Hacker News Reader

Comment by smsm42 | Hacker News Reader

> that it's not some big American cloud company but a relatively small startup in France

How it's any better? Small companies can be bought by big companies. French government is as capable of trampling over their citizen's privacy the moment they feel they need it as US government is. And putting a squeeze on a small startup is way easier than on a major cloud company (not that either is particularly hard). Also, OpenAI used to be an idealistic non-profit one day too, then it started to smell trillions and all that went of of the window.

> is not going to be nearly as capable as an off-device inference system.

I rarely need PhD-level research into my browsing history. I'm not going to solve millennium problems on my bookmarks. The tasks that I will realistically need are well within capacity of most very basic local models. Maybe they'd be a bit slower, who cares.

View on HN

>How it's any better? Small companies can be bought by big companies. French government is as capable of trampling over their citizen's privacy the moment they feel they need it as US government is.

It's better for Europeans because the company in question is European and so will not export their data to New Jersey. And because any success it has will presumably better benefit France and Europe.

> It's better for Europeans because the company in question is European and so will not export their data to New Jersey

There aren't many government institutions in New Jersey that would take a lot of interest in anything Frenchmen are doing. There are a lot of institutions in France that would be interested in anything Frenchmen are doing, if it contradicts what the French government wants to be happening. The main threat to citizen's privacy always comes from the government closest to them, the government overseas has its own citizens to worry about and pays much less attention to foreign citizens on foreign land. There could be exceptions, true, but as a rule, if you look into New Jersey, you'd sooner find mass surveillance of American citizens than mass surveillance of the French.

Same goes for commercial interests. If I want to run targeted ads in New Jersey, I want to have profiles of New Jersey people, not French people. So buying data from France in New Jersey would not be a routine occurrence, but buying local data would be.

Let's not pretend that EU data laws are not far more stringent and actually enforced than whatever the US has. Like sure, the government with a jury decision may acquire some person's data. But it's not getting sold to whichever-random-company-offered-the-highest.

Also, some shady TOS is also not enough to override the law in the EU, you have much more protection as a user here.

> But it's not getting sold to whichever-random-company-offered-the-highest.

Nothing in GDPR prevents transfer or selling of personal data. True, there are hoops to be jumped to do that, both in terms of consent and documentation, but let's not pretend a lot of people would read the welcome banner and refuse to interact with a service because its legalese says "we'll sell you data and if you don't want us to, go away". Yes, selling the data becomes more expensive because you need to hire the lawyers to produce those welcome pages and regulatory compliance paperwork, but large corps have enough money for lawyers.

> Also, some shady TOS is also not enough to override the law in the EU

It doesn't need to override anything, as the law does not prohibit data collection or transfer. It only describes the hoops that need to be jumped to achieve it.

It certainly does. You need to weigh the users privacy with your interests and can’t just put them aside. Noncompliance leads to quite large fines. You can easily find examples of fines given.

The DPA’s are short on capacity, sure, and large corps will try to fight the fines in court. But to describe it as “just hoops whilst allowing everything” is unfair.

> You need to weigh the users privacy with your interests and can’t just put them aside.

Who said anything about putting them aside? There would be a process and highly paid lawyers confirming that selling user data is only for the user's ultimate benefit, as it allows to provide awesome services to the users, and it all will be outlined in a 100-page privacy policy which you will be sure to read on each site you use, wouldn't you?

> But to describe it as “just hoops whilst allowing everything” is unfair.

Can you quote me the place where GDPR prohibits this? Not says something like "weigh user privacy" and "take adequate measures" and so on - which can always be resolved as "we weighed carefully and we took measures and we decided selling the data was awesome and users love it" - but explicitly and unambiguously prohibits the practice? If you don't find it - that description is exactly what it is.

> How it's any better? Small companies can be bought by big companies.

This. I've come to view a startup as a company without a business model, doing everything to get acquired by a mega corp that will finally squeeze the juice out of the userbase

(The lack of a viable business model applies to some mega corps too)

Reply on news.ycombinator.com