7 ms·

Will the EU respond by blocking them from doing business in the EU, given they're not abiding by GDPR?

by reassess_blind 1y ago

echelon 1y ago
Hopefully. We need many strong AI players. This would be a great way to ensure Europe can grow its own.
- ronsor 1y ago
  > This would be a great way to ensure Europe can grow its own. The reason this doesn't happen is because of Europe's internal issues, not because of foreign competition.
  - lxgr 1y ago
    Arguably, until recently there just wasn't any reason to: Europeans were happy buying American software and online services; Americans were happy buying German cars and pharmaceuticals.
    - deleted 1y ago
      [deleted]
    - glookler 1y ago
      Personally, I don't think the US clouds win anything on merit. It's hard/pointless to motivate engineers to use other options and their significance doesn't grow since Engineers won't blog that much about them to show their expertise, etc. Certification and experience with a provider with 10%-80% market share is a future employment reason to put up with a lot of trash, and the amount of help to work around that trash that has made it into places like ChatGPT is mindboggling.
deleted 1y ago
[deleted]
a2128 1y ago
It would be a political catastrophe right now if the EU blocked US companies due to them needing to comply with temporary US court orders. My guess is this'll be swept under the rug and permitted under the basis of a legal obligation
- yatopifo 1y ago
  Ultimately, American companies will be pushed out of the EU market. It’s not going to happen overnight, but the outcome is unavoidable in light of the ongoing system collapse in the US.
  - rafaelmn 1y ago
    EU software scene would take a decade to catch up. Only alternative being if AI really delivers on being a force multiplier - but even then EU would not have access to SOTA internally.
    - blagund 1y ago
      What does the EU lack? Is it the big corp infra? Or something more fundamental?
      - KoolKat23 1y ago
        Big corpo cash and big risk appetite.
      - inglor_cz 1y ago
        In my opinion, we lack two things: a) highly qualified people, even European natives move to Silicon Valley. There is a famous photo of the OpenAI core team with 6 Polish engineers and only 5 American ones; b) culture of calculated risk when it comes to investment. Here, bankruptcy is an albatross around your neck, both legally and culturally, and is considered a sign of you being fundamentally inept instead of maybe just a misalignment with the market or even bad luck. You'd better succeed on your first try, or your options for funding will evaporate.
deleted 1y ago
[deleted]
ensignavenger 1y ago
Doesn't GDPR have an explicit exemption for legal compliance?
- lxgr 1y ago
  Yes, but somehow I feel like "a foreign court told us to save absolutely everything" will not hold up in the EU indefinitely. At least in sensitive contexts (healthcare etc.) I could imagine this resulting in further restrictions, assuming the order is upheld even for European user's data.
- greatgib 1y ago
  Legal compliance with European laws that they are subject of. Not any random law around the world.
  - ensignavenger 1y ago
    Do you have a refference for where the GDPR limits it to only EU law compliance?
    - greatgib 1y ago
      Quoting wikipedia: The regulation does not purport to apply to the processing of personal data for national security activities or law enforcement of the EU; however, industry groups concerned about facing a potential conflict of laws have questioned whether Article 48 could be invoked to seek to prevent a data controller subject to a third country's laws from complying with a legal order from that country's law enforcement, judicial, or national security authorities to disclose to such authorities the personal data of an EU person, regardless of whether the data resides in or out of the EU. Article 48 states that any judgement of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may not be recognised or enforceable in any manner unless based on an international agreement, like a mutual legal assistance treaty in force between the requesting third (non-EU) country and the EU or a member state. The data protection reform package also includes a separate Data Protection Directive for the police and criminal justice sector that provides rules on personal data exchanges at State level, Union level, and international levels.[8] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
dijksterhuis 1y ago
GDPR allows for this as far as i can tell (IANAL) > Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: > ... > for the establishment, exercise or defence of legal claims. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/
- killerpopiller 1y ago
  if you are the controller (or data subject). ChatGPT is the Processor. Otherwise EU controller processing PII in ChatGPT have a problem now.
  - ndsipa_pomu 1y ago
    ‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. ‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
- _Algernon_ 1y ago
  Do legal claims outside eu jurisdiction apply? Seems like too big of a loophole to let any court globally sidestep GDPR.
gaogao 1y ago
The order is a bit broad, but legal holds frequently interact with deletion commitments. In particular, the only purpose of data deleted under GDPR held up by a legal hold should be for that legal hold, so it would be a big no-no if OpenAI continued to use that data for training.
voxic11 1y ago
> The General Data Protection Regulation (GDPR) gives individuals the right to ask for their data to be deleted and organisations do have an obligation to do so, except in the following cases: > there is a legal obligation to keep that data; https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://commission.europa.eu/law/law-topic/data-protection/r...
- tgsovlerkhgsel 1y ago
  Except that transferring the data to the US is likely illegal in the first place, specifically due to insufficient legal protections against overreach like this.
- shortsunblack 1y ago
  The legal obligation has to come from relevant member state or EU law. Not third party countries' laws. This at best is force majeure that prohibits OpenAI with satisfying its contractual obligations that are there to comply with EU law. But contractual obligations are not the only control organizations have to ensure compliance with EU law, so this is not a defense.
  - voxic11 1y ago
    From the law itself: > 1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay... > 3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: > e. for the establishment, exercise or defence of legal claims. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ The law makes no reference to the idea that the legal claims must be under a member state or EU law.
hulitu 1y ago
No. GDPR was never enforced, else Microsoft, Meta, Google and Apple couldn't do business in the EU.
udev4096 1y ago
EU privacy laws are nothing but theatre. How many times have they put up a law which would undermine end-to-end encryption or the recent law which "bans" anonymous crypto coins? It's quite clear they are very good at virtue signaling
- thrwheyho 1y ago
  Not sure why are you down voted here. I'm in EU and everything I can say about GDPR is that it does not work (simple example, government itself publishes my data including National ID number on their portal with property data; anybody can check who my parents are or if I'm on mortgage). And there are more.
  - udev4096 1y ago
    People on HN are fucking delusional. They have no connection to real world scenarios and most of them don't care about actual privacy. They only care about laws which make it sound like everything's fine

