Again, I'm not too concerned about my name or what comes up on Google or GitHub because they follow GDPR.
Language Models are already as powerful as google searches in finding my name, but there's not recourse. What will this look like in 5, 10, 50 years?
Your problem is that you gave consent and chose to publish your PII and now want it revoked globally long after the fact. That is extremely problematic since it’s very very difficult to unpublish things once published, and there is little if any precedent for people being able to change their mind. Nobody expects to be able to unpublish a book such that it cannot be recovered or reprinted after copyrights expire, that’s just not a thing, right? This isn’t a problem with language models, this seems like more of a problem with exposing yourself and then changing your mind.
It would be great if there were tools to help manage this, but that’s not something that has ever existed nor is codified by GDPR or any other current laws. That said, your concept does present an opportunity for an idea that someone could implement and start a business or organization for.
Publishing one name publicly gives no explicit nor implicit consent to third parties to handle such data.
You absolutely have the right to change your mind, and company need to delete your data on demand.
Gdpr absolutely codify the process to obtain, update and delete data from third parties.
And Gdpr definitely do not care how much hard is to unpublished data.
You’re also mistaken about the scope and reach of GDPR as it applies to what @BoppreH was asking for. The GDPR has been quite effective so far about making companies keep PII to themselves, stop selling it without consent, take reasonable precautions with it. It has done very good things for privacy. This thread isn’t about accidentally leaked medical records or purchase preferences. This thread appears to be about someone who wants to undo a decade of their own internet activity that has spread far and wide. That’s not a reasonable request.
Look, there are laws that help you with interactions with a specific company, or that can help unpublish libel, or help with a single event or an egregious mistake in the past. But there just aren’t laws that can let you change your mind about a wide swath of information that you leave online for years, information that exchanges many hands and no longer involves any one single company.
I suspect you're correct, but the point of the original post was, I believe, to link the moral concerns behind GDPR to moral concerns about language models.
For the record: I personally believe that (a) there is a morality issue here (b) the existence of the relevant technology means there's no going back anyway.
I’m curious to hear more about what the moral issue is from your perspective. There are legitimate privacy concerns surrounding PII and AI, and surrounding PII and the internet in general. There are legitimate concerns about ways that AI can infer non-public information. There are also legitimate concerns about humanity’s ability to record history and also about the legal and financial liabilities that might come about when recording publicly available information. Those are big general debates and are worthy of attention.
This particular case hasn’t convinced me yet, since the PII was knowingly posted, left online for some time, and since the AI is only regurgitating knowledge that Google also has.
GDPR Art 17:
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
[...] the data subject withdraws consent on which the processing is based [...] 2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take __reasonable steps__, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
> Nobody expects to be able to unpublish a book such that it cannot be recovered or reprinted after copyrights expire
Government do and it can be done: https://en.m.wikipedia.org/wiki/List_of_books_banned_by_gove...
“Where the controller has made the personal data public”
Again, GDPR does not protect you from yourself: it can’t! And we don’t want it to, we don’t want a surveillance state that bans public information and removes control, nor do we want people to censor history after the fact, right? As has always been the case, privacy needs to be considered before publishing information about yourself, not after.
Banning books is different from what I suggested, that’s the government deciding something is illegal, not the author changing their mind. Banning books also doesn’t cause them to be forgotten. It’s not a great example of what @BoppreH is wishing for, wouldn’t you agree?
How? 10 years ago one could not expect that all of the internet is used as training data for an AI model.
The processor has to have a legal basis for processing your data even if it is publicly available. One could argue that there is some kind of consent if the data is publicly available, but consent can be revoked.
https://en.m.wikipedia.org/wiki/Right_to_be_forgotten
> The right to privacy constitutes information that is not publicly known, whereas the right to be forgotten involves removing information that was publicly known at a certain time and not allowing third parties to access the information.
I think you could make a case under GDPR where making the model is data processing and the BoppreH could demand to be erased for the dataset. Why is he in the dataset in the first place? Why is anyone? Am I in it? Aren't this legitimate questions?
I’m not arguing that all publicly available information implies consent (it does not), I’m simply repeating what @BoppreH already said : that he gave the consent in this case. The reason we need GDPR and other privacy laws is primarily for cases when someone else decides to publish your PII. This is different, this is a case of the user publishing their own PII and allowing it to be public for a long time.
