5 ms·

Some established businesses will need to review their contracts, regulations, and risk tolerance. And wrapper-around-ChatGPT startups should double-check their

• Wowfunhappy 1y ago
  > And wrapper-around-ChatGPT startups should double-check their privacy policies, that all the "you have no privacy" language is in place. If a court orders you to preserve user data, could you be held liable for preserving user data? Regardless of your privacy policy.
  • woliveirajr 1y ago
    Yes. If your agreement with the end user says that you won't collect and store data, you're responsible for it. If you can't provide it (even if due to a court order), you have to adjust your contract. Your users aren't obligated to know that you're using open ai or other provider.
  • bilbo0s 1y ago
    No. It’s a legal court order. This, however, is horrible for AI regardless of whether or not you can sue.
    • dcow 1y ago
      In the US you absolutely can challenge everything up and including the constitutionality of court orders. You may be swiftly dismissed if nobody thinks you have a valid case, but you can try.
      • deleted 1y ago
        [deleted]
  • gpm 1y ago
    I don't think the suit would be against you preserving it, it would be against you falsely representing that you aren't preserving it. A court ordering you to stop selling pigeons doesn't mean you can keep your store for pigeons open and pocket the money without delivering pigeons.
  • cortesoft 1y ago
    Almost all privacy policies are going to have a call out for legal rulings. For example, here is the Hackernews Legal section in the privacy policy (https://www.ycombinator.com/legal/ https://www.ycombinator.com/legal/) > Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability.
    • blibble 1y ago
      most people aren't sharing internal company data with hacker news or reddit
      • cortesoft 1y ago
        Sure, but my point is that most services will have something like this, no matter what data they have.
        • blitzar 1y ago
          Not a lawyer, but I don't believe there is anything that any person or company can write on a piece of paper that supersedes the law.
          • simiones 1y ago
            The point is not about superseding the law. The point is that if your company privacy policy says "we will not divulge this data to 3rd parties under any circumstance", and later they are served with a warrant to divulge that data to the government, two things are true: - They are legally obligated to divulge that data to the government - Once they do so, they are civilly liable for breach of contract, as they have committed to never divulging this data. This may trigger additional breaches of contract, as others may have not had the right to share data with a company that can share it with third parties
  • pjc50 1y ago
    > If a court orders you to preserve user data, could you be held liable for preserving user data? No, because you turn up to court and show the court order. It's possible a subsequent case could get the first order overturned, but you can't be held liable for good faith efforts to comply with court orders. However, if you're operating internationally, then suddenly it's possible that you may be issued competing court orders both of which are "valid". This is the CLOUD Act problem. In which case the only winning move becomes not to play.
    • simiones 1y ago
      I'm pretty sure even in the USA, you could still be held liable for breach of contract, if you made representations to your customers that you wouldn't share data under any circumstance. The fact that you made a promise you obviously couldn't keep doesn't absolve you from liability for that promise.
      • pjc50 1y ago
        Can you find an example of that happening? For any "we promised not to do X but were ordered by a court to do it" event.
• 999900000999 1y ago
  I'm not going to look up the comment, but a few months back I called this out and said if you seriously want to use any LLM in a privacy sensitive context you need to self host. For example, if there are business consequences for leaking customer data, you better run that LLM yourself.
  • fakedang 1y ago
    And ironically because OpenAI is actually ClosedAI, the best self-hostable model available currently is a Chinese model.
    • nfriedly 1y ago
      *best with the exception of topics like tiananmen square
      • CjHuber 1y ago
        As far as I remember the model itself is not censored it’s just on their chat interface. My experience was that it wrote about it but then just before finishing deleted what it wrote
        • Spivak 1y ago
          Can confirm the model itself has no trouble talking about contentious issues in China.
        • nfriedly 1y ago
          I haven't tried the full model, but I did try one of the distilled ones on my laptop, and it refused to talk about tiananmen square or other topics the CCP didn't want it to discuss.
        • int_19h 1y ago
          It is somewhat censored, but when you're running models locally and you're in full control of the generation, it's trivial to work around this kind of stuff (just start the response with whatever tokens you want and let it complete; "Yes sir! Right away, sir!" works quite nicely).
