5 ms·
Companies outside of GDPR-land will have a competitive advantage over those inside of it, especially in the area of machine learning. From the article: "...one
by downandout 8y ago
Companies outside of GDPR-land will have a competitive advantage over those inside of it, especially in the area of machine learning.
From the article: "...one of the first major distinctions the GDPR makes about ML models is whether they are being deployed autonomously, without a human directly in the decision-making loop. If the answer is yes—as, in practice, will be the case in a huge number of ML models—then that use is likely prohibited by default."
If users explicitly consent to it, then it's permitted under GDPR, but what percentage of users are going to do that? Most will be hitting the "decline" button by default on all websites, even if a given application of ML will be beneficial to them.
This is a showstopper for most ML in the EU. If you have an ML startup in the EU....either close up shop or move.
- jcims 8y agoIs it true that users can consent their way into it?
- downandout 8y agoYes, there's an exception in the GDPR for explicit consent to ML: The regulation identifies three areas where the use of autonomous decisions is legal: where the processing is necessary for contractual reasons, where it’s separately authorized by another law, or when the data subject has explicitly consented. But, again, nobody's going to consent - after encountering countless permission popups on websites each and every day, most will just be hitting "decline" without reading what is being asked.
- tombone12 8y agoThat's a novel claim, usually security experts are always complaining that people just click "accept" and ignore all the warnings of broken crypto and all that. How foolish they will feel when they realize that all that was missing was putting "GDPR" in the popup and people will automatically stop ignoring warnings!
- downandout 8y agoThe difference is that before, they had to click accept in order to receive whatever service they were trying to obtain. Now they don't. Also, the sheer number of consent dialogs they will encounter will rise exponentially.
- erichocean 8y ago> The difference is that before, they had to click accept in order to receive whatever service they were trying to obtain. Now they don't. This doesn't receive nearly enough attention.
- zerostar07 8y agoall it takes is a celebrity tweet to tell them to click "decline" and it becomes a meme.
- jarfil 8y agoUsers will still have to consent for ML treatment of their data if they want to use ML based services. Base whatever service you offer around it, and they'll have to either accept or get no service. The only ones losing on this are the intermediaries who up to now could slurp whatever data they wanted and sell it to third parties, while now they'll have to offer something of value to the user or get no data.
- jimnotgym 8y agoIf you are using ML to make automated decisions for say insurance risk then you will have to say so explicitly. There is a pay-off for a customer to agree, and that is convenience. If all insurance companies are doing this then a customer will likely have to consent, or not get a fast insurance decision out of hours that they seem to want. I think the big difference under GDPR is that the user will be able to request that the decision is made by a human, but if this is the case they will not get to set up their insurance at 10PM for tomorrow morning like they can in the automated system. It is completely reasonable that a customer would have to wait a couple of days for this. In practice I wonder if insurance companies (for instance) are actually doing a live ML evaluation on customers, or do they just use ML to develop some 'bandings' that they fit you in to? They could still do this of course, because they can use anonymous data to build a model. I don't see where the competitive advantage you mention lies? Yes a company in the US could use ML on US citizens, but not EU ones. Presumably a company in France could set up a server in AWS US-West region and do ML on US citizens, but not EU citizens? Surely it is a matter of where the data-subject lives, not where the company is based?
- downandout 8y agoI don't see where the competitive advantage you mention lies? Well, if you can't perform ML on data about the population that is most accessible to you, you are at a competitive disadvantage to those who can. I can't think of many EU companies that control large amounts of data on US citizens. Though I'm sure they exist, there are many more US companies that would have larger volumes of data on US citizens.
- jimnotgym 8y agoSo you are arguing that US firms operating in the US are in competition with UK firms operating in the UK? I don't see how they are in competition at all?
- downandout 8y agoHumans are humans, regardless of what country they live in. If I have a larger dataset than you, and I can do more things with it, then I can predict human behavior in a given situation better than you can. That gives me a competitive advantage over you. I may be able to then go compete with you in the EU without ever having to violate the ML provisions of GDPR, because I know what humans - whether in the EU or US - will do. Granted, there are some country-specific behaviors that this will not apply to, but then nobody will be finding out what those are in the EU because it's now illegal to do there.