I am extremely proud to be associated with the GDPR (I'm still a European for now). It is an absolute belter of a set of regulations. If you read it, it is actually pretty concise for a legal thingie. It is also very prescriptive which is pretty odd for a legal thingie. It is up there with the "quietly enjoy your own property" basic right that is sort of enshrined in English Law nowadays (IANAL but a search would tell you what I'm on about).

If complying with GDPR is considered a problem then good luck with monetising that weakness.

Also, consider making your site compliant.

Not very long ago there were a bunch of articles posted on HN about how ML and deep neural networks produce knowledge, without humans being able to explain all the steps or any of the steps, and asked the question if this knowledge is still good.

The GDPR answers this question for business decisions regarding humans: No. It's not good enough. Your business is absolutely allowed to use ML for business decisions, but if a person asks how you reached that decision, you can no longer hide behind the machine, you can't treat it as some kind of oracle in a black box that spits out correct answers without any human knowing how the mind of the oracle works.

And I think that's an important foundation to have going forward. It's like how math tests work, you can't just print the correct answer, you have to show your work as well. Because the alternative is a dystopian "the computer is never wrong" future, and that's gonna suck for everyone.

Businesses may be required to state the reason why a decision was made under other regulation but in those cases those are essentially one liners that do not provide any real explanation e.g. credit score does not meet our treshold.

There is however a real problem with GDPR and ML and by real I mean it’s not you’re getting fined out of business but that no one has a good answer for it and that is if I use your information to train a model and you then tell me to stop and delete all your information do I need to retrain my network? (While most would say no it’s not that simple)

Because for example there are other questions like does a trained model constitutes anonymization or not? And again before you say “yes” there are ways to reconstruct the training data from models e.g. http://www.deeplearningbook.org/contents/autoencoders.html

There’s also the issue of using the data for decision making once a request to stop processing has been issued primarily does processing happens only during training or also during inferencing?

You are pretty much just repeating the questions and issues from the original article now. It addresses them better than I can.

But again the fact that a blog post says X isn’t enoguh and while I have no doubt that eventually sense will prevail it still doesn’t fix the current problem and that is that the lack of prescriptive guidance from the 28 DPAs is problematic because it’s not a small risk.

What people don’t seem to understand is that most people who have problems with the GDPR don’t have problems with its principles but rather with the fact that it has been rolled out without almost any clear guidelines and rulings. If you can’t be 100% sure that your business model is compliant with the GDPR it can be a pretty big risk to take on and this ambiguity is much more disruptive than the requirements themselves.

BTW the machine learning problem isn’t unique to GDPR, HIPAA also has this problem most companies elected to classify their trained models as patient data to be on the safe side unless they were only trained with public information.

If you want to do business with the EU then GDPR will probably apply in some way but not for say US to China relations.

However the GDPR is a damn fine set of standards to live up to - bear in mind that you personally are a person. Would you not want your rights as an individual protected in the same way. Go on ... live a little (and be decent).

GDPR may be what everyone needs.

No idea how much that's really an issue, but I'm pretty sure lots of people order from AliBaba in the EU (I have).

If a company uses a Chinese mega surveillance corp API, they still have to disclose it, and they can't just hide behind a "the computer says no" response if they use the results of that API call to make a business decision. The GDPR gives the data subject the right to know why and how the business decision was made, and gives the subject the right to appeal.

If you took someone's picture and ran it through neural style, would that be illegal because you couldn't tell them exactly why it painted their nose blue while imitating Leonardo Da Vinci's artistic style? Is Google auto identification of objects in personal images illegal now because they can't explain how a deep neural net works and classified their friend as something non-human by accident? This has actually happened.

That depends completely on what you are using the value for. Recommending five funny articles - GDPR does not apply. Denying an insurance claim - GDPR most certainly applies, and you have to be able to explain what factors went into the decision. You can't have unaccountable oracle boxes.

Note that a perfectly valid answer could be something like "We've analyzed your posts on social media and we've categorized you as having severe anger issues, which is why we're denying this auto collision insurance claim, because you are most likely at fault given situations like this". The GDPR says you have to be able to explain your decision like that. It doesn't forbid you from making these decisions.

> If you took someone's picture and ran it through neural style, would that be illegal because you couldn't tell them exactly why it painted their nose blue

This is not a business decision, don't be ridiculous.

The Chinese Corp API seems like the same thing. "We looked at you and decided you look like someone who wants to go on a Greek vacation."

EDIT: Also Jacques is not a Lawyer either.

1: https://jacquesmattheij.com/gdpr-hysteria

The difference between actual experts and people like Jacques is that credible experts recognize the complexity and will be honest about it.

Granted, it’s in their interest to do so, but still, at least the better ones won’t lie and tell you it’s simple just because they wish it was.

Not to mention accusing you of bad intent and doing shady things if you don’t quickly agree that the law is perfectly clear and simple and that any compliance costs are worth it if you’re honest.

