Flight attendants freaked out that Google is buying tons of Spirit employee data
Flight attendants freaked out that Google is buying tons of Spirit employee data
空乘人员对谷歌收购大量精神航空（Spirit Airlines）员工数据感到恐慌
Last Friday, Google won an auction to acquire a huge amount of Spirit Airlines data. The data doesn’t include personal information or customer data, but instead nearly covers the airline’s entire employment and workplace record. 上周五，谷歌赢得了一场拍卖，收购了精神航空（Spirit Airlines）的大量数据。这些数据不包含个人信息或客户数据，而是几乎涵盖了该航空公司所有的雇佣和工作场所记录。
To ensure that no individual can be identified in the dataset, Google agreed to use a court-appointed ombudsman to oversee a process to strip any personally identifying information (PII) from the data before it’s transferred to Google. Under the deal, Google agreed to maintain the data in this de-identified form and to never intentionally re-identify the data. And if Google sells access to the data, third parties would supposedly be bound by the same terms. 为了确保数据集中无法识别出任何个人，谷歌同意聘请法院指定的监察员，监督在数据传输给谷歌之前剔除所有个人身份信息（PII）的过程。根据协议，谷歌同意以这种去标识化的形式保存数据，并承诺绝不故意重新识别这些数据。如果谷歌出售这些数据的访问权限，第三方也将受到相同条款的约束。
It may sound like a solid plan if you ever flew on Spirit Airlines and interacted with an employee by email or chat. However, Google’s privacy commitments protecting Spirit customers don’t seem to extend to former Spirit workers. Panicked by the deal, former flight attendants are now rushing to object, worried that Google has not agreed to strip confidential information that workers fear could possibly be used by Google or a third party to link them to scrubbed data. 如果你曾乘坐过精神航空的航班，并通过电子邮件或聊天与员工互动过，这听起来可能是一个稳妥的计划。然而，谷歌保护精神航空客户的隐私承诺似乎并不适用于精神航空的前员工。由于对这笔交易感到恐慌，前空乘人员现在纷纷提出反对，他们担心谷歌并未同意剔除那些机密信息，而员工们担心这些信息可能会被谷歌或第三方利用，从而将他们与已脱敏的数据重新关联起来。
In a court filing Tuesday, the Association of Flight Attendants (AFA), a collective bargaining unit that represents Spirit workers, argued that Google relied on consumer protection laws to guarantee the data wouldn’t contain personally identifying information (PII). However, those laws do not cover worker confidentiality, and that allegedly leaves a huge privacy loophole in Google’s deal, especially when you consider that the tech giant is buying worker data, not consumer data. 在周二提交的一份法庭文件中，代表精神航空员工的集体谈判组织——空乘人员协会（AFA）指出，谷歌依赖消费者保护法来保证数据不包含个人身份信息（PII）。然而，这些法律并不涵盖员工机密性，据称这在谷歌的交易中留下了一个巨大的隐私漏洞，尤其是考虑到这家科技巨头购买的是员工数据，而非消费者数据。
“The privacy architecture of this transaction is consumer-facing; its payload is disproportionately employee-facing,” the AFA argued. “Hence, the employee data is far more confidential than the customer data, yet receives far less protection than the customer data.” “这笔交易的隐私架构是面向消费者的，但其核心内容却不成比例地涉及员工，”AFA辩称。“因此，员工数据比客户数据机密得多，却获得了比客户数据少得多的保护。”
The sale comes after Spirit Airlines went bankrupt and decided to auction off a massive dataset to the highest bidder. A privacy litigation director for a digital rights nonprofit called the Electronic Frontier Foundation, Adam Schwartz, told Ars that the sale alarmed privacy advocates. “EFF opposes using a person’s data for a new purpose without first getting their consent, which does not happen when a bankrupt company sells its employees’ emails to become AI training data,” Schwartz said. 此次出售是在精神航空破产并决定将海量数据集拍卖给出价最高者之后进行的。数字权利非营利组织“电子前沿基金会”（EFF）的隐私诉讼主任亚当·施瓦茨（Adam Schwartz）告诉《Ars Technica》，这次出售令隐私倡导者感到震惊。“EFF反对在未经本人同意的情况下将个人数据用于新目的，而当一家破产公司将其员工的电子邮件出售作为人工智能训练数据时，显然没有征得他们的同意，”施瓦茨说。
Google wins the auction
谷歌赢得拍卖
At the auction, Spirit debtors seemingly prioritized choosing a buyer with a plan that would least frustrate the customers it lost when the airline abruptly shuttered on May 2. The virtual auction was described beat for beat in a court filing supporting the data sale to Google from Dylan Friesner, the vice president of PJT Partners LP, which is Spirit Airlines’ investment banker. 在拍卖会上，精神航空的债务人似乎优先选择了一个买家，其计划能最大限度地减少因航空公司在5月2日突然停运而流失的客户的不满。精神航空的投资银行PJT Partners LP副总裁迪伦·弗里斯纳（Dylan Friesner）在支持将数据出售给谷歌的法庭文件中，详细描述了这场虚拟拍卖的过程。
