证性。这项权利要求数据控制者事先给出理由，以确定这些推断是否合理。这项权利的披露将解决以下问题：（1）为什么某些数据构成了规范上可接受的基础，可以从中得出推论;（2）为什么这些推论与所选的处理目的或自动决策类型相关，且在规范上是可接受的;（3）用于推论的数据和方法是否准确，统计上是否可靠。事前理由得到另一个事后机制的支持，该机制使不合理的推论能够受到质疑。

This Article examines how contract drafters can use data on contract outcomes to inform contract design. Building on recent developments in contract data collection and analysis, the Article proposes “predictive contracting,” a new method of contracting in which contract drafters can design contracts using a technology system that helps predict the connections between contract terms and outcomes. Predictive contracting will be powered by machine learning and draw on contract data obtained from integrated contract management systems, natural language processing, and computable contracts. The Article makes both theoretical and practical contributions to the contracts literature. On a theoretical level, predictive contracting can lead to greater customization, increased innovation, more complete contract design, more effective balancing of front-end and back-end costs, better risk assessment and allocation, and more accurate term pricing for negotiation. On a practical level, predictive contracting has the potential to significantly alter the role of transactional lawyers by providing them with access to previously unavailable information on the statistical connections between contract terms and outcomes. In addition to these theoretical and practical contributions, the Article also anticipates and addresses limitations and risks of predictive contracting, including technical constraints, concerns regarding data privacy and confidentiality, the regulation of the unauthorized practice of law and the potential for exacerbating information inequality.

本文探讨了合同起草者如何使用合同结果数据来为草拟合同提供帮助。基于合同数据收集和分析的最新发展，本文提出了“预测合同”，这是一种新的草拟合同方法：合同起草者可以使用一种技术系统来设计合同，该技术系统有助于预测合同条款和结果之间的联系。预测性合同将由机器学习提供支持，并利用从集成合同管理系统、自然语言处理和可计算合同中获得的合同数据。本文对合同文献做出了理论和实践的贡献。在理论层面上，预测性合同可以带来诸多优势：更大范围的定制化、更多的创新、更完整的合同设计、更有效地平衡前后端成本、更好的风险评估和分配以及更准确的谈判期限价款。在实践层面上，预测合同有可能为交易律师提供访问以前无法获得的合同条款与结果之间统计和联系，从而显著改变交易律师的角色。除理论和实践层面的分析之外，本文还预测并提供解决预测合同的局限性和风险的建议，包括技术限制、对数据隐私和机密性的担忧、对未经授权的法律实践的监管以及加剧信息不平等的可能性。

作者：Maddalena DeSimone

The Fourth Amendment protects against unreasonable searches and seizures. At the United States border, however, sovereignty interests—namely who and what enters the country—allow for warrantless searches of property without probable cause. This Note explores the reach of the border exception to one category of property: electronic devices. At present, circuit courts disagree over what level of suspicion—no suspicion or reasonable suspicion—applies to forensic searches of electronics. Courts do agree that manual searches, performed without the assistance of external equipment, merit no suspicion at all. The suspicion gap between manual and forensic searches reflects an assumption that all manual searches are cursory and hence violate a device owner’s privacy less than a forensic search.

第四修正案可以防止不合理的搜查和扣押。然而，在美国边境，主权利益——即“谁”和“什么”进入该国——允许在无正当理由下对财产进行无证搜查。本文探讨了边界例外对电子设备的影响。目前，巡回法院对如何认定怀疑的程度（无怀疑或合理怀疑）适用于电子产品的司法鉴定存在分歧。法院确实同意，在没有外部设备协助的情况下进行的人工搜查根本不值得怀疑。手动搜索和取证搜索之间的怀疑差距反映出一种假设，这一假设为所有手动搜索都无比仓促，因此手动搜索的过程比取证搜索更严重地侵犯了设备所有者的隐私。

This Note argues that the existing line between forensic and manual searches should be reimagined; instead, electronic devices, such as smartphones, should be separated out from other electronic devices, such as cameras, and be subject to a reasonable suspicion standard irrespective of the nature of the search, forensic or manual. Redrawing the line between devices themselves recognizes that certain electronics (e.g. cameras) are more analogous to traditional luggage and therefore should receive the same treatment at the border where suspicionless searches are permitted. Like luggage, one can curate these devices: it is possible to know and choose what is inside. As the attenuation of the link between the device in question and traditional luggage expands, so too should the suspicion required. Smartphones and like devices should not be searched without reasonable suspicion. Finally, this Note concludes by recommending that the Customs and Border Protection directive, subject to review and modification every three years, be revised to distinguish between the two groups of electronic devices and account for the privacy concerns unique to the smartphone and related devices group.