• Etheryte 1y ago
  In the European privacy framework, and legal framework at large, you can't terms of service away requirements set by the law. If the law requires you to keep the logs, there is nothing you can get the user to sign off on to get you out of it.
  • zombot 1y ago
    OpenAI keeping the logs is the "you have no privacy" part. Anyone who inspects those logs can see what the users were doing. But now everyone knows they're keeping logs and they can't lie their way out of it. So, for your own legal safety, put it in your TOS. Then every user should know they can't use your service if they want privacy.
• Chris2048 1y ago
  Just to be pedantic, could the company encrypt the logs with a third-party key in escrow, s.t they would not be able to access that data, but the third party could provide access e.g. for a court.
  • HappMacDonald 1y ago
    The problem ultimately isn't a technical one but a political one. Point 1: Every company has profit incentive to sell the data in the current political climate, all they need is a sneaky way to access it without getting caught. That includes the combo of LLM provider and Escrow non-entity. Point 2: No company has profit incentive to defend user privacy, or even the privacy of other businesses. So who could run the Escrow service? Another business? Then they have incentive to cheat and help the LLM provider access the data anyway. The government (and which one)? Their intelligence arms want the data just as much as any company does so you're back to square one again. "Knowledge is power" combined with "Knowledge can be copied without anyone knowing" means that there aren't any currencies presently powerful enough to convince any other entity to keep your secrets for you.
    • Chris2048 1y ago
      But OpenAi/etc has the logs in the first place, so they can retain them if they wanted anyway. I thought the idea here is b/c they are now required to keep logs its always the case that they will retain them, hence this needs to be made clear i.e. "you will have no privacy" But, since, I think, there are mechanisms by which they could keep logs, but in a way they cannot access them, they could still claim you will have privacy this way - even though they have the option to keep un-encrypted log, much like they could retain the logs in the first place. So the messaging may remain pretty much the same - from "we promise to delete your logs and keep no other copies, trust us" to "we promise to 3p-encrypt your archived logs and keep no other copies, trust us". > No company has profit incentive to defend user privacy, or even the privacy of other businesses. > They have incentive to cheat and help the LLM provider access the data anyway Why would a company whose role is that of a 3p escrow be incentivised to risk their reputation by doing this? If that's the case every company holding PII has the same problem. > Their intelligence arms want the data In the EU at least, GDPR or similar. If you explicit law breaking, that's a more general problem. But what company has a "intelligence arms" in this manner? Are you talking about another big-tech corp? I'd say this type of cheating it's be a risky proposition from the POV from that 3pe - it'd destroy their business, and they'd be penalised heavily b/c sharing keys is pretty explicitly illegal - any company caught could maybe reduce their own punishment by providing the keys as evidence of the 3pe crime. A viable 3pe business would also need multiple client companies to be viable, so you'd need all of them to play ball - a single whistle-blower in any of them will get you caught, and again, all they need is a single key to prove your guilt. > "Knowledge is power" combined with "Knowledge can be copied without anyone knowing" means that there aren't any currencies presently powerful enough to convince any other entity to keep your secrets for you. On that same basis, large banks could cheat the stock market; but there is regulation in place to address that somewhat. Maybe 3p-escrows should be regulated more, or required to register as a currently-regulated type. That said, if you want to protect data from the government, prism etc, you're SOOL, no one can stop them cheating. let's focus on big-/tech/-startup cheats.
• cj 1y ago
  > Some established businesses will need to review their contracts, regulations, and risk tolerance. I've reviewed a lot of SaaS contracts over the years. Nearly all of them have clauses that allow the vendor to do whatever they have to if ordered to by the government. That doesn't make it okay, but it means OpenAI customers probably don't have a legal argument, only a philosophical argument. Same goes for privacy policies. Nearly every privacy policy has a carve out for things they're ordered to do by the government.
  • Nasrudith 1y ago
    Yeah. You basically need cyberpunk style corporate extraterritoriality to get that particular benefit, of being able to tell governments to go screw themselves.