Held on August 14, Google placed the opening bid at $5 million, while promising from the start to cover the cost of a third party scrubbing the data. Competing bids raised next were rejected after requesting additional consumer data, including a certain customer list that Spirit wouldn’t sell. But any bid seeking to include PII in the sale was cast aside after the first round. 拍卖于8月14日举行，谷歌以500万美元的开盘价竞标，并从一开始就承诺承担第三方清洗数据的费用。随后的竞争性报价因要求获取额外的消费者数据（包括精神航空拒绝出售的特定客户名单）而被拒绝。但在第一轮之后，任何试图在交易中包含个人身份信息（PII）的报价都被排除在外。
Included in the dataset were Spirit computer programs, applications, and code, as well as worker data spanning decades, including approximately 100 million employee emails, HR information, payroll data, and data measuring employee behaviors, activity, and productivity. 该数据集包括精神航空的计算机程序、应用程序和代码，以及跨越数十年的员工数据，包括约1亿封员工电子邮件、人力资源信息、工资数据，以及衡量员工行为、活动和生产力的数据。
A court document showed that Google spent two and a half hours fighting off other bidders. Mercor Corporation was its fiercest rival for the data, but Mercor tried to avoid terms that would require a third party to scrub the data. Instead, Mercor floated rejected bids repeatedly offering to scrub the data itself. Ultimately, Google won by offering the highest price, $10 million, as well as by going the extra step of covering the costs of hiring a third-party service to scrub the data to comply with consumer privacy laws. An alternative bid with similar terms for $7.5 million was accepted from Mercor, should Google fail to follow through on the purchase. 法庭文件显示，谷歌花费了两个半小时击败了其他竞标者。Mercor Corporation是其争夺数据的最强劲对手，但Mercor试图规避要求第三方清洗数据的条款。相反，Mercor多次提出由其自行清洗数据的报价，但均被拒绝。最终，谷歌以1000万美元的最高出价赢得了竞标，并额外承担了聘请第三方服务机构清洗数据以符合消费者隐私法的费用。如果谷歌未能完成此次收购，Mercor提出的750万美元的替代报价已被接受。
In the flight attendants’ objection—which is “limited” and does not seek to disrupt the sale—the AFA argued that Spirit debtors should have protected workers as strongly as they did consumers. “The Sale Agreement nowhere requires that anyone screen for, segregate, or restrict the use of confidential employee information” that employees deem sensitive. 在空乘人员的反对意见中——该意见是“有限的”，并不寻求破坏此次出售——AFA认为，精神航空的债务人应该像保护消费者一样有力地保护员工。“销售协议中没有任何地方要求任何人筛选、隔离或限制使用”员工认为敏感的机密员工信息。
Specifically, they argued: “Deidentification addresses whether a record can be traced to a named individual. It does not address whether the contents of the record are confidential. A flight attendant’s disciplinary correspondence, a crew training deficiency, a leave or accommodation request, an internal Teams exchange about staffing or scheduling grievances, and a payroll adjustment history each remain sensitive employment information whether or not the employee’s name has been stripped from it.” 具体而言，他们辩称：“去标识化解决的是记录能否追溯到特定个人的问题，它并不解决记录内容是否机密的问题。空乘人员的纪律处分信函、机组培训缺陷、休假或住宿请求、关于人员配置或排班不满的内部Teams交流，以及工资调整历史，无论是否去除了员工姓名，都依然属于敏感的雇佣信息。”
Further, they’re concerned that despite Google’s agreement to never intentionally re-identify anyone in the data, the company could possibly combine the worker data with other Google datasets to re-associate them with their Spirit data. 此外，他们担心，尽管谷歌同意绝不故意重新识别数据中的任何人，但该公司仍可能将这些员工数据与其他谷歌数据集相结合，从而将他们与精神航空的数据重新关联起来。
Google says it won’t re-identify data
谷歌表示不会重新识别数据
In a statement to Ars, a Google spokesperson suggested that the company isn’t interested in using the data to identify people connected to Spirit Airlines. Google purchased the data to improve its AI and other products. “We acquired part of an enterprise dataset from Spirit Airlines, which can be helpful in improving our products and AI models,” the spokesperson said. “We will not receive any personal information from this dataset. Any data we receive will be rigorously scrubbed of any personally identifiable information by a third party before receipt.” 在给《Ars Technica》的一份声明中，谷歌发言人表示，该公司无意利用这些数据来识别与精神航空有关的人员。谷歌购买这些数据是为了改进其人工智能和其他产品。“我们从精神航空获取了部分企业数据集，这有助于改进我们的产品和人工智能模型，”发言人说。“我们不会从该数据集中接收任何个人信息。我们在接收之前，任何数据都将由第三方进行严格清洗，剔除所有个人身份信息。”