5 ms·

Good summary: https://www.politico.eu/article/italian-privacy-regulator-bans-chatgpt/ https://www.politico.eu/article/italian-privacy-regulator-ba... The key i

by isp 4y ago

Good summary: https://www.politico.eu/article/italian-privacy-regulator-bans-chatgpt/ https://www.politico.eu/article/italian-privacy-regulator-ba... The key issue under GDPR seems to be that OpenAI: > lacks a legal basis justifying "the mass collection and storage of personal data ... to 'train' the algorithms" of ChatGPT" My reading: OpenAI could comply with this by modifying ChatGPT to give users protected by GDPR a clear choice to opt-in vs opt-out on their chats being used as future OpenAI training data.

revelio 4y ago
They already stopped using chats as training material for everyone anyway, so if that's the basis for the ban then it's already wrong. But what do you expect? This is exactly the kind of problem people have constantly pointed out with the GDPR. It's vague, has many unintended consequences, massively empowers low-competence regulatory regimes and constantly interferes with innovation and new tech. The EU will continue to ban new technologies whilst simultaneously hosting endless summits trying to figure out why there's no EU Silicon Valley equivalent, without being able to notice the answer staring them in the face. Very sad.
- saliagato 4y ago
  How is this ban vague? Have you read the full announcement?[1] Here are the reasons: DETECTED, from a check carried out in this regard, that no information is provided to users, nor to interested parties whose data has been collected by OpenAI, L.L.C. and processed through the ChatGPT service; NOTING the absence of an appropriate legal basis in relation to the collection of personal data and their processing for the purpose of training the algorithms underlying the functioning of ChatGPT; NOTING that the processing of personal data of the interested parties is inaccurate as the information provided by ChatGPT does not always correspond to the real data; DETECTED, moreover, the absence of any verification of the age of users in relation to the ChatGPT service which, according to the terms published by OpenAI L.L.C., is reserved for individuals who are at least 13 years old; CONSIDERING that the absence of filters for minors under the age of 13 exposes them to absolutely unsuitable responses with respect to their degree of development and self-awareness; CONSIDERING therefore that in the situation outlined above, the processing of personal data of users, including minors, and of interested parties whose data is used by the service is in violation of articles 5, 6, 8, 13 and 25 of the Regulation; RECOGNIZING, therefore, the need to have, pursuant to art. 58, par. 2, lit. f), of the Regulation - as a matter of urgency and pending the completion of the necessary investigation with respect to what has emerged so far against OpenAI L.L.C., a US company that develops and manages ChatGPT, the extent of the temporary limitation of the treatment; CONSIDERING that, in the absence of any mechanism for verifying the age of the users, as well as, in any case, of the complex of violations detected, said temporary limitation must extend to all personal data of the interested parties established in the Italian territory; CONSIDERED it necessary to order the aforementioned limitation with immediate effect from the date of receipt of this provision, reserving any other determination to the outcome of the definition of the preliminary investigation started on the case; RECALLING that, in the event of non-compliance with the measure established by the Guarantor, the criminal sanction pursuant to art. 170 of the Code and the administrative sanctions provided for by art. 83, par. 5, letter. e), of the Regulation; CONSIDERING, on the basis of the foregoing, that the prerequisites for the application of art. 5, paragraph 8, of Regulation no. 1/2000 on the organization and functioning of the Guarantor's office, which provides that «In cases of particular urgency and in which the Guarantor cannot be convened in good time, the president can adopt the measures pertaining to the body , which cease to have effect from the moment of their adoption if they are not ratified by the Guarantor in the first useful meeting, to be convened no later than the thirtieth day"; [1]https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9870832 https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb...
