It seemed like a game when Riley first started the virtual reality (VR) maze.
当莱利首次玩虚拟现实（VR）迷宫时，它似乎就像一场游戏。
He used a room-scale setup, so by physically walking around his living room, he could solve puzzles and visit different parts of the virtual maze.
他使用了房间规模一样的设置，所以通过在他的客厅里走动，他可以解决谜题并探索虚拟迷宫中不同部分。
His friends were networked into the game, so even though they were in their own living rooms, when Riley turned his head he could make eye-contact with them.
他的朋友们已经连入游戏，所以即使他们在自己的客厅里，当莱利转过头时，他也可以与他们进行目光接触。
He could even give them virtual high-fives - slapping avatar hands gave him the sensation of haptic feedback from his controller.
他甚至可以给他们虚拟击掌-拍打虚拟人物的手让他感受到来自他操控者的触觉反馈。
What Riley didn’t know was that the startup that created this game had decided to sell its users’ tracking data.
莱利不知道的是，创建这款游戏的初创公司决定出售其用户的跟踪数据。
Riley also didn’t know that a 20-minute VR game session recorded 2 million points of data about his body movement, and that an insurance company was one of the customers buying the game data.
莱利也不知道20分钟的VR一段游戏时间就记录了200万点关于他的身体运动的数据，并且一家保险公司成为了购买游戏数据的客户之一。
A month after playing the game, Riley was turned down for a new life-insurance policy.
游戏结束后的一个月，由于新的人寿保险政策，莱利被拒绝投保。
Given his excellent health, he couldn’t understand why.
鉴于他的良好健康状况，他无法理解为什么。
Several appeals later, the insurance company disclosed that Riley’s tracking data from the VR maze game revealed behavioral movement patterns often seen among people in the very early stages of dementia.
通过几个上诉后，保险公司透露，莱利的VR迷宫游戏跟踪数据揭示了他具有痴呆症早期阶段人们常常看到的行为运动模式。
Later, Riley’s sister, who had not played the VR maze game, was also rejected for life and long-term care insurance policies, as dementia tends to run in families.
后来，没有玩这个游戏的莱利姐姐同样被拒绝投保终身和长期护理保险，原因是他们家族有患上老年痴呆症的风险。
This is a hypothetical situation, but the science of using movements tracked in VR to predict dementia, and the technology to do so, are very real.
这是一个假设的情况，但是在VR中使用行为运动的科学来预测痴呆以及需要的技术是非常真实的。
Currently, there are no standards or regulations as to how this data is collected, used or shared.
目前，没有关于如何收集，使用或共享这些数据的标准或规定。
Virtual and augmented reality (VR and AR) biometric tracking data - micro-movements of head, torso, hands, and eyes - can be medical data.
虚拟和增强现实（VR和AR）生物识别跟踪数据 - 头部，躯干，手和眼睛的微小运动 - 都可以成为医疗数据。
It can diagnose or predict anxiety, depression, schizophrenia, addiction, ADHD, autism spectrum disorder and more about a person’s cognitive and physical function.
它可以诊断或预测焦虑，抑郁，精神分裂症，成瘾，注意（力）缺陷多动障碍，自闭症谱系障碍以及更多关于一个人的认知和身体功能。
Because VR and AR applications can detect changes over time in these disease-linked states, developing successful therapeutic interventions will be possible.
由于VR和AR应用可以检测这些与疾病相关的状态随时间的变化，因此将有可能开发成功的治疗干预措施。
The issue here, though, is the unintended consequences that arise when such medically-relevant data is fed into users’ psychometric profiles.
然而，这里的问题是当这些医学相关数据被输入用户的心理测量概况时出现的意外后果。
Such profiles may start out as relatively harmless, merely predicting when someone might be getting ready to buy a new car.
这样的概况可能起初相对无害，只是预测某人可能准备购买新车。
However, sprawling psychographic profiles with medical inputs could leave people vulnerable to the type of scenario outlined above.
