5 ms·

There are just more regulations to comply with before a release. OpenAI's new Deep Research tool wasn't originally available in the EU either, but it was releas

There are just more regulations to comply with before a release. OpenAI's new Deep Research tool wasn't originally available in the EU either, but it was released less then a week after it came out in the US. Since the EU is a gigantic market with a lot of buying power and this release makes a strong case for people to switch over from competitors, I doubt it'll take long.

diggan 2y ago
> There are just more regulations to comply with before a release. If you do collect personal data and do funky stuff with it. Another approach would be to not collect that personal data until you have the right process in place, and basically be regulation-compatible out-of-the-door on day one.
- somenameforme 2y ago
  When regulations become sufficiently burueacrafied it's extremely easy to accidentally violate them doing completely normal things. As a really random example, in California when you operate a foodcart it's not enough to just keep your area and wares in sanitary condition, instead you need a dish washing bin of a minimum of exactly 'x' inches 10.5 IIRC. A guy who was just ensuring he was preparing clean healthy food, keeping everything sanitary and all that might assume he was naturally obeying all regulations. But that assumption can cost one a big fat fine (leading to fun scenarios like a food cart vendor needing a compliance legal team), and given Musk's relationship with the EU - they'd love to crucify him him on any possible technicality they can find.
  - diggan 2y ago
    Right, that's true I suppose. But also, if you don't have a car for example, you don't need to think about the laws of how to legally drive a car, since it doesn't apply to you. Similarly, if you don't collect nor process any personal data whatsoever, directives like GDPR doesn't even apply to you, so there isn't really any way (easy or hard) to "crucify" someone on violating that.
    - deleted 2y ago
      [deleted]
- IMTDb 2y ago
  Even if you don't collect personal data, you need to comply with regulations to document properly the fact that you do not collect personal data.
  - diggan 2y ago
    If your organization truly don't collect or process any personal data then no, you don't have to say anything as for example GDPR doesn't even apply to you in the first place. Or are you thinking about a different directive than GDPR perhaps?
    - IMTDb 2y ago
      The definition of "personal data" is so wide that it is impossible to provide any web service without collecting some form of "personal data". If all you have is an apache web server with the default configuration serving fully static HTML / CSS page without any script tag, you already might need a DPO and complete some documents.
      - diggan 2y ago
        > The definition of "personal data" is so wide that it is impossible to provide any web service without collecting some form of "personal data". Just because Apache by default collect and stores IPs doesn't mean it is impossible to provide a web service without collecting personal data? Disable the IP collecting, and even the default configuration wouldn't need to follow GDPR as it again doesn't even apply. Is there something else in Apache that collects personal data by default? If you're unsure what "persona data" really means, https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ has the definition. Not sure how HTML/CSS is relevant, it shouldn't depend on what content you're serving.
        IMTDb 2y ago
        All that requires additional active effort to fight having access to any data. The more complex your infra the harder it becomes to not having to do paperwork. Include a reverse proxy, and a CDN to the above and the chance of you not having access to any "personal data" is really really close to 0 unless you spend significant engineering resources triple checking everything. Even then, if you wanna be safe you better have the paperwork ready in case you forgot something. In the example above, I hope that you would not have stopped at checking the apache configuration as I am sure you are fully aware that there are multiple log levels at the OS level that need to be tweaked as well. This is of course despite the fact that you clearly have 0 ill intent and that none of these "personal data" can really be used for anything bad. The mention HTML/CSS is just to make it clear that no additional data collection can happen through javascript tags (Google analytics, or any other alternative), or useful third parties. It makes total sense that if you dare use a bug tracking software, you should definitely pay hundreds of euros per month to hire a proper DPO who will handle all the paperwork or risk being exposed as the mental lunatic that the EU commission believes you are.
- topynate 2y ago
  That's possible in general but not for this application; a chat interface to an LLM isn't very useful unless you can tell it whatever you want—including GDPR personal data—and then pick up the thread of conversation later.
  - ben_w 2y ago
    It is kinda possible to do store that in browser, but as I've been finding with my own browser-based front end for the API, the browsers seem to clear this data a bit more than one might expect. Or at least, Safari on Mac clears it.
- jpadkins 2y ago
  how do you store chat inputs without collecting personal data?

