Also, consider making your site compliant.
Not very long ago there were a bunch of articles posted on HN about how ML and deep neural networks produce knowledge, without humans being able to explain all the steps or any of the steps, and asked the question if this knowledge is still good.
The GDPR answers this question for business decisions regarding humans: No. It's not good enough. Your business is absolutely allowed to use ML for business decisions, but if a person asks how you reached that decision, you can no longer hide behind the machine, you can't treat it as some kind of oracle in a black box that spits out correct answers without any human knowing how the mind of the oracle works.
And I think that's an important foundation to have going forward. It's like how math tests work, you can't just print the correct answer, you have to show your work as well. Because the alternative is a dystopian "the computer is never wrong" future, and that's gonna suck for everyone.
Businesses may be required to state the reason why a decision was made under other regulation but in those cases those are essentially one liners that do not provide any real explanation e.g. credit score does not meet our treshold.
There is however a real problem with GDPR and ML and by real I mean it’s not you’re getting fined out of business but that no one has a good answer for it and that is if I use your information to train a model and you then tell me to stop and delete all your information do I need to retrain my network? (While most would say no it’s not that simple)
Because for example there are other questions like does a trained model constitutes anonymization or not? And again before you say “yes” there are ways to reconstruct the training data from models e.g. http://www.deeplearningbook.org/contents/autoencoders.html
There’s also the issue of using the data for decision making once a request to stop processing has been issued primarily does processing happens only during training or also during inferencing?
You are pretty much just repeating the questions and issues from the original article now. It addresses them better than I can.
But again the fact that a blog post says X isn’t enoguh and while I have no doubt that eventually sense will prevail it still doesn’t fix the current problem and that is that the lack of prescriptive guidance from the 28 DPAs is problematic because it’s not a small risk.
What people don’t seem to understand is that most people who have problems with the GDPR don’t have problems with its principles but rather with the fact that it has been rolled out without almost any clear guidelines and rulings. If you can’t be 100% sure that your business model is compliant with the GDPR it can be a pretty big risk to take on and this ambiguity is much more disruptive than the requirements themselves.
BTW the machine learning problem isn’t unique to GDPR, HIPAA also has this problem most companies elected to classify their trained models as patient data to be on the safe side unless they were only trained with public information.
I am extremely proud to be associated with the GDPR (I'm still a European for now). It is an absolute belter of a set of regulations. If you read it, it is actually pretty concise for a legal thingie. It is also very prescriptive which is pretty odd for a legal thingie. It is up there with the "quietly enjoy your own property" basic right that is sort of enshrined in English Law nowadays (IANAL but a search would tell you what I'm on about).
If complying with GDPR is considered a problem then good luck with monetising that weakness.