Hacker News Reader

Comment by astrange | Hacker News Reader

> No current employee of a corporation can promise that data collected today will not in the future be used for any particular purpose.

Yes they can, because data privacy laws forbid collecting data for one purpose and then using it for new ones without notice or consent.

View on HN

This means that, possibly, I can sue if my data is misused: it does not prevent its misuse. It doesn’t offer any protection if the law changes, or any real protection against constant TOS changes, etc.

That argument is unreasonably strong. How many other illegal things are you worried about in case they become legal again later?

Quite a lot when it comes to privacy, actually.

Depends on where you are.

In the US, privacy policies change every week. And they don't gather consent - they just say "you're using our thing? Okay you consent". They'll send you an email with their new privacy policy. Which you don't read, because it's awful to read. And even if you do read it, it doesn't matter, because it's completely fake. The policy doesn't tell you how they actually use your data. It just says they can use any data for any purpose.

That would be meaningful if there were ever any enforcement.

https://cppa.ca.gov/announcements/

And of course the EU does nothing but fine tech companies bazillions of euros for GDPR violations.

If they keep having to do it the fines are obviously not high enough.

The fines keep increasing for repeated violators, up to 4% of global revenue. The idea is to force companies to change behaviour, the fines getting larger is the mechanism for it, they might not be high enough yet but keep violating the law and it will definitely be high.

Having to do it? Why would they want to stop?

The entire point of laws and fines is to get bad actors to NOT DO THE THING IN THE FIRST PLACE. That is literally the entire point of the exercise.

The point of the EU's tech laws is to find American companies violating them so they can charge them big fines. They're not going to be satisfied, they just want to fine them. This is called protectionism.

But it does lead to privacy protections.

(This is similar to how Americans have a religious belief that "regulations are written in blood" and so think it's immoral to ever undo any safety regulation; as a result their building code bans anything anyone has ever thought was bad with not a moment spared for cost-benefit analysis.)

Do you honestly expect a company like Anthropic to take data privacy laws seriously? I do not.

Have you seen GDPR penalties? It's like they fine you 300% of your revenue and then have all your children executed by firing squad.

Anthropic in particular is a PBC founded by weenies who thought the other labs weren't being safe enough. I believe up until a few months ago they never used any user data for training, even if you opted in.

> Have you seen GDPR penalties?

No, i would have love to see them (Hello Microsoft, Google) but, no.

Google has been fined ~$180 million so far.

https://en.wikipedia.org/wiki/GDPR_fines_and_notices#Fines_a...

Plus this $377 million one.

https://www.cnil.fr/en/cookie-regulation-cnil-continuing-act...

And we can be 100% certain your data is safe because nobody ever breaks the law. /s

How would you even know your data is being used in a way you didn’t authorize?

Reply on news.ycombinator.com