> How? 10 years ago one could not expect that all of the internet is used as training data for an AI model.
Hehe, are you joking? You must be young because people have been expecting this information explosion and archival for a hundred years and more, and people were talking about using the whole internet for AI training ever since the internet and neural networks were invented, complaining that we didn’t have the computational power yet, more than 50 years ago. Archive.org (saving the entire internet) and Google (indexing the entire internet) both launched almost thirty years ago. Ten years ago there were already debates that could stand in for this very thread.
The AI model is completely irrelevant here, and it has been from the very first comment. AI isn’t @BoppreH’s problem, his problem is that he willingly published his name on the internet and now doesn’t want people to know it, via Google or any search index. The AI did not glean any PII about him that Google and Bing and multiple other sites hadn’t already indexed.
As to how … Well, there are sayings out there older than dirt that clearly discuss how to keep your things private. The so-called “New York Times” rule is pretty well known, but is just one example in a class of such general advice that is probably as old as the printing press, and comes in many variations. Don’t do or write down anything you wouldn’t want printed on the front page of the New York Times. If it’s private, keep it private.
* BTW I’m sure you saw that above the WP sentence you quoted, there was a lot of text that broadly if indirectly supports what I’m trying to say. The right to be forgotten isn’t the right to be forgotten from all online existence, it’s not something you can use to force all published information about you for all time to disappear at everyone else’s expense, it’s a right that people can sometimes exercise to fix specific mistakes, and it gives specific examples such as revenge porn. And again, most of the examples involve someone else publishing your info without consent. Wishing the right to be forgotten gave us editorial power over history is extremely problematic, as was stated right on that Wikipedia page.
He consented and if this is the legal basis, he has the right to withdraw the consent at any time without reason. The data then has to be removed. This is done by search engines on regular bases, e.g. DMCA Takedowns.
> Hehe, are you joking? You must be young because people have been expecting this information explosion and archival for a hundred years and more, and people were talking about using the whole internet for AI training ever since the internet and neural networks were invented, complaining that we didn’t have the computational power yet, more than 50 years ago
To average Joe this is still something out of the realm of science fiction. They are still wondering if the phone is listening to them if they get ads of products that they are talking about.
I understand your point and I am ambivalent about both sides but in doubt I would opt for the strong privacy side. Ea-nasir for example could not have dreamed about what happened to the complaint letter [0] and this is not something New York Times worthy at the time the complaint was written.
[0] https://en.m.wikipedia.org/wiki/Complaint_tablet_to_Ea-nasir
From whom?
Your claim there is neither broadly true according to both articles you quoted, nor is it particularly practical. And the practical part is the part you are consistently ignoring here. Theoretical rights are useless if they can’t be realistically exercised. This is no longer something he can request of any one single company, the data is presumably all over the internet, with no reason to believe GDPR even applies since GDPR has no jurisdiction over non-EU sites that don’t target EU users and don’t do any specific business in the EU. You might be able to request something from Google maybe, but good luck and Godspeed with Baidu and Yandex and any site outside of EU jurisdiction.
DMCA takedowns target specific content, they are used by copyright holders to assert rights to a given video, song, image, etc. DMCA takedowns have not been used to erase years worth of random PII connected to someone’s username on the internet, nor has GDPR, nor has a right to be forgotten law. And, as everyone knowns, DMCA takedowns are sometimes completely ineffective because it’s hard to put the two million cats back in the bag.
The most troubling part of this thread to me is multiple people here asserting the existence of seemingly absolute rights without even a passing acknowledgment or thought to the ramifications and what negative consequences it would have if people started demanding editorial power over the entire internet over casual, consensual, and non-damaging PII. It might not be apparent from my comments yet, but I’m a firmly in the camp of privacy advocates, I think the GDPR has done wonderful things, and yet I see this argument as both lacking historical perspective and being completely unrealistic. I don’t want to live in a world where it’s illegal to record history and everyone can erase minor things they regret long after they explicitly agreed to publication. I’m perfectly fine with the existence of rights to undo certain mistakes and wrongdoings, but generally speaking I think it’s a mistake to even want the ability to revoke any non-threatening public information at any time, completely aside from the fact that that is not actually broadly available in any country today.