然而，蔓延开来的消费者心理加上医疗投入让人们处于脆弱的地位，容易受到上述情况的影响。
Anonymizing VR and AR tracking data is nearly impossible because individuals have unique patterns of movement.
匿名化VR和AR跟踪数据几乎是不可能的，因为个人具有独特的移动模式。
No person throws a ball exactly the way that someone else does.
人没有完全一样的扔球方式。
Using gaze, head direction, hand position, height, and other behavioral and biological characteristics collected in VR headsets, researchers have personally identified users with 8 to 12 times better accuracy than chance.
利用在VR头戴式耳机中收集的凝视，头部方向，手部位置，身高和其他行为和生物特征，研究人员亲自确定用户的准确度比偶然性高8到12倍。
In one study where researchers collected data at 95 time points in VR, they could identify an individual with 90% accuracy.
在一项研究中，研究人员在VR中的95个时间点收集数据，他们可以识别出具有90％准确度的个体。
ust like zip code, IP address, and voiceprint, VR and AR tracking data should be considered potential ‘personally identifiable information’ (PII) because it can be used to distinguish or trace an individual's identity, either alone or when combined with other personal or identifying information.
如同邮政编码，IP地址和声纹，VR和AR跟踪数据应被视为潜在的“个人身份信息”（PII），因为它可用于区分或追踪个人身份，无论是单独还是与其他个人或 识别信息。
This is an issue that professionals in the medical research world have been grappling with for decades.
这是几十年来医学研究领域的专业人士一直在努力解决的问题。
Researchers have shown that health and medical information like DNA sequences, medical records, and health research data stripped of names and other identifying information, can be traced back to individuals by combining this data with other publicly available data sources.
研究人员已经证明，通过将这些数据与其他公开数据源相结合，可以追溯到个人健康和医疗信息，如DNA序列，剥夺名称的医疗记录和其他识别信息的健康研究数据。
Unlike medical data, however, data collected by VR technologies is currently unregulated, and how it is collected, used and shared is not monitored by any external entity.
然而，与医疗数据不同，VR技术收集的数据目前尚未受到监管，任何外部实体都不会监控其收集，使用和共享的方式。
In late 2018, VR and AR privacy policy professionals representing major players in hardware and software, as well as experts from academia and non-profits, were invited to attend a privacy summit at Stanford University to review the risks of this technology and to ideate potential solutions.
2018年末，代表硬件和软件主要参与者的VR和AR隐私政策专家以及学术界和非营利组织的专家受邀参加斯坦福大学的隐私峰会，以审查该技术的风险并考虑潜力解决方案。
The main areas of concern raised were loss of freedom, harm to reputation, and decrease in access and opportunity due to online identities becoming inseparable from offline ones.
提出来要主要关注领域是失去自由，声誉损害，以及由于在线身份与离线身份不可分割而导致访问和机会减少。
VR and AR data misuse could cause people to lose control of their identity and how they choose to present themselves to employers, insurers and others.
VR和AR数据滥用可能会导致人们失去对自己身份的控制，以及他们如何选择向雇主，保险公司和其他人展示自己。
There was special concern for the vulnerability of children who may be tracked using this technology from a young age and who are not capable of consenting to these risks.
人们特别关注儿童的脆弱性，这些儿童被科技从童年追踪而且没能力同意这些风险。
Summit attendees generated a range of solutions that could be employed to protect user privacy, which were subsequently voted on.
