5 ms·

It slows down the innovation in a small subset of leeches which were taking advantage of new technology to abuse the citizens and residents of the EU. Cry me a

It slows down the innovation in a small subset of leeches which were taking advantage of new technology to abuse the citizens and residents of the EU. Cry me a river.

downandout 8y ago
This comment is a perfect example of what I'm talking about when I say that you people have drunk the Kool Aid. What you typed above seems to be the party line - those complaining are evil, there are no downsides to it, etc. Sounds awfully cultish, and it also happens to be wrong. The reality is that startup investment in the EU will shrink across the board because of the risks imposed by the GDPR. Additionally, any business that planned to use advertising as its revenue model probably shouldn't bother even starting up in the EU. I'm not talking about ad tech companies alone - I'm talking about publishers, news sites, social networks, companies that want to make mobile games, etc. The GDPR also outlaws most machine learning applications, so that whole industry is toast over there. It's not just a "small subset of leeches". I know that's the party line, and is probably what the PR campaign over there has been saying, but that simply isn't the case.
- DanBC 8y ago
  > The reality is that startup investment in the EU will shrink across the board because of the risks imposed by the GDPR. There are no additional risks imposed by GDPR; all of those risks already exist in other privacy directives. >The GDPR also outlaws most machine learning applications, Can you point to the specific bit of GDPR that outlaws machine learning?
  - downandout 8y ago
    Can you point to the specific bit of GDPR that outlaws machine learning? Here's a whole article on the subject [1] and HN discussion thread [2] . Any machine learning application that utilizes automated decision making - which is the entire point of machine learning - is forbidden under the GDPR. This can be overcome with explicit consent for that specific application of ML, but getting that in most circumstances will be a low percentage shot. There are no additional risks imposed by GDPR; all of those risks already exist in other privacy directives. Fines of up to 20 million EUR are a significant and new risk. [1] https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machine-learning https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi... [2] https://news.ycombinator.com/item?id=17138354 https://news.ycombinator.com/item?id=17138354
    - deleted 8y ago
      [deleted]
    - kilburn 8y ago
      Can you point out some examples of machine learning usages where: (a) they are clearly beneficial for the users; (b) it wasn't forbidden before; and (c) it is very hard to get user's consent for them. I'm going to point out some counter-examples: - One of the first machine learning stories around was movie recommendation. Under GDPR, when you click the "Recommended for me" link in your typical movie recommender, they now have to show you a page that says something on the lines of: > UberRecommender needs to automatically process your previous ratings/view history/whatever data to make you good recommendations. We will find users with similar taste to yours, recommend movies they have liked to you and vice-versa. Click on "I agree" to continue, or "I don't agree" to disable this functionality for your account (you may change this preference later on in your settings page). It doesn't seem too difficult to get people to click that "I agree" button, does it? - Machine learning applied to medical diagnosis/early detection/etc. This usage was already heavily regulated (at least in the EU). So much that I'm pretty sure the GDPR does not change anything in that space.
    - jdietrich 8y ago
      >Any machine learning application that utilizes automated decision making - which is the entire point of machine learning - is forbidden under the GDPR. Not true. Article 22 allows automated decision making if it is contractually necessary, is authorised by law or is based on explicit consent. Many use-cases for machine learning do not constitute automated decision making within the meaning of Article 22, because they do not produce "legal effects concerning him or her or similarly significantly affects him or her". Using ML to recommend a product or enhance a photo is perfectly permissible without any special safeguards. Most ML models based on personal data are effectively anonymous in line with Recital 26, so are not considered to be personal data. If you're using ML in a way that respects the rights of users, GDPR is not a significant obstacle. https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/
      - 8y ago
- melbourne_mat 8y ago
  "the party line"? That sort of emotive language sounds like something from Fox News or Heritage Foundation. A small number of huge American tech companies have most to lose on this. These are the ones who play fast and loose with people's privacy. If these new laws change the focus of business investment in Europe to those who respect privacy, that's a big win for all European citizens. Now it's time for Margrethe Vestager to start cutting those huge American tech monopolies down to size!
  - madez 8y ago
    That's not just emotive language, it's insulting and degrading. The GDPR is a multi-party, supranational, democratically legitimized regulation. Also, I haven't seen a single PR campaign about the GDPR, and I'm from "over there". The grandparent is not arguing objectively nor purely based on facts.
