Hacker News Reader

Comment by sigmoid10 | Hacker News Reader

There are just more regulations to comply with before a release. OpenAI's new Deep Research tool wasn't originally available in the EU either, but it was released less then a week after it came out in the US. Since the EU is a gigantic market with a lot of buying power and this release makes a strong case for people to switch over from competitors, I doubt it'll take long.

View on HN

> There are just more regulations to comply with before a release.

If you do collect personal data and do funky stuff with it.

Another approach would be to not collect that personal data until you have the right process in place, and basically be regulation-compatible out-of-the-door on day one.

Even if you don't collect personal data, you need to comply with regulations to document properly the fact that you do not collect personal data.

If your organization truly don't collect or process any personal data then no, you don't have to say anything as for example GDPR doesn't even apply to you in the first place. Or are you thinking about a different directive than GDPR perhaps?

The definition of "personal data" is so wide that it is impossible to provide any web service without collecting some form of "personal data".

If all you have is an apache web server with the default configuration serving fully static HTML / CSS page without any script tag, you already might need a DPO and complete some documents.

> The definition of "personal data" is so wide that it is impossible to provide any web service without collecting some form of "personal data".

Just because Apache by default collect and stores IPs doesn't mean it is impossible to provide a web service without collecting personal data? Disable the IP collecting, and even the default configuration wouldn't need to follow GDPR as it again doesn't even apply.

Is there something else in Apache that collects personal data by default? If you're unsure what "persona data" really means, https://gdpr-info.eu/art-4-gdpr/ has the definition.

Not sure how HTML/CSS is relevant, it shouldn't depend on what content you're serving.

All that requires additional active effort to fight having access to any data. The more complex your infra the harder it becomes to not having to do paperwork. Include a reverse proxy, and a CDN to the above and the chance of you not having access to any "personal data" is really really close to 0 unless you spend significant engineering resources triple checking everything. Even then, if you wanna be safe you better have the paperwork ready in case you forgot something. In the example above, I hope that you would not have stopped at checking the apache configuration as I am sure you are fully aware that there are multiple log levels at the OS level that need to be tweaked as well.

This is of course despite the fact that you clearly have 0 ill intent and that none of these "personal data" can really be used for anything bad.

The mention HTML/CSS is just to make it clear that no additional data collection can happen through javascript tags (Google analytics, or any other alternative), or useful third parties. It makes total sense that if you dare use a bug tracking software, you should definitely pay hundreds of euros per month to hire a proper DPO who will handle all the paperwork or risk being exposed as the mental lunatic that the EU commission believes you are.

> All that requires additional active effort to fight having access to any data

I agree that it requires additional active effort, I'm not arguing against that. I don't agree with your original point that it's "impossible to provide any web service without collecting personal data", and it would seem you no longer agree with that either.

> It makes total sense that if you dare use a bug tracking software, you should definitely pay hundreds of euros per month to hire a proper DPO who will handle all the paperwork or risk being exposed as the mental lunatic that the EU commission believes you are.

If you willy-willy use bug tracking software that is needlessly collect and/or process EU individuals personal data, then yeah, you need to follow the regulations in the region you operate in.

If the collecting/processing actually serves a higher purpose (for your business and otherwise) then again, makes sense you need to follow the regulations.

> it would seem you no longer agree with that either.

On the other hand, you pretended that fixing that apache configuration was somehow "all I needed to do" to be compliant with EU regulations. We proved that this was wrong, and despite your best effort you are still unable to give a proper list of everything I need to do. You are unable to do so because it is virtually impossible; no matter how thorough you believe you are, you might still be missing an element you don't know well enough. To be safe the only path is to accept the fact that you will need to access personal data, even if that's not your purpose, nor if you do anything with them. The additional paperwork and needless effort are mandatory.

This in turn explains that regardless of what the Grok3 team really does behind the scenes; they DO have additional work to complete to be able to release their product in Europe, and that might explain the delay.

> If you willy-willy use bug tracking software that is needlessly collect and/or process EU individuals personal data, then yeah, you need to follow the regulations in the region you operate in.

I am willing to use whatever error tracking software you suggest. My criteria are simple: I might have JS errors I don't know about, please give me enough information to fix the underlying issue when that happens, without requiring me to fill additional paperwork.

My whole point is that the definition of what constitutes "personal data" is so wide that such a tool does not exist.

how do you store chat inputs without collecting personal data?

That's possible in general but not for this application; a chat interface to an LLM isn't very useful unless you can tell it whatever you want—including GDPR personal data—and then pick up the thread of conversation later.

It is kinda possible to do store that in browser, but as I've been finding with my own browser-based front end for the API, the browsers seem to clear this data a bit more than one might expect.

Or at least, Safari on Mac clears it.

When regulations become sufficiently burueacrafied it's extremely easy to accidentally violate them doing completely normal things. As a really random example, in California when you operate a foodcart it's not enough to just keep your area and wares in sanitary condition, instead you need a dish washing bin of a minimum of exactly 'x' inches 10.5 IIRC.

A guy who was just ensuring he was preparing clean healthy food, keeping everything sanitary and all that might assume he was naturally obeying all regulations. But that assumption can cost one a big fat fine (leading to fun scenarios like a food cart vendor needing a compliance legal team), and given Musk's relationship with the EU - they'd love to crucify him him on any possible technicality they can find.

Right, that's true I suppose. But also, if you don't have a car for example, you don't need to think about the laws of how to legally drive a car, since it doesn't apply to you.

Similarly, if you don't collect nor process any personal data whatsoever, directives like GDPR doesn't even apply to you, so there isn't really any way (easy or hard) to "crucify" someone on violating that.

Reply on news.ycombinator.com