4 ms·

Well, you have to hand it to the EU (Brit here): privacy has been legislated for in a way that is absolutely breathtaking. The GDPR is the first decent effort

Well, you have to hand it to the EU (Brit here): privacy has been legislated for in a way that is absolutely breathtaking. The GDPR is the first decent effort to curb the dreadful abuse of privacy that many massive multi nationals see as their right (omm nom nom data). I am extremely proud to be associated with the GDPR (I'm still a European for now). It is an absolute belter of a set of regulations. If you read it, it is actually pretty concise for a legal thingie. It is also very prescriptive which is pretty odd for a legal thingie. It is up there with the "quietly enjoy your own property" basic right that is sort of enshrined in English Law nowadays (IANAL but a search would tell you what I'm on about). If complying with GDPR is considered a problem then good luck with monetising that weakness.

cutler 8y ago
Pity the biggest abusers of our privacy - credit reference agencies - will slip through the net. How this racket can be classified as legitimate interest is beyond me.
- jimnotgym 8y ago
  Legitimate interest or not, if a UK based credit reference agency loses data in the same way that Equifax, for instance, did I think they will find GDPR has the teeth to deal with them.
  - biztos 8y ago
    But wouldn't "deal with them" basically mean work with them and give them a lot of help and support while they try to reform their practices and prevent a recurrence, because of course they will demonstrate that none of their screwup was willful?
  - cutler 8y ago
    It's not breaches that worry me, it's their right to exist in the first place. Credit reference agencies put Facebook in the shade when it comes to abuse of privacy and acting as a law unto themselves.
zerostar07 8y ago
i want to share your optimism but i wish there were at least some provisions that security/law enforcement/the Nsa etc will respect some of that privacy. Also, consider making your site compliant.
henrikschroder 8y ago
Agree. Not very long ago there were a bunch of articles posted on HN about how ML and deep neural networks produce knowledge, without humans being able to explain all the steps or any of the steps, and asked the question if this knowledge is still good. The GDPR answers this question for business decisions regarding humans: No. It's not good enough. Your business is absolutely allowed to use ML for business decisions, but if a person asks how you reached that decision, you can no longer hide behind the machine, you can't treat it as some kind of oracle in a black box that spits out correct answers without any human knowing how the mind of the oracle works. And I think that's an important foundation to have going forward. It's like how math tests work, you can't just print the correct answer, you have to show your work as well. Because the alternative is a dystopian "the computer is never wrong" future, and that's gonna suck for everyone.
- deleted 8y ago
  [deleted]
- dogma1138 8y ago
  You do not need to say how you reached a decision you at most may be required to identify which information was used to reach the decision and how it was obtained. Businesses may be required to state the reason why a decision was made under other regulation but in those cases those are essentially one liners that do not provide any real explanation e.g. credit score does not meet our treshold. There is however a real problem with GDPR and ML and by real I mean it’s not you’re getting fined out of business but that no one has a good answer for it and that is if I use your information to train a model and you then tell me to stop and delete all your information do I need to retrain my network? (While most would say no it’s not that simple) Because for example there are other questions like does a trained model constitutes anonymization or not? And again before you say “yes” there are ways to reconstruct the training data from models e.g. http://www.deeplearningbook.org/contents/autoencoders.html http://www.deeplearningbook.org/contents/autoencoders.html There’s also the issue of using the data for decision making once a request to stop processing has been issued primarily does processing happens only during training or also during inferencing?
  - 8y ago

cutler 8y ago

Pity the biggest abusers of our privacy - credit reference agencies - will slip through the net. How this racket can be classified as legitimate interest is beyond me.

jimnotgym 8y ago
Legitimate interest or not, if a UK based credit reference agency loses data in the same way that Equifax, for instance, did I think they will find GDPR has the teeth to deal with them.
- biztos 8y ago
  But wouldn't "deal with them" basically mean work with them and give them a lot of help and support while they try to reform their practices and prevent a recurrence, because of course they will demonstrate that none of their screwup was willful?
- cutler 8y ago
  It's not breaches that worry me, it's their right to exist in the first place. Credit reference agencies put Facebook in the shade when it comes to abuse of privacy and acting as a law unto themselves.

zerostar07 8y ago

i want to share your optimism but i wish there were at least some provisions that security/law enforcement/the Nsa etc will respect some of that privacy. Also, consider making your site compliant.

henrikschroder 8y ago

Agree. Not very long ago there were a bunch of articles posted on HN about how ML and deep neural networks produce knowledge, without humans being able to explain all the steps or any of the steps, and asked the question if this knowledge is still good. The GDPR answers this question for business decisions regarding humans: No. It's not good enough. Your business is absolutely allowed to use ML for business decisions, but if a person asks how you reached that decision, you can no longer hide behind the machine, you can't treat it as some kind of oracle in a black box that spits out correct answers without any human knowing how the mind of the oracle works. And I think that's an important foundation to have going forward. It's like how math tests work, you can't just print the correct answer, you have to show your work as well. Because the alternative is a dystopian "the computer is never wrong" future, and that's gonna suck for everyone.

deleted 8y ago
[deleted]
dogma1138 8y ago
You do not need to say how you reached a decision you at most may be required to identify which information was used to reach the decision and how it was obtained. Businesses may be required to state the reason why a decision was made under other regulation but in those cases those are essentially one liners that do not provide any real explanation e.g. credit score does not meet our treshold. There is however a real problem with GDPR and ML and by real I mean it’s not you’re getting fined out of business but that no one has a good answer for it and that is if I use your information to train a model and you then tell me to stop and delete all your information do I need to retrain my network? (While most would say no it’s not that simple) Because for example there are other questions like does a trained model constitutes anonymization or not? And again before you say “yes” there are ways to reconstruct the training data from models e.g. http://www.deeplearningbook.org/contents/autoencoders.html http://www.deeplearningbook.org/contents/autoencoders.html There’s also the issue of using the data for decision making once a request to stop processing has been issued primarily does processing happens only during training or also during inferencing?
- 8y ago