    - downandout 8y ago
      Huh? It’s not meant to be insulting, nor could I find any reference in any culture in which it would be considered an insult. It simply means that all of you from the EU seem to say the same things about GDPR - that it’s wonderful, has no downsides, that our new self-declared privacy overlords will be kind and benevolent, etc. It’s like there is one person behind all of your accounts, and that person is a big fan of it. That’s why I used the non-derogatory term “party line”. See https://www.merriam-webster.com/dictionary/party%20line https://www.merriam-webster.com/dictionary/party%20line
      - olavk 8y ago
        That is in turn called a strawman. And there are many different opinions in the EU regarding the GDPR. I think HN users are non-representative of the general public since they tend to be a lot more concerned about privacy issues - and that no just the users from the EU. But in general, the EU does seem overall more positive towards regulation of business than Americans.
      - pjc50 8y ago
- Joeri 8y ago
  There was already european privacy legislation which was just as strict, and companies like google and facebook already had been fined under those laws (though not to the degree that GDPR allows). What GDPR does is harmonize this kind of legislation across europe. You can argue that it is now easier for startups to build a product that targets the european market, since there is only a single set of rules to follow.
- olavk 8y ago
  > Sounds awfully cultish This is some high-strung rhetoric. And claiming GDPR outlaws machine learning is just FUD. ML performed on personal data collected without the user's consent is illegal - but so is doing anything with illegally obtained data. ML is not the issue here, and ML has many other applications besides stealth user profiling.
  - downandout 8y ago
    Please see https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machine-learning https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi...
    - azernik 8y ago
      Keep reading: "So why is interpreting the GDPR as placing a ban on ML so misleading? Because there are significant exceptions to the prohibition on the autonomous use of ML—meaning that “prohibition” is way too strong of a word. Once the GDPR goes into effect, data scientists should expect most applications of ML to be achievable—just with a compliance burden they won’t be able to ignore. Now, a bit more detail on the exceptions to the prohibition. The regulation identifies three areas where the use of autonomous decisions is legal: where the processing is necessary for contractual reasons, where it’s separately authorized by another law, or when the data subject has explicitly consented. In practice, it’s that last basis—when a data subject has explicitly allowed their data to be used by a model—that’s likely to be a common way around this prohibition. Managing user consent is not easy. Users can consent to many different types of data processing, and they can also withdraw that consent at anytime, meaning that consent management needs to be granular (allowing many different forms of consent), dynamic (allowing consent to be withdrawn), and user friendly enough that data subjects are actually empowered to understand how their data is being used and to assert control over that use. So, does the GDPR really prohibit the use of ML models? Not completely - but it will, in many of ML’s most powerful use cases, make the deployment and management of these models and their input data increasingly difficult."
      - downandout 8y ago
- jdietrich 8y ago
  > Sounds awfully cultish, and it also happens to be wrong. GDPR is a piece of human rights legislation. For entirely sensible historical reasons, Europeans are acutely sensitive to issues of privacy. Many of them were born and raised in totalitarian regimes and learned painful lessons about the dangers of mass surveillance. By passing the GDPR, the European Parliament said in no uncertain terms "if you can't run a business without infringing the rights of our citizens, we don't want you to do business in our Union". The citizens of that union are supportive of the decision taken by their democratically elected representatives.
  - freeflight 8y ago
    > GDPR is a piece of human rights legislation. Not only that, to a certain degree it also influences IT security: Companies with a data breach have 72 hours to report it. No more sitting out breaches until users can find their own data on some obscure Russian forum, 2 years later.
  - taysic 8y ago
    As a note - this is only one interpretation of the situation. In my opinion, if the privacy policy of a website is clear, then using their service and having one's collected data used as stated is not infringing on anyone's rights.
    - deleted 8y ago
      [deleted]
    - madez 8y ago
      Consent must be informed in all cases. If a user does not know the privacy policy of your website while using it, it is not informed consent. How do you make sure that the user is aware of the privacy policy while using the website?
      - taysic 8y ago
        Are you talking about cookie tracking? Most websites show their privacy policy or provide a link when you sign up, before one provides any personal information. Either way, nearly all websites have a privacy policy in their footer which can be read before continuing.
- TheForumTroll 8y ago
  >the party line Oh, a "red-scare" american.

