4 ms·

> In the age of GDPR this feels like an enormous regression in privacy. As you stated, this is publically available information. GDPR has nothing to do with it

> In the age of GDPR this feels like an enormous regression in privacy. As you stated, this is publically available information. GDPR has nothing to do with it.

blagie 4y ago
There are different levels of publicly-available information. I have a stalker. I know her well enough to keep myself safe. I don't take measures which would deter a marketing company or a government, but enough to deter her. It's a lot easier to live with some "soft" measures than with "hard" measures. When "public" information is aggregated and posted online, it does cause problems for people like me.
- that_guy_iain 4y ago
  I am not saying it's not a pain. But what I am saying, is scraping the internet and displaying the data you gathered is not a breach of GDPR. If in doubt, go look at Google. Constantly fined billions by the EU. Not once have they been fined for displaying personal information in their Google search results. Not liking something is fair enough. Not liking something and then saying it's breaching GDPR because they used public information isn't the same.
  - blagie 4y ago
    It depends. Google has tools: https://support.google.com/websearch/troubleshooter/3111061?hl=en https://support.google.com/websearch/troubleshooter/3111061?... GDPR grants a right-to-be-forgotten. It's not a proactive right; you need to make a request.
    - that_guy_iain 4y ago
      Right to be forgotten, isn't GDPR, and it only affects results within the EU.
      - jhgb 4y ago
        > Right to be forgotten, isn't GDPR https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/: "Art. 17 GDPR Right to erasure ('right to be forgotten')" ...seems like it is?
        that_guy_iain 4y ago
        Right to be forgotten is older than GDPR. They might have included it as part of the new law. But overall the right to be forgotten is older than GDPR. But that link is not an offical source and has right to be forgotten in brackets as the actual right is the right to have data deleted. And the main part is that it only affects data within the EU. Google can still process your data and even clearly tells you that they still have the data when they show you a link at the bottom of the search result that they removed results. Edit: Wikipedia has "The right to be forgotten was replaced by a more limited right to erasure in the version of the GDPR adopted by the European Parliament in March 2014."
      - blagie 4y ago
        There are analogues for minors across the US (COPPA), in many other jurisdictions (e.g. CCPA), etc. GDPR, as a human rights law, tends to have far-reaching claws too. Enforcement is sporadic, but that may change.
jacquesm 4y ago
This is incorrect.
jhgb 4y ago
Please show us where GDPR excepts publicly available information about a person from requirements for processing.
- JPLeRouzic 4y ago
  I am not a layer but this web page seems to tell there are a few exceptions: https://iapp.org/news/a/publicly-available-data-under-gdpr-main-considerations/ https://iapp.org/news/a/publicly-available-data-under-gdpr-m... If I am not mistaken, this is one case: "in line with Article 9, if the processing relates to personal data that are manifestly made public by the data subject, no explicit consent or other legal basis as enlisted in the Article 9 (mainly specific laws and regulations or establishment, exercise or defense of legal claims) is required."
  - jhgb 4y ago
    Even if they wouldn't need permission to gather and process that data, does this circumvent the right to ask for your personal data in the possession of someone to be deleted? I know there are several listed exceptions to an entity's obligation to comply with your request for data deletion (freedom of expression, public interest, legal obligation for keeping data), but I strongly doubt any of them apply to GPT-3, and none of them refers to the way the data has been collected.
    - that_guy_iain 4y ago
      I suspect it might not be technically feasible to delete. For example, it's in a language mode, it's not like it's going to be easily identifiable. And your name alone isn't data you can demand to be removed. For example, I might want "Iain Cambridge" to be removed but the other Iain Cambridge might want records belong to them to remain.
junon 4y ago
This is NOT how GDPR works.
lucb1e 4y ago
So by doxxing someone, you can get them to no longer fall under GDPR? Interesting theory! Do you have any court rulings or law texts or even a random lawyer's interpretation on a blog post to link for that?

> In the age of GDPR this feels like an enormous regression in privacy. As you stated, this is publically available information. GDPR has nothing to do with it.

blagie 4y ago

There are different levels of publicly-available information. I have a stalker. I know her well enough to keep myself safe. I don't take measures which would deter a marketing company or a government, but enough to deter her. It's a lot easier to live with some "soft" measures than with "hard" measures. When "public" information is aggregated and posted online, it does cause problems for people like me.

that_guy_iain 4y ago
I am not saying it's not a pain. But what I am saying, is scraping the internet and displaying the data you gathered is not a breach of GDPR. If in doubt, go look at Google. Constantly fined billions by the EU. Not once have they been fined for displaying personal information in their Google search results. Not liking something is fair enough. Not liking something and then saying it's breaching GDPR because they used public information isn't the same.
- blagie 4y ago
  It depends. Google has tools: https://support.google.com/websearch/troubleshooter/3111061?hl=en https://support.google.com/websearch/troubleshooter/3111061?... GDPR grants a right-to-be-forgotten. It's not a proactive right; you need to make a request.
  - that_guy_iain 4y ago
    Right to be forgotten, isn't GDPR, and it only affects results within the EU.
    - jhgb 4y ago
      > Right to be forgotten, isn't GDPR https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/: "Art. 17 GDPR Right to erasure ('right to be forgotten')" ...seems like it is?
      - that_guy_iain 4y ago
        Right to be forgotten is older than GDPR. They might have included it as part of the new law. But overall the right to be forgotten is older than GDPR. But that link is not an offical source and has right to be forgotten in brackets as the actual right is the right to have data deleted. And the main part is that it only affects data within the EU. Google can still process your data and even clearly tells you that they still have the data when they show you a link at the bottom of the search result that they removed results. Edit: Wikipedia has "The right to be forgotten was replaced by a more limited right to erasure in the version of the GDPR adopted by the European Parliament in March 2014."
    - blagie 4y ago
      There are analogues for minors across the US (COPPA), in many other jurisdictions (e.g. CCPA), etc. GDPR, as a human rights law, tends to have far-reaching claws too. Enforcement is sporadic, but that may change.

jacquesm 4y ago

This is incorrect.

jhgb 4y ago

Please show us where GDPR excepts publicly available information about a person from requirements for processing.

JPLeRouzic 4y ago
I am not a layer but this web page seems to tell there are a few exceptions: https://iapp.org/news/a/publicly-available-data-under-gdpr-main-considerations/ https://iapp.org/news/a/publicly-available-data-under-gdpr-m... If I am not mistaken, this is one case: "in line with Article 9, if the processing relates to personal data that are manifestly made public by the data subject, no explicit consent or other legal basis as enlisted in the Article 9 (mainly specific laws and regulations or establishment, exercise or defense of legal claims) is required."
- jhgb 4y ago
  Even if they wouldn't need permission to gather and process that data, does this circumvent the right to ask for your personal data in the possession of someone to be deleted? I know there are several listed exceptions to an entity's obligation to comply with your request for data deletion (freedom of expression, public interest, legal obligation for keeping data), but I strongly doubt any of them apply to GPT-3, and none of them refers to the way the data has been collected.
  - that_guy_iain 4y ago
    I suspect it might not be technically feasible to delete. For example, it's in a language mode, it's not like it's going to be easily identifiable. And your name alone isn't data you can demand to be removed. For example, I might want "Iain Cambridge" to be removed but the other Iain Cambridge might want records belong to them to remain.

junon 4y ago

This is NOT how GDPR works.

lucb1e 4y ago

So by doxxing someone, you can get them to no longer fall under GDPR? Interesting theory! Do you have any court rulings or law texts or even a random lawyer's interpretation on a blog post to link for that?