> The most troubling part of this thread to me is multiple people here asserting the existence of seemingly absolute rights without even a passing acknowledgment or thought to the ramifications and what negative consequences it would have [...]
There are absolute rights. Absolute human rights, everyone has them, practical or not. Even if you can't enforce them. Protection of personal data is such a right.
Sorry for all the pathos, but I firmly believe it. I think this is the core of our discussion. Maybe our fundamental disagreement. I understand your point of view but I weight other aspects stronger and you other aspects.
So yeah if you’re talking only abstractly and intentionally ignoring the practical then we’re definitely talking past each other a bit. It’s hard to discuss rights that can’t be enforced and aren’t part of a specific legal code; normally if it isn’t law and can’t be enforced, it’s more of an idealistic goal than a right. GDPR is entirely based on “reasonable” precautions, it does not and cannot demand anything impractical of companies that haven’t violated the law. Imagine you’re giving @BoppreH actual advice about what to do, and tell me what he can realistically do that won’t cause him months or years of work and frustration, or ultimate failure to revoke and protect his published PII.
I should be in charge of my PII. I am in charge of my PII. What does “in charge” actually mean though? There are two specific issues here in this case that make the question of who should be in charge a moot question. One is that @BoppreH was in charge of his PII and chose to publish it. That is control over his PII that he exercised. His actual stated wish was for GPT-3 to somehow guess that his PII found on Google should not be indexed by GPT-3. A human wouldn’t do that, so why should a machine? My issue here actually does go straight to your question: if someone revokes intentionally published PII, that can cause harm to others. Imagine you write a biography and in it in a chapter about your best friend BoppreH, who agrees in writing to be featured in your book. You publish the book and six months later your friend says, “no, wait, I don’t like that anymore, I revoke it and I want all mention of me retroactively erased: I have a right!” What can you actually do? This could cause loss of income for you and your publishing company, distress and loss of friendship, lawyer fees, reprinting, destruction of unsold stock, costly time spent editing and renegotiating and redistributing. I’m imagining just a few of the many bad things that could happen with a book, but there are many analogous issues, and some unique problems too, with deletion of data online.
Have you considered the possibility that @BoppreH may have in effect signed multiple contracts stating that he agrees to publish personal information and not hold the publisher liable for it, or demand that it be taken down? (This is not an abstract question, this is what GitHub’s license states, for example, and others here pointed out that some of his PII was on GitHub.) How do you reconcile a so-called right to revoke PII with consensual contractual agreement to publish this PII? You’re arguing that this right to revoke should be allowed to override signed contracts without cause? There are so many legal & practical problems with that idea, I don’t know where to begin.
The other issue is that once information goes public, it cannot be reasonably contained. The transition from private to public is a one way street, it always has been, and it has never gone the other way, by and large. This is in fact codified into law in many ways (securities laws, for example, specify actions to take when insider information is leaked), and the fact that the publishing of information can’t be taken back has been the default assumption for humanity for a very long time.
The idea that somehow you can revoke something that’s published and public is a very new idea. The idea that it can be for any reason at any time even if you previously agreed to it is a very naïve idea that doesn’t yet exist in practice. It’s a good thing that there are specific exceptions, but in general unpublishing on a whim isn’t realistic. We already know that media companies haven’t been able to stop movie or song piracy with DMCA nor copy protection schemes nor fines & lawsuits, why would we think unpublishing personal information from the internet is even possible? Generally speaking, it’s not.
Another early result in DDG is a profile on deviantart, which you may not want linked to your professional identity (or maybe you do).
Your steam community page has a list of hundreds of games you own.
Fundamentally your problem isn't as much that your github account links to your name, it's that you use the same identifier across the web, one that isn't common like "neo", from "interesting" sites like deviantart to more normal ones like ubuntuforums.
You've removed your CV from your website, but it's still in internet archive. And do you really want your CV hidden? You've gota a good portfolio of work on the internet.
To me, the lack of separation of your names is far more of a challenge to your anonymity - especially when you call it out by posting something like this under that nome-de-plume. You have multiple aspects of your life that you can present in different ways, choosing a single unique nickname links those together, is that what you really want - even if your real name wasn't connected to it?