It slows down the innovation in a small subset of leeches which were taking advantage of new technology to abuse the citizens and residents of the EU. Cry me a river.

downandout 8y ago

This comment is a perfect example of what I'm talking about when I say that you people have drunk the Kool Aid. What you typed above seems to be the party line - those complaining are evil, there are no downsides to it, etc. Sounds awfully cultish, and it also happens to be wrong. The reality is that startup investment in the EU will shrink across the board because of the risks imposed by the GDPR. Additionally, any business that planned to use advertising as its revenue model probably shouldn't bother even starting up in the EU. I'm not talking about ad tech companies alone - I'm talking about publishers, news sites, social networks, companies that want to make mobile games, etc. The GDPR also outlaws most machine learning applications, so that whole industry is toast over there. It's not just a "small subset of leeches". I know that's the party line, and is probably what the PR campaign over there has been saying, but that simply isn't the case.

DanBC 8y ago
> The reality is that startup investment in the EU will shrink across the board because of the risks imposed by the GDPR. There are no additional risks imposed by GDPR; all of those risks already exist in other privacy directives. >The GDPR also outlaws most machine learning applications, Can you point to the specific bit of GDPR that outlaws machine learning?
- downandout 8y ago
  Can you point to the specific bit of GDPR that outlaws machine learning? Here's a whole article on the subject [1] and HN discussion thread [2] . Any machine learning application that utilizes automated decision making - which is the entire point of machine learning - is forbidden under the GDPR. This can be overcome with explicit consent for that specific application of ML, but getting that in most circumstances will be a low percentage shot. There are no additional risks imposed by GDPR; all of those risks already exist in other privacy directives. Fines of up to 20 million EUR are a significant and new risk. [1] https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machine-learning https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi... [2] https://news.ycombinator.com/item?id=17138354 https://news.ycombinator.com/item?id=17138354
  - deleted 8y ago
    [deleted]
  - kilburn 8y ago
    Can you point out some examples of machine learning usages where: (a) they are clearly beneficial for the users; (b) it wasn't forbidden before; and (c) it is very hard to get user's consent for them. I'm going to point out some counter-examples: - One of the first machine learning stories around was movie recommendation. Under GDPR, when you click the "Recommended for me" link in your typical movie recommender, they now have to show you a page that says something on the lines of: > UberRecommender needs to automatically process your previous ratings/view history/whatever data to make you good recommendations. We will find users with similar taste to yours, recommend movies they have liked to you and vice-versa. Click on "I agree" to continue, or "I don't agree" to disable this functionality for your account (you may change this preference later on in your settings page). It doesn't seem too difficult to get people to click that "I agree" button, does it? - Machine learning applied to medical diagnosis/early detection/etc. This usage was already heavily regulated (at least in the EU). So much that I'm pretty sure the GDPR does not change anything in that space.
  - jdietrich 8y ago
    >Any machine learning application that utilizes automated decision making - which is the entire point of machine learning - is forbidden under the GDPR. Not true. Article 22 allows automated decision making if it is contractually necessary, is authorised by law or is based on explicit consent. Many use-cases for machine learning do not constitute automated decision making within the meaning of Article 22, because they do not produce "legal effects concerning him or her or similarly significantly affects him or her". Using ML to recommend a product or enhance a photo is perfectly permissible without any special safeguards. Most ML models based on personal data are effectively anonymous in line with Recital 26, so are not considered to be personal data. If you're using ML in a way that respects the rights of users, GDPR is not a significant obstacle. https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/
    - 8y ago
melbourne_mat 8y ago
"the party line"? That sort of emotive language sounds like something from Fox News or Heritage Foundation. A small number of huge American tech companies have most to lose on this. These are the ones who play fast and loose with people's privacy. If these new laws change the focus of business investment in Europe to those who respect privacy, that's a big win for all European citizens. Now it's time for Margrethe Vestager to start cutting those huge American tech monopolies down to size!
- madez 8y ago
  That's not just emotive language, it's insulting and degrading. The GDPR is a multi-party, supranational, democratically legitimized regulation. Also, I haven't seen a single PR campaign about the GDPR, and I'm from "over there". The grandparent is not arguing objectively nor purely based on facts.