Will the EU respond by blocking them from doing business in the EU, given they're not abiding by GDPR?

echelon 1y ago

Hopefully. We need many strong AI players. This would be a great way to ensure Europe can grow its own.

ronsor 1y ago
> This would be a great way to ensure Europe can grow its own. The reason this doesn't happen is because of Europe's internal issues, not because of foreign competition.
- lxgr 1y ago
  Arguably, until recently there just wasn't any reason to: Europeans were happy buying American software and online services; Americans were happy buying German cars and pharmaceuticals.
  - deleted 1y ago
    [deleted]
  - glookler 1y ago
    Personally, I don't think the US clouds win anything on merit. It's hard/pointless to motivate engineers to use other options and their significance doesn't grow since Engineers won't blog that much about them to show their expertise, etc. Certification and experience with a provider with 10%-80% market share is a future employment reason to put up with a lot of trash, and the amount of help to work around that trash that has made it into places like ChatGPT is mindboggling.

deleted 1y ago

[deleted]

a2128 1y ago

It would be a political catastrophe right now if the EU blocked US companies due to them needing to comply with temporary US court orders. My guess is this'll be swept under the rug and permitted under the basis of a legal obligation

yatopifo 1y ago
Ultimately, American companies will be pushed out of the EU market. It’s not going to happen overnight, but the outcome is unavoidable in light of the ongoing system collapse in the US.
- rafaelmn 1y ago
  EU software scene would take a decade to catch up. Only alternative being if AI really delivers on being a force multiplier - but even then EU would not have access to SOTA internally.
  - blagund 1y ago
    What does the EU lack? Is it the big corp infra? Or something more fundamental?
    - KoolKat23 1y ago
      Big corpo cash and big risk appetite.
    - inglor_cz 1y ago
      In my opinion, we lack two things: a) highly qualified people, even European natives move to Silicon Valley. There is a famous photo of the OpenAI core team with 6 Polish engineers and only 5 American ones; b) culture of calculated risk when it comes to investment. Here, bankruptcy is an albatross around your neck, both legally and culturally, and is considered a sign of you being fundamentally inept instead of maybe just a misalignment with the market or even bad luck. You'd better succeed on your first try, or your options for funding will evaporate.