  - revelio 4y ago
    Verbosity isn't the same thing as precision. The judgement is both vague and inconsistent, as GDPR related things always are. They don't want OpenAI using personal data for training, which it doesn't do anyway, unless they mean the entire original training set which - as they themselves note - they can't prove contains personal data of Italians (which they mean is unclear due to vagueness), but at the same time they are banning it for not collecting enough personal data.
- isp 4y ago
  > They already stopped using chats as training material for everyone anyway From the latest ChatGPT General FAQ [0]: > Will you use my conversations for training? Yes. Your conversations may be reviewed by our AI trainers to improve our systems. [0] https://help.openai.com/en/articles/6783457-chatgpt-general-faq https://help.openai.com/en/articles/6783457-chatgpt-general-...
  - revelio 4y ago
    You're right, I was mistaken. What they changed is they now offer the ability to opt-out of that: https://help.openai.com/en/articles/6950777-chatgpt-plus https://help.openai.com/en/articles/6950777-chatgpt-plus https://docs.google.com/forms/d/e/1FAIpQLScrnC-_A7JFs4LbIuzevQ_78hVERlNqqCPCt3d8XqnKOfdRdQ/viewform https://docs.google.com/forms/d/e/1FAIpQLScrnC-_A7JFs4LbIuze...
    - isp 4y ago
      Thank you - these links are helpful. From the above, my understanding is that they currently offer opt out for the paid subscription users only ("ChatGPT Plus"). Perhaps they may end up compelled by this case to add a similar opt out to the free version. Or, possibly, to allow a free choice - where opting in and opting out are equally straightforward.
      - revelio 4y ago
        Maybe. I found the link to the form in the Plus FAQ, but neither the answer nor the form say anywhere that it's limited to Plus. I see nothing stopping anyone from filling it out even for free users. I guess you do need an "organization ID", but I think I have one of those even though I'm just an individual.
- xdennis 4y ago
  > They already stopped using chats as training material for everyone anyway, so if that's the basis for the ban then it's already wrong. Your Honor, I only murdered people in the past. I'm not murdering anyone at the moment so I should be set free!
  - revelio 4y ago
    There's no comparison between murder and anything data related, obviously. Also, logging chats and using those logs is not meaningfully different to search engines logging web searches and using them to improve web search, which they all do. At any rate OpenAI isn't an EU company and has no presence there, so can simply ignore Italy entirely (or block it themselves).
oriettaxx 4y ago
not just that: another, for example, will be to give the ability for any user to remove his/her data (and also to be able to download). Then some more: I don't think OpenAI will have problems implement it, they are probably just late. But the big issue may be another one (I hope to be wrong): if I train my model with the contributions of many users, then some users ask me to remove their 'contribution', am I able to do it?
- SiempreViernes 4y ago
  Yes: just remove that user's data from the training set, throw out the existing model and train from scratch on the modified training set. As for the more interesting question if you can modify an existing model in a simple way: probably not. But you might get away with just dropping any response containing snippets of the contribution to be expunged, and that is hopefully good enough for the regulator.
  - hollowturtle 4y ago
    geez training from scratch costs a lot of money! Let alone being able to contact all the authors of the content the model was trained on, infeasible for me
    - SiempreViernes 4y ago
      Convincing people to pay for your product isn't free either, but them's the breaks if you want to do legal business.