  - downandout 8y ago
    Huh? It’s not meant to be insulting, nor could I find any reference in any culture in which it would be considered an insult. It simply means that all of you from the EU seem to say the same things about GDPR - that it’s wonderful, has no downsides, that our new self-declared privacy overlords will be kind and benevolent, etc. It’s like there is one person behind all of your accounts, and that person is a big fan of it. That’s why I used the non-derogatory term “party line”. See https://www.merriam-webster.com/dictionary/party%20line https://www.merriam-webster.com/dictionary/party%20line
    - olavk 8y ago
      That is in turn called a strawman. And there are many different opinions in the EU regarding the GDPR. I think HN users are non-representative of the general public since they tend to be a lot more concerned about privacy issues - and that no just the users from the EU. But in general, the EU does seem overall more positive towards regulation of business than Americans.
    - pjc50 8y ago
Joeri 8y ago
There was already european privacy legislation which was just as strict, and companies like google and facebook already had been fined under those laws (though not to the degree that GDPR allows). What GDPR does is harmonize this kind of legislation across europe. You can argue that it is now easier for startups to build a product that targets the european market, since there is only a single set of rules to follow.
olavk 8y ago
> Sounds awfully cultish This is some high-strung rhetoric. And claiming GDPR outlaws machine learning is just FUD. ML performed on personal data collected without the user's consent is illegal - but so is doing anything with illegally obtained data. ML is not the issue here, and ML has many other applications besides stealth user profiling.
- downandout 8y ago
  Please see https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machine-learning https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi...
  - azernik 8y ago
    Keep reading: "So why is interpreting the GDPR as placing a ban on ML so misleading? Because there are significant exceptions to the prohibition on the autonomous use of ML—meaning that “prohibition” is way too strong of a word. Once the GDPR goes into effect, data scientists should expect most applications of ML to be achievable—just with a compliance burden they won’t be able to ignore. Now, a bit more detail on the exceptions to the prohibition. The regulation identifies three areas where the use of autonomous decisions is legal: where the processing is necessary for contractual reasons, where it’s separately authorized by another law, or when the data subject has explicitly consented. In practice, it’s that last basis—when a data subject has explicitly allowed their data to be used by a model—that’s likely to be a common way around this prohibition. Managing user consent is not easy. Users can consent to many different types of data processing, and they can also withdraw that consent at anytime, meaning that consent management needs to be granular (allowing many different forms of consent), dynamic (allowing consent to be withdrawn), and user friendly enough that data subjects are actually empowered to understand how their data is being used and to assert control over that use. So, does the GDPR really prohibit the use of ML models? Not completely - but it will, in many of ML’s most powerful use cases, make the deployment and management of these models and their input data increasingly difficult."
    - downandout 8y ago
jdietrich 8y ago
> Sounds awfully cultish, and it also happens to be wrong. GDPR is a piece of human rights legislation. For entirely sensible historical reasons, Europeans are acutely sensitive to issues of privacy. Many of them were born and raised in totalitarian regimes and learned painful lessons about the dangers of mass surveillance. By passing the GDPR, the European Parliament said in no uncertain terms "if you can't run a business without infringing the rights of our citizens, we don't want you to do business in our Union". The citizens of that union are supportive of the decision taken by their democratically elected representatives.
- freeflight 8y ago
  > GDPR is a piece of human rights legislation. Not only that, to a certain degree it also influences IT security: Companies with a data breach have 72 hours to report it. No more sitting out breaches until users can find their own data on some obscure Russian forum, 2 years later.
- taysic 8y ago
  As a note - this is only one interpretation of the situation. In my opinion, if the privacy policy of a website is clear, then using their service and having one's collected data used as stated is not infringing on anyone's rights.
  - deleted 8y ago
    [deleted]
  - madez 8y ago
    Consent must be informed in all cases. If a user does not know the privacy policy of your website while using it, it is not informed consent. How do you make sure that the user is aware of the privacy policy while using the website?
    - taysic 8y ago
      Are you talking about cookie tracking? Most websites show their privacy policy or provide a link when you sign up, before one provides any personal information. Either way, nearly all websites have a privacy policy in their footer which can be read before continuing.
TheForumTroll 8y ago
>the party line Oh, a "red-scare" american.