After all, only an evil person would avoid the EU market with the stated reason that the compliance costs seem too high or the law too vague, because random blogger Jacques already cleared that up for us :)

Or it could be a well meaning law, that has been drafted in good faith to incrementally extend an existing directive, one that IMHO has worked rather well up to the point that organisations outside of the EU have felt they can ignore it, even when acting in EU countries. GDPR is certainly making overseas firms take our laws seriously now...

It has been mentioned a number of times, but EU law is principles-based not rules-based like in the US. I can see how it might appear vague to US eyes, but to my eyes I see a flexible law that will live on while the technology changes. I also felt it was written in plain, straight-forward language, and not poorly-written at all, I personally can live without 'here-on-ins'.

I guess if I lived in the US and had a similar law, and had US prosecutors I might be scared, but the law of European countries has survived on being principle based rather longer than the US has existed. I once had to compare and contrast both systems for an exam, and of course they both work in practice! I note however that Europe is a much less litigious place than the US, and I personally prefer that.

My real issue with the law is primarily that the EU thinks that it can assert that it has global jurisdiction with regard to the GDPR. This is so undemocratic and dangerous, it boggles my mind that fans of the GDPR can’t see it. Just because you like the intent of the law doesn’t mean you can admit that it goes too far, or sets bad precedent, or is likely to be abused.

If Saudi Arabia passes anti-blasphemy laws and says they apply globally if a citizen of theirs visits your website, should anyone care?

GDPR is being taken seriously by firms with enforcement exposure. My hope is that every other organization in the world just ignores it. It’s a dangerous precedent.

And then there’s my issue with the fans of the law who will read the above and come back with the vapid response: “well, if you’re not going to comply then clearly you’re shady and I hope you do go out of business.”

If you have a legal or business presence in the EU, you will be affected, because that puts you inside the EU jurisdiction.

Note that Facebook/Google/Apple/Microsoft/Amazon/Samsung/etc have a substantial presence in the EU; employees, offices, shops, data-centers, customers, which is why they are affected by the GDPR, and the EU is giving them the choice to either comply, or pull out.

If you have a small business in the US, you can safely ignore the GDPR, because there are no avenues of enforcement against you, because you're not inside the jurisdiction. Non-US companies get sued in US courts all the time, and nothing comes of that either.

> If Saudi Arabia passes anti-blasphemy laws and says they apply globally if a citizen of theirs visits your website, should anyone care?

Everyone doing business with Saudi Arabia should care. Is this not self-evident to you?

If only this were true. Under the GDPR, an EU resident sending their info to me anywhere else in the world apparently constitutes me doing business in the EU in their eyes. That’s their claim of global jurisdiction.

Fortunately, they can’t actually enforce this, so I’ll be ignoring it, just like I would for Saudi Arabian anti-blasphemy laws.

Yes! That is exactly the right position to take as a US company!

Anyone claiming differently is most probably peddling snake-oil in the form of "GDPR compliance".

Personally I think it's an excellent attempt to bring some sanity back to our online privacy. It's perfectly readable and understandable by an individual. Though of course it's not perfect. What is?

It's been fascinating and extremely educational to see in the numerous HN discussions how many from the US are managing to view it from entirely the opposite point of view.

Maybe it reads fine if you are a "data subject" (i hate this term btw) , but if you actually need to comply its hard, even for the simple stuff that every website has. E.g. cookies, advertising, backups

I 'm not even sure if the data subject can figure out what to expect from GDPR. E.g. Is HN compliant? Can you tell if a website you visited today is compliant?

Yes, you all keep saying that, often while tripping over each other with contradictory explanations of when it applies and how to interpret it. Yes, truly well-written and not vague at all.

That appears to be a baseless comment.

> It's a protectionist law

Or another way to look at it the US tech sector is no longer going to pick and choose which of our laws apply to it.

I'm intrigued. How is it baseless to say that a given EU country, say Germany, would not see a massive inflow of foreign money and a bunch of hobbled foreign competitors of German companies if they chose to engage in aggressive enforcement of GDPR against foreign companies?

See also the answer to when you asked 17 days ago: https://news.ycombinator.com/item?id=17005603

Please link to the specific law that exists outside the GDPR that requires such warnings. It has to be written somewhere...you (and other fans of GDPR) keep making this argument, so such a law must exist. The "answer" you linked to was just more of the same stuff you keep spouting, not a written law. If I can see such a law in the "old and large legal framework" you GDPR fans keep referring to that is somehow supposed to protect us from abuses, I'll happily admit that I'm wrong.

You're no doubt going to tell me that's far too vague and woolly. So this link might give you a flavour of how EU fundamental principles[1] came about from a bunch of centuries old separate national legal systems:

http://blogs.northampton.ac.uk/law/2015/11/02/proportionalit...

Just a random result on first page - there may be better or more easily readable sources.

That proportionality applies to everything in EU law, and there have been numerous cases through the courts, national Judicial Review, and taking cases to the EU Courts of Justice. The principle is firmly enshrined.