峰会与会者制作了一系列可用于保护用户隐私的解决方案，随后进行了投票。
Some recommendations were:
建议如下：
· Limiting the collection of biometric data by VR and AR devices, either by disallowing collection of raw data, or automatically deleting the data after a defined period to eliminate the possibility of longitudinal data collection
·限制VR和AR设备收集生物识别数据，或者通过禁止收集原始数据，或者在规定的时间段后自动删除数据，以消除纵向数据收集的可能性
· Explicit communication of the data policy (what’s being collected and how it being used) in plain, clear language
·以简单明了的语言明确传达数据政策（正在收集的内容及其使用方式）
· Not limiting access to an experience based on who opts-in to data collection, and never making opt-in the default setting
·不限制对基于谁选择加入数据的体验的访问权限，并且永远不会选择默认设置
· When data policies change, all users should be asked to opt-in again; consent should not be grandfathered through multiple iterations of a company’s privacy policy
·当数据策略发生变化时，应要求所有用户再次选择加入; 用户许可不应该通过公司隐私政策的多次迭代来实现
· Awareness that acquisition is a weak spot in privacy policy - if one company is acquired by another, user biometrics should not be transferred to the purchasing company without re-consenting users
·意识到收购是隐私政策中的一个弱点 - 如果一家公司被另一家公司收购，用户生物识别技术不应该在未经用户重新同意的情况下转移到采购公司+
One solution rose to the top at the summit: the adoption of a system similar to the institutional review boards (IRBs) that exist in universities, medical centers and companies across the world.
在峰会一个解决方案在众多方案中突出重围：这方案采用类似于全球大学，医疗中心和公司中存在的机构审查委员会（IRB）的系统。
A traditional IRB reviews researchers’ proposals to ensure that when research participants consent to become part of a research study, the study is conducted in an unbiased way that preserves their autonomy, and that the risks of their participation are minimized.
传统的IRB审查研究人员的建议，以确保当研究参与者同意成为研究的一部分时，该研究以无偏见的方式进行，以保持其自主性，并最大限度地降低其参与的风险。
Unlike more general tech advisory boards, IRBs are independent by definition, with diverse membership, and are focused on ethics, justice and respect for those who are the source of research data.
与更一般的技术咨询委员会不同，IRB根据定义是独立的，具有不同的成员资格，并且专注于道德，正义和尊重那些作为研究数据来源的人。
We believe that an IRB model can be successful in the context of VR and AR because potential harms are relatively well-understood, and possible solutions (for example, requiring clear, prospective user consent to data use activities) align with existing IRB approaches.
我们认为IRB模型可以在VR和AR的背景下取得成功，因为潜在的危害相对容易理解，并且可行的解决方案 （例如，需要明确的是，预期的用户对数据使用活动的同意）与现有的IRB方法一致。
The hope is that this type of review model will be adopted industry-wide for VR and AR.
希望这种类型的评审模型将在整个行业范围内用于VR和AR。
One way it could work is for a centralized group of experts to review the privacy policies of each company.
它可以工作的一种方式是由一个集中的专家组来审查每个公司的隐私政策。
Their role would be to assess the risks to users of each company’s data collection, storage, and usage policies.
他们的作用是评估每个公司的数据收集，存储和使用政策对用户的风险。
This independent board would be responsible for identifying the magnitude and probability of harm and recommend steps that can be taken to minimize potential harm to the user.
该独立董事会将负责确定损害的程度和可能性，并建议可采取的措施，以尽量减少对用户的潜在伤害。
IRBs were borne out of an unfortunate history of unethical scientific research in which people were unfairly injured, particularly those from disadvantaged backgrounds.
IRB是出于不道德的科学研究的不幸历史，其中人们受到不公平的伤害，特别是那些来自弱势背景的人。
Although AR and VR are relatively new consumer technologies, we perceive that the current industry is heading toward an experiment in human behaviour with the potential to harm.
尽管AR和VR是相对较新的消费者技术，但我们认为当前的行业正朝着可能造成伤害的人类行为进行实验。
Our proposal is to create an independent voice in VR and AR that advocates for the protection of users.
我们的建议是在VR和AR中创建一个独立的声音，倡导保护用户。
In turn, we believe that these protections will draw more consumers to immersive technology.
反过来，我们相信这些保护措施将吸引更多消费者使用沉浸式技术。
A significant amount of testing, iteration and refinement would be needed to make a review board strategy viable.
需要进行大量的测试，迭代和改进才能使审查委员会的战略可行。
Given the correct level of execution, we are optimistic about the potential for this solution to make VR and AR a truly user-friendly technology.
鉴于正确的执行水平，我们对此解决方案的潜力持乐观态度，使VR和AR成为真正用户友好的技术。
