3 ms·

Thanks for the list, I took some actions based on it. Again, I'm not too concerned about my name or what comes up on Google or GitHub because they follow GDPR.

Thanks for the list, I took some actions based on it. Again, I'm not too concerned about my name or what comes up on Google or GitHub because they follow GDPR. Language Models are already as powerful as google searches in finding my name, but there's not recourse. What will this look like in 5, 10, 50 years?

iso1631 4y ago
I think you're putting too much faith in GDPR and right to be forgotten. I'm guessing you've got Portuguese citizen from a parent to be covered (not aware of any Brazillian rights), but I'm not sure how much that applies to fake names like "BoppreH" or "Elton John" compared to a real person.
dahart 4y ago
Why does GDPR help? Have you read it? It has no provision for protecting you from information you choose to share publicly. GDPR will not force Google to scrub the information you chose to put online, that’s not the spirit of the right to be forgotten idea. GDPR does not enforce absolute privacy at all times, it merely sets reasonable standards for companies to prevent leaking your information without your consent; it’s specifically for when you didn’t choose to publish your PII. Your problem is that you gave consent and chose to publish your PII and now want it revoked globally long after the fact. That is extremely problematic since it’s very very difficult to unpublish things once published, and there is little if any precedent for people being able to change their mind. Nobody expects to be able to unpublish a book such that it cannot be recovered or reprinted after copyrights expire, that’s just not a thing, right? This isn’t a problem with language models, this seems like more of a problem with exposing yourself and then changing your mind. It would be great if there were tools to help manage this, but that’s not something that has ever existed nor is codified by GDPR or any other current laws. That said, your concept does present an opportunity for an idea that someone could implement and start a business or organization for.
- number6 4y ago
  > Your problem is that you gave consent and chose to publish your PII and now want it revoked globally long after the fact. GDPR Art 17: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: [...] the data subject withdraws consent on which the processing is based [...] 2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take __reasonable steps__, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. > Nobody expects to be able to unpublish a book such that it cannot be recovered or reprinted after copyrights expire Government do and it can be done: https://en.m.wikipedia.org/wiki/List_of_books_banned_by_governments https://en.m.wikipedia.org/wiki/List_of_books_banned_by_gove...
  - dahart 4y ago
    The part you quoted clearly states this applies to data the “controller” made public, and not to data the user chose to make public: “Where the controller has made the personal data public” Again, GDPR does not protect you from yourself: it can’t! And we don’t want it to, we don’t want a surveillance state that bans public information and removes control, nor do we want people to censor history after the fact, right? As has always been the case, privacy needs to be considered before publishing information about yourself, not after. Banning books is different from what I suggested, that’s the government deciding something is illegal, not the author changing their mind. Banning books also doesn’t cause them to be forgotten. It’s not a great example of what @BoppreH is wishing for, wouldn’t you agree?
    - number6 4y ago
      > As has always been the case, privacy needs to be considered before publishing information about yourself, not after. How? 10 years ago one could not expect that all of the internet is used as training data for an AI model. The processor has to have a legal basis for processing your data even if it is publicly available. One could argue that there is some kind of consent if the data is publicly available, but consent can be revoked. https://en.m.wikipedia.org/wiki/Right_to_be_forgotten https://en.m.wikipedia.org/wiki/Right_to_be_forgotten > The right to privacy constitutes information that is not publicly known, whereas the right to be forgotten involves removing information that was publicly known at a certain time and not allowing third parties to access the information. I think you could make a case under GDPR where making the model is data processing and the BoppreH could demand to be erased for the dataset. Why is he in the dataset in the first place? Why is anyone? Am I in it? Aren't this legitimate questions?
- avereveard 4y ago
  Everything you said about gdpr is wrong. Publishing one name publicly gives no explicit nor implicit consent to third parties to handle such data. You absolutely have the right to change your mind, and company need to delete your data on demand. Gdpr absolutely codify the process to obtain, update and delete data from third parties. And Gdpr definitely do not care how much hard is to unpublished data.
  - dahart 4y ago
    Sorry, I must not have been very clear, and it seems like perhaps you didn’t follow the thread about what @BoppreH actually did. This is not a case of one exchange that can reasonably be revoked. This appears to be a case of @BoppreH publishing his own information publicly for years in multiple places, and using the same username everywhere. People do this on purpose in order to do business, to build online reputations, and to link to their offline lives. You’re also mistaken about the scope and reach of GDPR as it applies to what @BoppreH was asking for. The GDPR has been quite effective so far about making companies keep PII to themselves, stop selling it without consent, take reasonable precautions with it. It has done very good things for privacy. This thread isn’t about accidentally leaked medical records or purchase preferences. This thread appears to be about someone who wants to undo a decade of their own internet activity that has spread far and wide. That’s not a reasonable request. Look, there are laws that help you with interactions with a specific company, or that can help unpublish libel, or help with a single event or an egregious mistake in the past. But there just aren’t laws that can let you change your mind about a wide swath of information that you leave online for years, information that exchanges many hands and no longer involves any one single company.
    - mst 4y ago
      > You’re also mistaken about the scope and reach of GDPR I suspect you're correct, but the point of the original post was, I believe, to link the moral concerns behind GDPR to moral concerns about language models. For the record: I personally believe that (a) there is a morality issue here (b) the existence of the relevant technology means there's no going back anyway.

