GDPR is a piece of human rights legislation. For entirely sensible historical reasons, Europeans are acutely sensitive to issues of privacy. Many of them were born and raised in totalitarian regimes and learned painful lessons about the dangers of mass surveillance.
By passing the GDPR, the European Parliament said in no uncertain terms "if you can't run a business without infringing the rights of our citizens, we don't want you to do business in our Union". The citizens of that union are supportive of the decision taken by their democratically elected representatives.
Not only that, to a certain degree it also influences IT security: Companies with a data breach have 72 hours to report it.
No more sitting out breaches until users can find their own data on some obscure Russian forum, 2 years later.
GDPR doesn't stop you from creating a service that's a massive invasion of privacy, but you've got to ask permission first in plain language and allow people to change their minds later. If it turns out that users aren't willing to give that permission and revoke permissions that they have previously granted, it vindicates one of the basic arguments for GDPR - users wanted privacy, but they weren't being offered the opportunity to make a free and informed decision.
A small number of huge American tech companies have most to lose on this. These are the ones who play fast and loose with people's privacy.
If these new laws change the focus of business investment in Europe to those who respect privacy, that's a big win for all European citizens.
Now it's time for Margrethe Vestager to start cutting those huge American tech monopolies down to size!
And I suspect the main driver for GDPR cheering is that nothing else has been done about so many other privacy incidents. We can look back on HN and find such things as the massive Equifax leak (the next one of those is going to be interesting!) and the smart TVs that exfiltrate a list of all files on any media inserted.
This is some high-strung rhetoric. And claiming GDPR outlaws machine learning is just FUD. ML performed on personal data collected without the user's consent is illegal - but so is doing anything with illegally obtained data. ML is not the issue here, and ML has many other applications besides stealth user profiling.
"So why is interpreting the GDPR as placing a ban on ML so misleading?
Because there are significant exceptions to the prohibition on the autonomous use of ML—meaning that “prohibition” is way too strong of a word. Once the GDPR goes into effect, data scientists should expect most applications of ML to be achievable—just with a compliance burden they won’t be able to ignore.
Now, a bit more detail on the exceptions to the prohibition.
The regulation identifies three areas where the use of autonomous decisions is legal: where the processing is necessary for contractual reasons, where it’s separately authorized by another law, or when the data subject has explicitly consented.
In practice, it’s that last basis—when a data subject has explicitly allowed their data to be used by a model—that’s likely to be a common way around this prohibition. Managing user consent is not easy. Users can consent to many different types of data processing, and they can also withdraw that consent at anytime, meaning that consent management needs to be granular (allowing many different forms of consent), dynamic (allowing consent to be withdrawn), and user friendly enough that data subjects are actually empowered to understand how their data is being used and to assert control over that use.
So, does the GDPR really prohibit the use of ML models? Not completely - but it will, in many of ML’s most powerful use cases, make the deployment and management of these models and their input data increasingly difficult."
Want to use machine learning to analyze stock price movements? For self-driving cars? You're fine.
For an example, looking at kaggle's page of open competitions, only 2 of 19 use datasets that I suspect would run into consent issues (predicting home credit default risk, and predicting demand for classified ads).
There are no additional risks imposed by GDPR; all of those risks already exist in other privacy directives.
>The GDPR also outlaws most machine learning applications,
Can you point to the specific bit of GDPR that outlaws machine learning?
Here's a whole article on the subject [1] and HN discussion thread [2] . Any machine learning application that utilizes automated decision making - which is the entire point of machine learning - is forbidden under the GDPR. This can be overcome with explicit consent for that specific application of ML, but getting that in most circumstances will be a low percentage shot.
There are no additional risks imposed by GDPR; all of those risks already exist in other privacy directives.
Fines of up to 20 million EUR are a significant and new risk.
[1] https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi...
Not true. Article 22 allows automated decision making if it is contractually necessary, is authorised by law or is based on explicit consent.
Many use-cases for machine learning do not constitute automated decision making within the meaning of Article 22, because they do not produce "legal effects concerning him or her or similarly significantly affects him or her". Using ML to recommend a product or enhance a photo is perfectly permissible without any special safeguards. Most ML models based on personal data are effectively anonymous in line with Recital 26, so are not considered to be personal data.
If you're using ML in a way that respects the rights of users, GDPR is not a significant obstacle.
From https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi...
Ah, yes, if what your ML application does is suck user data on one end and produce "useful" information on the other end, then you will have a hard time explaining users why you need to collect all that data and why you need to hold it in storage for as long as you do. Because, indeed, you don't really know how that data is processed, nor how long do you really need to keep it. (This is very much an oversimplification though; many ML-based things don't necessarily fall under the rule about automated decision-based making)
Both are pieces of information that should be essential to making an informed decision about whether or not to allow private data to be collected. If you can't provide it, you need a better business plan. I'm really sorry that your founder won't be able to buy that new yacht this summer but it's hardly my problem -- and it does nothing to stiffle ML progress.
In fact, if anything, it'll be beneficial to society if some smart people give up doing ML to show ads and go someplace where they can apply ML to something useful.
I'm going to point out some counter-examples:
- One of the first machine learning stories around was movie recommendation. Under GDPR, when you click the "Recommended for me" link in your typical movie recommender, they now have to show you a page that says something on the lines of:
> UberRecommender needs to automatically process your previous ratings/view history/whatever data to make you good recommendations. We will find users with similar taste to yours, recommend movies they have liked to you and vice-versa. Click on "I agree" to continue, or "I don't agree" to disable this functionality for your account (you may change this preference later on in your settings page).
It doesn't seem too difficult to get people to click that "I agree" button, does it?
- Machine learning applied to medical diagnosis/early detection/etc. This usage was already heavily regulated (at least in the EU). So much that I'm pretty sure the GDPR does not change anything in that space.
A company really has to do terrible things to data to come anywhere near the €20m maximum fine.