by isp 4y ago

revelio 4y ago

They already stopped using chats as training material for everyone anyway, so if that's the basis for the ban then it's already wrong. But what do you expect? This is exactly the kind of problem people have constantly pointed out with the GDPR. It's vague, has many unintended consequences, massively empowers low-competence regulatory regimes and constantly interferes with innovation and new tech. The EU will continue to ban new technologies whilst simultaneously hosting endless summits trying to figure out why there's no EU Silicon Valley equivalent, without being able to notice the answer staring them in the face. Very sad.

saliagato 4y ago
How is this ban vague? Have you read the full announcement?[1] Here are the reasons: DETECTED, from a check carried out in this regard, that no information is provided to users, nor to interested parties whose data has been collected by OpenAI, L.L.C. and processed through the ChatGPT service; NOTING the absence of an appropriate legal basis in relation to the collection of personal data and their processing for the purpose of training the algorithms underlying the functioning of ChatGPT; NOTING that the processing of personal data of the interested parties is inaccurate as the information provided by ChatGPT does not always correspond to the real data; DETECTED, moreover, the absence of any verification of the age of users in relation to the ChatGPT service which, according to the terms published by OpenAI L.L.C., is reserved for individuals who are at least 13 years old; CONSIDERING that the absence of filters for minors under the age of 13 exposes them to absolutely unsuitable responses with respect to their degree of development and self-awareness; CONSIDERING therefore that in the situation outlined above, the processing of personal data of users, including minors, and of interested parties whose data is used by the service is in violation of articles 5, 6, 8, 13 and 25 of the Regulation; RECOGNIZING, therefore, the need to have, pursuant to art. 58, par. 2, lit. f), of the Regulation - as a matter of urgency and pending the completion of the necessary investigation with respect to what has emerged so far against OpenAI L.L.C., a US company that develops and manages ChatGPT, the extent of the temporary limitation of the treatment; CONSIDERING that, in the absence of any mechanism for verifying the age of the users, as well as, in any case, of the complex of violations detected, said temporary limitation must extend to all personal data of the interested parties established in the Italian territory; CONSIDERED it necessary to order the aforementioned limitation with immediate effect from the date of receipt of this provision, reserving any other determination to the outcome of the definition of the preliminary investigation started on the case; RECALLING that, in the event of non-compliance with the measure established by the Guarantor, the criminal sanction pursuant to art. 170 of the Code and the administrative sanctions provided for by art. 83, par. 5, letter. e), of the Regulation; CONSIDERING, on the basis of the foregoing, that the prerequisites for the application of art. 5, paragraph 8, of Regulation no. 1/2000 on the organization and functioning of the Guarantor's office, which provides that «In cases of particular urgency and in which the Guarantor cannot be convened in good time, the president can adopt the measures pertaining to the body , which cease to have effect from the moment of their adoption if they are not ratified by the Guarantor in the first useful meeting, to be convened no later than the thirtieth day"; [1]https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9870832 https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb...
- revelio 4y ago
  Verbosity isn't the same thing as precision. The judgement is both vague and inconsistent, as GDPR related things always are. They don't want OpenAI using personal data for training, which it doesn't do anyway, unless they mean the entire original training set which - as they themselves note - they can't prove contains personal data of Italians (which they mean is unclear due to vagueness), but at the same time they are banning it for not collecting enough personal data.
isp 4y ago
> They already stopped using chats as training material for everyone anyway From the latest ChatGPT General FAQ [0]: > Will you use my conversations for training? Yes. Your conversations may be reviewed by our AI trainers to improve our systems. [0] https://help.openai.com/en/articles/6783457-chatgpt-general-faq https://help.openai.com/en/articles/6783457-chatgpt-general-...
- revelio 4y ago
  You're right, I was mistaken. What they changed is they now offer the ability to opt-out of that: https://help.openai.com/en/articles/6950777-chatgpt-plus https://help.openai.com/en/articles/6950777-chatgpt-plus https://docs.google.com/forms/d/e/1FAIpQLScrnC-_A7JFs4LbIuzevQ_78hVERlNqqCPCt3d8XqnKOfdRdQ/viewform https://docs.google.com/forms/d/e/1FAIpQLScrnC-_A7JFs4LbIuze...
  - isp 4y ago
    Thank you - these links are helpful. From the above, my understanding is that they currently offer opt out for the paid subscription users only ("ChatGPT Plus"). Perhaps they may end up compelled by this case to add a similar opt out to the free version. Or, possibly, to allow a free choice - where opting in and opting out are equally straightforward.
    - revelio 4y ago
      Maybe. I found the link to the form in the Plus FAQ, but neither the answer nor the form say anywhere that it's limited to Plus. I see nothing stopping anyone from filling it out even for free users. I guess you do need an "organization ID", but I think I have one of those even though I'm just an individual.
xdennis 4y ago
> They already stopped using chats as training material for everyone anyway, so if that's the basis for the ban then it's already wrong. Your Honor, I only murdered people in the past. I'm not murdering anyone at the moment so I should be set free!
- revelio 4y ago
  There's no comparison between murder and anything data related, obviously. Also, logging chats and using those logs is not meaningfully different to search engines logging web searches and using them to improve web search, which they all do. At any rate OpenAI isn't an EU company and has no presence there, so can simply ignore Italy entirely (or block it themselves).

oriettaxx 4y ago

not just that: another, for example, will be to give the ability for any user to remove his/her data (and also to be able to download). Then some more: I don't think OpenAI will have problems implement it, they are probably just late. But the big issue may be another one (I hope to be wrong): if I train my model with the contributions of many users, then some users ask me to remove their 'contribution', am I able to do it?

SiempreViernes 4y ago
Yes: just remove that user's data from the training set, throw out the existing model and train from scratch on the modified training set. As for the more interesting question if you can modify an existing model in a simple way: probably not. But you might get away with just dropping any response containing snippets of the contribution to be expunged, and that is hopefully good enough for the regulator.
- hollowturtle 4y ago
  geez training from scratch costs a lot of money! Let alone being able to contact all the authors of the content the model was trained on, infeasible for me
  - SiempreViernes 4y ago
    Convincing people to pay for your product isn't free either, but them's the breaks if you want to do legal business.