Hacker News Reader

Hacker News

Comment by Jmcdd | Hacker News Reader

Full thread

Jmcdd

Surely anyone bothered by this can just request that their data be nuked? Thanks GDPR.

View on HN

I wonder how GDPR will apply to models trained on user data. What does deleting user data look like in that case?

I would assume deleting the model if you can't unwind specific user data used to evolve the model.

You only have to delete data that is personally identifiable.

Can you prove it isn't personally identifiable?

Can you prove it is? Many many things can be personally identifiable given enough resources and associated data, so it's unclear whose burden of proof it is, especially considering sibling comment mentioning a GDPR exception to delete data if it causes sizable damage to a business.

I work at Microsoft Research in the UK. A few weeks ago we had a lecture from a lawyer on exactly this subject. Her main point was that GDPR gives people the right to request their data be deleted but it gives companies the right to refuse if it would cause unreasonable damage to their business. Until a case makes its way through all levels of the court system, nobody knows how this collision of rights will be interpreted.

I suspect someone would have to show that the model trained on their data revealed something about them in a practically harmful way.

> A few weeks ago we had a lecture from a lawyer on exactly this subject. Her main point was that GDPR gives people the right to request their data be deleted but it gives companies the right to refuse if it would cause unreasonable damage to their business.

I guess it still needs to be litigated, but the question on my mind is: Does that right of refusal only apply to the model, or also the data that trained it. If it applies to the data, the regulation is pretty useless, since anyone could avoid the deletion requirements by training models on it, if it doesn't I think the use in the model takes care of itself. At some point they'll need to retrain, and then you're data won't be there.

It is an interesting thought.

I feel though that the point of the GDPR was to protect our personal data held by companoes, not to prevent companies using our personal data to make money.

So if a company uses your personal data to train a model (lets assume you willingly gave your informed consent for the time being), and then they delete your data after they have trained their model, does that model contain your personally identifiable inbformation? I'd argue that it does not - the model is just some weights, right? So 0.6 34.291, 0.0016 - is that you, mum?

.... but having just said that, I do wonder what happens if you run the model in reverse, like the deepdream stuff did (1). Could it re-generate PII (or rather generate "nearly-PII") purely from those weights?

1 - https://en.wikipedia.org/wiki/DeepDream

Will the GDPR still apply in the UK after it leaves the EU?

AIUI, the GDPR by itself doesn't apply to the UK (or any other EU member state in particular). Instead, the GDPR forces member states to enact laws that implement those rules.

This means that, after Brexit, the GDPR implementation laws will still be law in the UK. Depending on the outcome of the Brexit negotiations, the UK might or might not be in a position to repeal those laws at their own discretion.

the key word is General Data Protection Regulation. Regulations are law, and apply directly, no local implementation needed (except for "interfaces", e.g. in the case of GDPR changes to existing laws to clarify how they interact with GDPR and to make exceptions GDPR explicitly allows the states to make)

Directives are the ones that only direct the states to enact laws implementing them.

Ah awesome. Thanks for the clarification.

But in the case of GDPR the UK has also implemented the DPA 2018 which implements GDPR.

Yep, I think the current understanding is that all EU laws will still apply - they kind of grandfather them in - with the understanding that they could repeal them at a later date (as they can for any law).

As with everything else Brexit related, technically the UK won’t be bound but practically it will have to choose between following one of the three major economic blocks — EU, USA, China — or struggling economically because they refuse to believe the Commonwealth is not on that list.

Yes. Though the British government will be able to then amend regulations, they say the intention is to basically keep it.

http://www.blplaw.com/expert-legal-insights/articles/gdpr-an...

Better do that before Brexit, when GDPR is (currently) supposed to stop being applicable to British citizens.

If Brexit ever happens... so many contradictions in what folks think about it / want from it and what it is / what deal anyone can actually make.

It will have to happen - the vocal leavers would create an absolute shitstorm if the government even considered reneging on article 50. Even if we weren't in a situation where the leadership of both relevant parties is committed to Brexit it'd be political suicide.

As of today it's looking more and more likely that the separation will be in name more than in function though.

> As of today it's looking more and more likely that the separation will be in name more than in function though.

its worse than that. Its what nobody wants: tied to some parts of the EU, with no say whatso ever. In the case of the finance industry, it'll be 60 days notice to comply or access is withdrawn. Brilliant for the EU as it means that it can start creaming off the finance industry and the vast sums of money it generates in tax.

It will happen automatically, by law in march. That is what article 50 does.

The battle now is, what form does the divorce take, messy and sharp (no deal, where the UK has no access to anything without lots of barriers) or really painful, where we loose access to lots of things, but retain access to a few key things.

There is a very remote chance, very remote, that a referendum will take place, but unless article 50 is rescinded it will be meaningless, as we will leave the EU automatically at the end of march.

It will remain part of UK law

Unless they decide to include it in the great repeal ...

No. GDPR has been written into UK legislation and will continue as-is.

I’m a Remainer, but let’s concentrate on being alarmed about the real impacts.

Is it? EU laws are written into our own national laws, and so to assume UK citizens won't be subject to GDPR (or requirements akin to it) is perhaps not sound.

Reply on news.ycombinator.com