As with anything human mistakes are made, so of course there are appeals from time to time. That's how case law gets made.

[0] http://fra.europa.eu/en/charterpedia/article/49-principles-l... [1] https://en.wikipedia.org/wiki/General_principles_of_European...

Again the problem is that this is in the eye of the beholder. With 20 million euro maximum fines, it would be easy to say that 100k euros is proportional for the lowest levels of offenses - after all, its only 0.5% of the maximum. But that would still kill most small businesses.

Regardless, it’s pointless to argue since GDPR is here in about 36 hours, and we will all get to witness its wrath - hopefully from the sidelines. I think that within a year, most US based websites will have closed their doors to EU residents, which may be the worst aspect of this for both the EU and the US. It’s sad, but nobody - even sites with the best of intentions - can take on the liability of potential 20M euro fines, regardless of what you say the odds are of those actually being handed out.

> I think that within a year, most US based websites will have closed their doors to EU residents

I would be astonished if that is the case. If it shuts out those not willing to play nicer with data and privacy - great! Even if that ultimately includes Facebook.

Every small business within the EU is adopting this "potential liability" without any signs of a rush to relocate outside the EU or shutting down.

But what irritates me a lot more is the many GDPR fans here who not just disagree with this assessment but accuse the other side of ill intent.

It’s disgusting to call people evil and shady because they are uncomfortable with relying on the voluntary goodwill of some faceless overseas bureaucrat that they did not elect and who has been given the power of life and death over one’s livelihood. 99% of people here who have concerns don’t want to violate user privacy, but this law is so shitty that they don’t even know how to comply. And every single thread is packed with people exclaiming that it’s so obvious and easy, while all spouting totally different and contradictory advice. What a shitshow.

Sarbanes-Oxley in particular is much more draconian than any UK corporate law, and this is a barrier to me coming and breaking the law in the US, so you should change that too.

I didn't vote for your overseas faceless bureaucrat either, so I can I treat US law as optional?

Sorry Team America, you don't get to choose our laws

I didn’t elect these governments, I don’t know them or trust them, and I don’t know or trust you either.

I don’t trust unaccountable power as a general rule.

I think this is a huge strawman argument that you've constructed and hinged your entire line of reasoning on.

The EU claims jurisdiction over EU businesses. The reason very large US businesses are caring about GDPR, is because they are multinational businesses with a significant presence in the EU, i.e. they are also EU businesses. And if you're doing business in a country, you have to comply with local law. There's nothing new or weird or over-reaching about that.

When Facebook constructs a data center somewhere in the EU, the local Facebook subsidiary has to comply with local zoning laws, building codes, and labour laws.

When Facebook gathers personal data about EU citizens, the local Facebook subsidiaries have to comply with local privacy laws.

Note that Facebook isn't extending the GDPR protections to non-EU users, because it doesn't have to! It only has to extend GDPR protections to EU users, if they wish to keep their European subsidiaries.

So of course you are being downvoted.

1 - https://news.ycombinator.com/item?id=17095217

From the article: "...one of the first major distinctions the GDPR makes about ML models is whether they are being deployed autonomously, without a human directly in the decision-making loop. If the answer is yes—as, in practice, will be the case in a huge number of ML models—then that use is likely prohibited by default."

If users explicitly consent to it, then it's permitted under GDPR, but what percentage of users are going to do that? Most will be hitting the "decline" button by default on all websites, even if a given application of ML will be beneficial to them.

This is a showstopper for most ML in the EU. If you have an ML startup in the EU....either close up shop or move.

In practice I wonder if insurance companies (for instance) are actually doing a live ML evaluation on customers, or do they just use ML to develop some 'bandings' that they fit you in to? They could still do this of course, because they can use anonymous data to build a model.

I don't see where the competitive advantage you mention lies? Yes a company in the US could use ML on US citizens, but not EU ones. Presumably a company in France could set up a server in AWS US-West region and do ML on US citizens, but not EU citizens? Surely it is a matter of where the data-subject lives, not where the company is based?

Well, if you can't perform ML on data about the population that is most accessible to you, you are at a competitive disadvantage to those who can. I can't think of many EU companies that control large amounts of data on US citizens. Though I'm sure they exist, there are many more US companies that would have larger volumes of data on US citizens.

Granted, there are some country-specific behaviors that this will not apply to, but then nobody will be finding out what those are in the EU because it's now illegal to do there.

The regulation identifies three areas where the use of autonomous decisions is legal: where the processing is necessary for contractual reasons, where it’s separately authorized by another law, or when the data subject has explicitly consented.

But, again, nobody's going to consent - after encountering countless permission popups on websites each and every day, most will just be hitting "decline" without reading what is being asked.

This doesn't receive nearly enough attention.

Imagine you are a company that makes $500k+/year off of user data. You are not just going to stop doing it because of GDPR, you are going to spend up to $500k on lawyers figuring out how to get around it.