deleted 1y ago

[deleted]

ensignavenger 1y ago

Doesn't GDPR have an explicit exemption for legal compliance?

lxgr 1y ago
Yes, but somehow I feel like "a foreign court told us to save absolutely everything" will not hold up in the EU indefinitely. At least in sensitive contexts (healthcare etc.) I could imagine this resulting in further restrictions, assuming the order is upheld even for European user's data.
greatgib 1y ago
Legal compliance with European laws that they are subject of. Not any random law around the world.
- ensignavenger 1y ago
  Do you have a refference for where the GDPR limits it to only EU law compliance?
  - greatgib 1y ago
    Quoting wikipedia: The regulation does not purport to apply to the processing of personal data for national security activities or law enforcement of the EU; however, industry groups concerned about facing a potential conflict of laws have questioned whether Article 48 could be invoked to seek to prevent a data controller subject to a third country's laws from complying with a legal order from that country's law enforcement, judicial, or national security authorities to disclose to such authorities the personal data of an EU person, regardless of whether the data resides in or out of the EU. Article 48 states that any judgement of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may not be recognised or enforceable in any manner unless based on an international agreement, like a mutual legal assistance treaty in force between the requesting third (non-EU) country and the EU or a member state. The data protection reform package also includes a separate Data Protection Directive for the police and criminal justice sector that provides rules on personal data exchanges at State level, Union level, and international levels.[8] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

dijksterhuis 1y ago

GDPR allows for this as far as i can tell (IANAL) > Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: > ... > for the establishment, exercise or defence of legal claims. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/

killerpopiller 1y ago
if you are the controller (or data subject). ChatGPT is the Processor. Otherwise EU controller processing PII in ChatGPT have a problem now.
- ndsipa_pomu 1y ago
  ‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. ‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
_Algernon_ 1y ago
Do legal claims outside eu jurisdiction apply? Seems like too big of a loophole to let any court globally sidestep GDPR.

gaogao 1y ago

The order is a bit broad, but legal holds frequently interact with deletion commitments. In particular, the only purpose of data deleted under GDPR held up by a legal hold should be for that legal hold, so it would be a big no-no if OpenAI continued to use that data for training.

voxic11 1y ago

> The General Data Protection Regulation (GDPR) gives individuals the right to ask for their data to be deleted and organisations do have an obligation to do so, except in the following cases: > there is a legal obligation to keep that data; https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/dealing-citizens/do-we-always-have-delete-personal-data-if-person-asks_en https://commission.europa.eu/law/law-topic/data-protection/r...

tgsovlerkhgsel 1y ago
Except that transferring the data to the US is likely illegal in the first place, specifically due to insufficient legal protections against overreach like this.
shortsunblack 1y ago
The legal obligation has to come from relevant member state or EU law. Not third party countries' laws. This at best is force majeure that prohibits OpenAI with satisfying its contractual obligations that are there to comply with EU law. But contractual obligations are not the only control organizations have to ensure compliance with EU law, so this is not a defense.
- voxic11 1y ago
  From the law itself: > 1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay... > 3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: > e. for the establishment, exercise or defence of legal claims. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ The law makes no reference to the idea that the legal claims must be under a member state or EU law.

hulitu 1y ago

No. GDPR was never enforced, else Microsoft, Meta, Google and Apple couldn't do business in the EU.

udev4096 1y ago

EU privacy laws are nothing but theatre. How many times have they put up a law which would undermine end-to-end encryption or the recent law which "bans" anonymous crypto coins? It's quite clear they are very good at virtue signaling

thrwheyho 1y ago
Not sure why are you down voted here. I'm in EU and everything I can say about GDPR is that it does not work (simple example, government itself publishes my data including National ID number on their portal with property data; anybody can check who my parents are or if I'm on mortgage). And there are more.
- udev4096 1y ago
  People on HN are fucking delusional. They have no connection to real world scenarios and most of them don't care about actual privacy. They only care about laws which make it sound like everything's fine