本文认为，司法鉴定和人工搜索之间的现有界线应当被重构；相反，智能手机等电子设备应与相机等其他电子设备分开，并且无论搜索、取证或手动搜索的性质如何界定，都应遵守合理怀疑的标准。重新划定设备本身之间的界限可以使某些电子产品（例如相机）的搜查过程与传统的行李箱相似，因此在无嫌疑搜查的过程中，电子产品应该得到同样的待遇。就像行李一样，人们可以管理这些设备：了解或选择里面的东西是可行的。随着相关设备与传统行李箱之间联系减弱，所需的怀疑也应相应减弱。在没有合理怀疑的情况下，不应搜查智能手机和类似设备。最后，本说明最后建议对每三年审查和修改一次的海关和边境保护指令进行修订，以区分这两组电子设备，从而解决智能手机和相关设备组特有的隐私问题。

How to Protect Consumer Data? Leave it to the Consumer Protection Agency 

FTC Rulemaking as a Path to Federal Cybersecurity Regulation

如何保护消费者数据？留给消费者保护局

FTC规则制定作为联邦网络安全监管的途径

作者：Hayes Hagan

In the wake of cases challenging the scope of the Federal Trade Commission’s authority and its role in regulating cybersecurity, this Note considers the centrality of the FTC as a protector of consumer data. It broadly examines the current state of cybersecurity regulation and the need for a uniform national regime to protect consumer data. In considering different methods for realizing such federal oversight, this Note examines legislative and administrative options. Tracing the development of both highlights their shortcomings and reveals a potential solution. In the face of concerning legislative movement and uncertainty surrounding the FTC’s current enforcement philosophy, this Note endorses the employment of the FTC’s rarely used, but highly effective, rulemaking authority as a tool to complement and enhance its adjudicative enforcement.

在一系列质疑联邦贸易委员会的权力范围及其在监管网络安全方面的作用的案件之后，本文考量联邦贸易委员会作为消费者数据保护者的中心地位，并广泛研究了网络安全监管的现状以及建立统一的全国性制度来保护消费者数据的必要性。在关注实现联邦监督的不同方法时，本文审视了立法和行政两种选择。通过追踪两者的发展并突出它们的缺点，从而在本文揭示出一个潜在的解决方案。本文围绕对联邦贸易委员会当前执法理念的立法动向和不确定性，并且最后赞同了使用规则制定机构，尽管联邦贸易委员会很少使用该机构，但其运行但十分高效，从而作为补充和加强其裁决执行的工具。

作者：Jonathan Trebble-Greening

In the current framework of human rights, data privacy is finding its home as an independent human right, separate from its historical home under the umbrella of general privacy. However, there is no consistent system or standard for defining this right, and different regions require substantially different levels of protection. This inconsistency has allowed for corporations, by way of their executive officers, to avoid or completely ignore the requirements imposed by many countries. Moreover, the penalties in many regions are not severe enough to incentivize corporations to change their behavior. The lack of a truly global system and standard for enforcing this right, and the specific lack of pressure on the officers that direct corporate policy, has allowed data privacy violations to go severely under-checked.

在当下人权的讨论框架内，数据隐私正逐渐成为一项独立的人权，与一般隐私保护框架下的历史进行区分。然而，目前没有统一的制度或标准来界定这项权利，不同地区需要的保护程度不尽相同。这种不一致导致公司可以让公司高层人员进行回避或完全不顾众多国家所提出的要求。此外，许多地区的处罚还不够严厉，不足以激励企业改变行为。由于缺乏一个真正的全球系统和标准来执行这项权利，以及对指导公司政策的官员缺乏压力，使得数据隐私侵犯行为受到严重控制。

This Note seeks to provide a novel solution for tackling corporate holdup in complying with data privacy laws. This Note examines the historical roots of data privacy as a human right, discusses its similarity to resources that have been considered public utilities, and provides examples of instances where the right to data privacy has been ignored by corporate officers. By modifying the United Nations’ existing sanction procedure and jurisdiction, this Note proposes that the United Nations would be able to target corporate officers individually for their roles in data privacy violations. By leveraging personal liability for noncompliance, the United Nations could generate a global sense of accountability to the modern, human right to privacy in one’s personal data.

本文旨在为解决企业在遵守数据隐私法时产生的障碍，并提供新颖的解决方案。本文探讨了数据隐私作为人权的历史根源，以及数据隐私与公用事业的资源的相似性，并列举了公司高层人员忽视数据隐私权的例子。通过修改联合国现有的制裁程序和管辖权的方式，本文建议联合国能够针对公司高层人员侵犯数据隐私的行为有所反应与措施。通过对不遵守行为承担个人责任，联合国可以产生一种全球责任感，对个人数据中享有隐私的现代人权负责。

原文链接：

https://journals.library.columbia.edu/index.php/CBLR/issue/view/346