hhmx.de

Föderation EN Mo 29.04.2024 18:40:51

This is gonna be fun: OpenAI runs afoul of the GDPR because it generates false information about individuals and they don't have full access to the data that pertains to them.

From the article:

> Maartje de Graaf, data protection lawyer at noyb: “The obligation to comply with access requests applies to all companies. [...] It seems that with each ‘innovation’, another group of companies thinks that its products don’t have to comply with the law.”

noyb.eu/en/chatgpt-provides-fa

Föderation EN Mo 29.04.2024 19:00:39

@gabrielesvelto I think it's actually very funny that the excuse of "we can't really change the model after it's trained" is now biting them in the ass

Föderation EN Mo 29.04.2024 19:04:50

@brazmogu @gabrielesvelto “What do you mean, I’m liable for this raging bull I dropped in the middle of a crowded street? It’s not like I made the bull!”

Föderation EN Mo 29.04.2024 19:40:42

@brazmogu @gabrielesvelto Guess they'll have to retrain the model then, right?

Föderation EN Mo 29.04.2024 21:34:08

@jernej__s @brazmogu @gabrielesvelto ... sucking power and water like a tiny country while doing it. For every request. They should be closed down, but it's not illegal to consume so much resources if you're paying for it.

Föderation EN Mo 29.04.2024 22:26:05

@jernej__s @gabrielesvelto there are a couple of different answers to that
1. they can, but they'd have to retrain the model every time it fucks up, like when it started giving out people recipes for IEDs
2. they can't, really, because it's a language model, not a fact model; it can still stumble into an untruth
3. if they can, then they can remove all the copyrighted material from their training base, and there goes their model
4. they shouldn't, because it wastes a fuckton of water

Föderation EN Mo 29.04.2024 20:48:16

@gabrielesvelto "but we came up with a thing that makes it technologically impossible to comply!!1" "sounds like a you problem?"

Föderation EN Mo 29.04.2024 21:26:55

@gabrielesvelto we asked ChatGPT 6SE and it said that GDPR compliance is a matter of interpretation and suggested that we pack the US Supreme Court with AI-friendly justices 🤪

Föderation EN Mo 29.04.2024 22:15:16

@airshipper Last I heard, GDPR was a European regulation, not a US one

/ @gabrielesvelto

Föderation EN Di 30.04.2024 22:37:27

@airshipper @mjgardner If they do business in the EU, GDPR is valid for them, even if they are an US company.

Föderation EN Mi 01.05.2024 01:21:13

@mrdk Thanks guy, but that’s going farther afield than @airshipper’s goofy 🤪 intent.

Muting now

Föderation EN Mo 29.04.2024 23:17:04

@gabrielesvelto @jackyan given the accounts making up stuff about you last week this might be of interest?

Föderation EN Di 30.04.2024 00:01:54

@SimonCHulse @gabrielesvelto Oh wow, thank you, Simon, this is of extreme interest.
Still a minimum of one article per day getting indexed by Google.

Föderation EN Mo 29.04.2024 23:56:10

@gabrielesvelto No one will stand up to the company or the tech. They'll cave, they all do.

Föderation EN Do 02.05.2024 18:53:33

@gabrielesvelto

It is not only GDPR but also California CPRA and other regulations around the globe. Right to delete information, right to know who your data was shared with, right to correct information, right to opt out, and so forth. There are a whole bunch of regulatory violations happening right now, it appears to me.

I also think this is a problem for most Web3 applications. Delete a transaction from blockchain? I don't think so. Remove a document from IPFS? Nope.

In my opinion all of the big AI and Web3 vendors should be acknowledging regulatory liability, but I don't think they are.

Föderation EN So 05.05.2024 04:20:22

@patrick_townsend @gabrielesvelto The problem isn’t IPFS, it’s putting data on IPFS that might need to be deleted. IPFS should only ever be used for:

  1. Publicly accessible data that will never need to be taken down, such as open source software releases and archives of public mailing lists.
  2. Encrypted data that can be deleted by deleting the encryption key.

Föderation EN So 05.05.2024 20:16:28

@alwayscurious @gabrielesvelto

I would agree that IPFS should only be used for these things. Unfortunately, it has already been used to distribute malware and CSAM material.

If I understand GDPR and other data regulations correctly, the right to delete personal data does not apply only to personal data that you personally store. As far as I know IPFS does not have a delete function and would prevent anyone or any organization from complying with a legitimate GDPR delete request.

I like IPFS technology, but I would not want to bear the legal or reputational risk associated with data regulation non-compliance.

I would like to be wrong about my interpretation. Open to any thoughts you might have.

Föderation EN Mo 13.05.2024 01:08:31

@patrick_townsend @gabrielesvelto Usual disclaimer: I am not a lawyer and this is not legal advice.

I don’t think a GDPR request to delete one’s information from e.g. the Linux git history would work. Kernel developers have a stronger legitimate interest in keeping that data (repository integrity, IP ownership tracking) than the requestor has in its removal. This works because the Linux git history can only be appended by trusted contributors, so it does not include malware, CSAM, or other illegal material.

Any site that allows data to be uploaded by untrusted third parties is much more complex and I would consult with a lawyer before running one.