iso1631 4y ago

I think you're putting too much faith in GDPR and right to be forgotten. I'm guessing you've got Portuguese citizen from a parent to be covered (not aware of any Brazillian rights), but I'm not sure how much that applies to fake names like "BoppreH" or "Elton John" compared to a real person.

dahart 4y ago

Why does GDPR help? Have you read it? It has no provision for protecting you from information you choose to share publicly. GDPR will not force Google to scrub the information you chose to put online, that’s not the spirit of the right to be forgotten idea. GDPR does not enforce absolute privacy at all times, it merely sets reasonable standards for companies to prevent leaking your information without your consent; it’s specifically for when you didn’t choose to publish your PII. Your problem is that you gave consent and chose to publish your PII and now want it revoked globally long after the fact. That is extremely problematic since it’s very very difficult to unpublish things once published, and there is little if any precedent for people being able to change their mind. Nobody expects to be able to unpublish a book such that it cannot be recovered or reprinted after copyrights expire, that’s just not a thing, right? This isn’t a problem with language models, this seems like more of a problem with exposing yourself and then changing your mind. It would be great if there were tools to help manage this, but that’s not something that has ever existed nor is codified by GDPR or any other current laws. That said, your concept does present an opportunity for an idea that someone could implement and start a business or organization for.

number6 4y ago
> Your problem is that you gave consent and chose to publish your PII and now want it revoked globally long after the fact. GDPR Art 17: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: [...] the data subject withdraws consent on which the processing is based [...] 2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take __reasonable steps__, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. > Nobody expects to be able to unpublish a book such that it cannot be recovered or reprinted after copyrights expire Government do and it can be done: https://en.m.wikipedia.org/wiki/List_of_books_banned_by_governments https://en.m.wikipedia.org/wiki/List_of_books_banned_by_gove...
- dahart 4y ago
  The part you quoted clearly states this applies to data the “controller” made public, and not to data the user chose to make public: “Where the controller has made the personal data public” Again, GDPR does not protect you from yourself: it can’t! And we don’t want it to, we don’t want a surveillance state that bans public information and removes control, nor do we want people to censor history after the fact, right? As has always been the case, privacy needs to be considered before publishing information about yourself, not after. Banning books is different from what I suggested, that’s the government deciding something is illegal, not the author changing their mind. Banning books also doesn’t cause them to be forgotten. It’s not a great example of what @BoppreH is wishing for, wouldn’t you agree?
  - number6 4y ago
    > As has always been the case, privacy needs to be considered before publishing information about yourself, not after. How? 10 years ago one could not expect that all of the internet is used as training data for an AI model. The processor has to have a legal basis for processing your data even if it is publicly available. One could argue that there is some kind of consent if the data is publicly available, but consent can be revoked. https://en.m.wikipedia.org/wiki/Right_to_be_forgotten https://en.m.wikipedia.org/wiki/Right_to_be_forgotten > The right to privacy constitutes information that is not publicly known, whereas the right to be forgotten involves removing information that was publicly known at a certain time and not allowing third parties to access the information. I think you could make a case under GDPR where making the model is data processing and the BoppreH could demand to be erased for the dataset. Why is he in the dataset in the first place? Why is anyone? Am I in it? Aren't this legitimate questions?
avereveard 4y ago
Everything you said about gdpr is wrong. Publishing one name publicly gives no explicit nor implicit consent to third parties to handle such data. You absolutely have the right to change your mind, and company need to delete your data on demand. Gdpr absolutely codify the process to obtain, update and delete data from third parties. And Gdpr definitely do not care how much hard is to unpublished data.
- dahart 4y ago
  Sorry, I must not have been very clear, and it seems like perhaps you didn’t follow the thread about what @BoppreH actually did. This is not a case of one exchange that can reasonably be revoked. This appears to be a case of @BoppreH publishing his own information publicly for years in multiple places, and using the same username everywhere. People do this on purpose in order to do business, to build online reputations, and to link to their offline lives. You’re also mistaken about the scope and reach of GDPR as it applies to what @BoppreH was asking for. The GDPR has been quite effective so far about making companies keep PII to themselves, stop selling it without consent, take reasonable precautions with it. It has done very good things for privacy. This thread isn’t about accidentally leaked medical records or purchase preferences. This thread appears to be about someone who wants to undo a decade of their own internet activity that has spread far and wide. That’s not a reasonable request. Look, there are laws that help you with interactions with a specific company, or that can help unpublish libel, or help with a single event or an egregious mistake in the past. But there just aren’t laws that can let you change your mind about a wide swath of information that you leave online for years, information that exchanges many hands and no longer involves any one single company.
  - mst 4y ago
    > You’re also mistaken about the scope and reach of GDPR I suspect you're correct, but the point of the original post was, I believe, to link the moral concerns behind GDPR to moral concerns about language models. For the record: I personally believe that (a) there is a morality issue here (b) the existence of the relevant technology means there's no going back anyway.