3 ms·

Can you point to the specific bit of GDPR that outlaws machine learning? Here's a whole article on the subject [1] and HN discussion thread [2] . Any machine

Can you point to the specific bit of GDPR that outlaws machine learning? Here's a whole article on the subject [1] and HN discussion thread [2] . Any machine learning application that utilizes automated decision making - which is the entire point of machine learning - is forbidden under the GDPR. This can be overcome with explicit consent for that specific application of ML, but getting that in most circumstances will be a low percentage shot. There are no additional risks imposed by GDPR; all of those risks already exist in other privacy directives. Fines of up to 20 million EUR are a significant and new risk. [1] https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machine-learning https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi... [2] https://news.ycombinator.com/item?id=17138354 https://news.ycombinator.com/item?id=17138354

deleted 8y ago
[deleted]
kilburn 8y ago
Can you point out some examples of machine learning usages where: (a) they are clearly beneficial for the users; (b) it wasn't forbidden before; and (c) it is very hard to get user's consent for them. I'm going to point out some counter-examples: - One of the first machine learning stories around was movie recommendation. Under GDPR, when you click the "Recommended for me" link in your typical movie recommender, they now have to show you a page that says something on the lines of: > UberRecommender needs to automatically process your previous ratings/view history/whatever data to make you good recommendations. We will find users with similar taste to yours, recommend movies they have liked to you and vice-versa. Click on "I agree" to continue, or "I don't agree" to disable this functionality for your account (you may change this preference later on in your settings page). It doesn't seem too difficult to get people to click that "I agree" button, does it? - Machine learning applied to medical diagnosis/early detection/etc. This usage was already heavily regulated (at least in the EU). So much that I'm pretty sure the GDPR does not change anything in that space.
jdietrich 8y ago
>Any machine learning application that utilizes automated decision making - which is the entire point of machine learning - is forbidden under the GDPR. Not true. Article 22 allows automated decision making if it is contractually necessary, is authorised by law or is based on explicit consent. Many use-cases for machine learning do not constitute automated decision making within the meaning of Article 22, because they do not produce "legal effects concerning him or her or similarly significantly affects him or her". Using ML to recommend a product or enhance a photo is perfectly permissible without any special safeguards. Most ML models based on personal data are effectively anonymous in line with Recital 26, so are not considered to be personal data. If you're using ML in a way that respects the rights of users, GDPR is not a significant obstacle. https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/
- downandout 8y ago
  ”The GDPR, as a matter of law, does contain a blanket prohibition on the use of automated decision-making, so long as that decision-making occurs without human intervention and produces significant effects on data subjects. Importantly, the GDPR itself applies to all uses of EU data that could potentially identify a data subject—which, in any data science program using large volumes of data, means that the GDPR will apply to almost all activities (as study after study has illustrated the ability to identify individuals given enough data).” From https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machine-learning https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi...
DanBC 8y ago
The existing fines in the UK of upto £500,000 are a significant risk, but don't seem to have had much impact on start ups. It should also be reassuring to see that the maximum fine of £500,000 has never been applied. A company really has to do terrible things to data to come anywhere near the €20m maximum fine.
alxlaz 8y ago
That stuff is completely ridiculous. If your news aggregator ran a ML-based application to filter out science-related articles so as to keep out click-bait, bogus articles, you'll be able to continue running it without any problem. It doesn't even have anything to do with GDPR. Ah, yes, if what your ML application does is suck user data on one end and produce "useful" information on the other end, then you will have a hard time explaining users why you need to collect all that data and why you need to hold it in storage for as long as you do. Because, indeed, you don't really know how that data is processed, nor how long do you really need to keep it. (This is very much an oversimplification though; many ML-based things don't necessarily fall under the rule about automated decision-based making) Both are pieces of information that should be essential to making an informed decision about whether or not to allow private data to be collected. If you can't provide it, you need a better business plan. I'm really sorry that your founder won't be able to buy that new yacht this summer but it's hardly my problem -- and it does nothing to stiffle ML progress. In fact, if anything, it'll be beneficial to society if some smart people give up doing ML to show ads and go someplace where they can apply ML to something useful.

deleted 8y ago

[deleted]

kilburn 8y ago

Can you point out some examples of machine learning usages where: (a) they are clearly beneficial for the users; (b) it wasn't forbidden before; and (c) it is very hard to get user's consent for them. I'm going to point out some counter-examples: - One of the first machine learning stories around was movie recommendation. Under GDPR, when you click the "Recommended for me" link in your typical movie recommender, they now have to show you a page that says something on the lines of: > UberRecommender needs to automatically process your previous ratings/view history/whatever data to make you good recommendations. We will find users with similar taste to yours, recommend movies they have liked to you and vice-versa. Click on "I agree" to continue, or "I don't agree" to disable this functionality for your account (you may change this preference later on in your settings page). It doesn't seem too difficult to get people to click that "I agree" button, does it? - Machine learning applied to medical diagnosis/early detection/etc. This usage was already heavily regulated (at least in the EU). So much that I'm pretty sure the GDPR does not change anything in that space.

jdietrich 8y ago

>Any machine learning application that utilizes automated decision making - which is the entire point of machine learning - is forbidden under the GDPR. Not true. Article 22 allows automated decision making if it is contractually necessary, is authorised by law or is based on explicit consent. Many use-cases for machine learning do not constitute automated decision making within the meaning of Article 22, because they do not produce "legal effects concerning him or her or similarly significantly affects him or her". Using ML to recommend a product or enhance a photo is perfectly permissible without any special safeguards. Most ML models based on personal data are effectively anonymous in line with Recital 26, so are not considered to be personal data. If you're using ML in a way that respects the rights of users, GDPR is not a significant obstacle. https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/recitals/no-26/ https://gdpr-info.eu/recitals/no-26/

downandout 8y ago
”The GDPR, as a matter of law, does contain a blanket prohibition on the use of automated decision-making, so long as that decision-making occurs without human intervention and produces significant effects on data subjects. Importantly, the GDPR itself applies to all uses of EU data that could potentially identify a data subject—which, in any data science program using large volumes of data, means that the GDPR will apply to almost all activities (as study after study has illustrated the ability to identify individuals given enough data).” From https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machine-learning https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi...

DanBC 8y ago

The existing fines in the UK of upto £500,000 are a significant risk, but don't seem to have had much impact on start ups. It should also be reassuring to see that the maximum fine of £500,000 has never been applied. A company really has to do terrible things to data to come anywhere near the €20m maximum fine.

alxlaz 8y ago

That stuff is completely ridiculous. If your news aggregator ran a ML-based application to filter out science-related articles so as to keep out click-bait, bogus articles, you'll be able to continue running it without any problem. It doesn't even have anything to do with GDPR. Ah, yes, if what your ML application does is suck user data on one end and produce "useful" information on the other end, then you will have a hard time explaining users why you need to collect all that data and why you need to hold it in storage for as long as you do. Because, indeed, you don't really know how that data is processed, nor how long do you really need to keep it. (This is very much an oversimplification though; many ML-based things don't necessarily fall under the rule about automated decision-based making) Both are pieces of information that should be essential to making an informed decision about whether or not to allow private data to be collected. If you can't provide it, you need a better business plan. I'm really sorry that your founder won't be able to buy that new yacht this summer but it's hardly my problem -- and it does nothing to stiffle ML progress. In fact, if anything, it'll be beneficial to society if some smart people give up doing ML to show ads and go someplace where they can apply ML to something useful.