diggan 2y ago

> There are just more regulations to comply with before a release. If you do collect personal data and do funky stuff with it. Another approach would be to not collect that personal data until you have the right process in place, and basically be regulation-compatible out-of-the-door on day one.

somenameforme 2y ago
When regulations become sufficiently burueacrafied it's extremely easy to accidentally violate them doing completely normal things. As a really random example, in California when you operate a foodcart it's not enough to just keep your area and wares in sanitary condition, instead you need a dish washing bin of a minimum of exactly 'x' inches 10.5 IIRC. A guy who was just ensuring he was preparing clean healthy food, keeping everything sanitary and all that might assume he was naturally obeying all regulations. But that assumption can cost one a big fat fine (leading to fun scenarios like a food cart vendor needing a compliance legal team), and given Musk's relationship with the EU - they'd love to crucify him him on any possible technicality they can find.
- diggan 2y ago
  Right, that's true I suppose. But also, if you don't have a car for example, you don't need to think about the laws of how to legally drive a car, since it doesn't apply to you. Similarly, if you don't collect nor process any personal data whatsoever, directives like GDPR doesn't even apply to you, so there isn't really any way (easy or hard) to "crucify" someone on violating that.
  - deleted 2y ago
    [deleted]
IMTDb 2y ago
Even if you don't collect personal data, you need to comply with regulations to document properly the fact that you do not collect personal data.
- diggan 2y ago
  If your organization truly don't collect or process any personal data then no, you don't have to say anything as for example GDPR doesn't even apply to you in the first place. Or are you thinking about a different directive than GDPR perhaps?
  - IMTDb 2y ago
    The definition of "personal data" is so wide that it is impossible to provide any web service without collecting some form of "personal data". If all you have is an apache web server with the default configuration serving fully static HTML / CSS page without any script tag, you already might need a DPO and complete some documents.
    - diggan 2y ago
      > The definition of "personal data" is so wide that it is impossible to provide any web service without collecting some form of "personal data". Just because Apache by default collect and stores IPs doesn't mean it is impossible to provide a web service without collecting personal data? Disable the IP collecting, and even the default configuration wouldn't need to follow GDPR as it again doesn't even apply. Is there something else in Apache that collects personal data by default? If you're unsure what "persona data" really means, https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ has the definition. Not sure how HTML/CSS is relevant, it shouldn't depend on what content you're serving.
      - IMTDb 2y ago
        All that requires additional active effort to fight having access to any data. The more complex your infra the harder it becomes to not having to do paperwork. Include a reverse proxy, and a CDN to the above and the chance of you not having access to any "personal data" is really really close to 0 unless you spend significant engineering resources triple checking everything. Even then, if you wanna be safe you better have the paperwork ready in case you forgot something. In the example above, I hope that you would not have stopped at checking the apache configuration as I am sure you are fully aware that there are multiple log levels at the OS level that need to be tweaked as well. This is of course despite the fact that you clearly have 0 ill intent and that none of these "personal data" can really be used for anything bad. The mention HTML/CSS is just to make it clear that no additional data collection can happen through javascript tags (Google analytics, or any other alternative), or useful third parties. It makes total sense that if you dare use a bug tracking software, you should definitely pay hundreds of euros per month to hire a proper DPO who will handle all the paperwork or risk being exposed as the mental lunatic that the EU commission believes you are.
topynate 2y ago
That's possible in general but not for this application; a chat interface to an LLM isn't very useful unless you can tell it whatever you want—including GDPR personal data—and then pick up the thread of conversation later.
- ben_w 2y ago
  It is kinda possible to do store that in browser, but as I've been finding with my own browser-based front end for the API, the browsers seem to clear this data a bit more than one might expect. Or at least, Safari on Mac clears it.
jpadkins 2y ago
how do you store chat inputs without collecting personal data?