You are pretty much just repeating the questions and issues from the original article now. It addresses them better than I can.
But again the fact that a blog post says X isn’t enoguh and while I have no doubt that eventually sense will prevail it still doesn’t fix the current problem and that is that the lack of prescriptive guidance from the 28 DPAs is problematic because it’s not a small risk.
What people don’t seem to understand is that most people who have problems with the GDPR don’t have problems with its principles but rather with the fact that it has been rolled out without almost any clear guidelines and rulings. If you can’t be 100% sure that your business model is compliant with the GDPR it can be a pretty big risk to take on and this ambiguity is much more disruptive than the requirements themselves.
BTW the machine learning problem isn’t unique to GDPR, HIPAA also has this problem most companies elected to classify their trained models as patient data to be on the safe side unless they were only trained with public information.
Businesses may be required to state the reason why a decision was made under other regulation but in those cases those are essentially one liners that do not provide any real explanation e.g. credit score does not meet our treshold.
There is however a real problem with GDPR and ML and by real I mean it’s not you’re getting fined out of business but that no one has a good answer for it and that is if I use your information to train a model and you then tell me to stop and delete all your information do I need to retrain my network? (While most would say no it’s not that simple)
Because for example there are other questions like does a trained model constitutes anonymization or not? And again before you say “yes” there are ways to reconstruct the training data from models e.g. http://www.deeplearningbook.org/contents/autoencoders.html
There’s also the issue of using the data for decision making once a request to stop processing has been issued primarily does processing happens only during training or also during inferencing?