Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Has anyone leveraged GDPR to overturn automated bans?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 77 posts

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#11

Post by kelnos »

Someone wrote: post #8
tyingq wrote: post #3

Earlier quoted context omitted.

There was a recent example with Google Drive where it explicitly disabled any way to appeal. I was able to reproduce the issue where it was flagging files that consisted of a single byte, sometimes followed by \r\n or \n. Here's the HN story: https://news.ycombinator.com/item?id=30060405 Screenshots of trying to "appeal" (Request a review) from when I recreated the issue show pretty clearly there is no human involved…

I don’t see how you get from Google’s statement “Was taken down for legal reasons and cannot be appealed“ to “no human was involved” .

I think the point is they, based on the file content, no human could have been involved in the decision. If there was a human involved, the files never would have been flagged.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#12

Post by SAI_Peregrinus »

kelnos wrote: post #11
Someone wrote: post #8

Earlier quoted context omitted.

I don’t see how you get from Google’s statement “Was taken down for legal reasons and cannot be appealed“ to “no human was involved” .

I think the point is they, based on the file content, no human could have been involved in the decision. If there was a human involved, the files never would have been flagged.

You're assuming the human both has agency, and gives a damn. It's more likely the human just rubber-stamps all bans, to get their KPI of number of appeals processed per day up!

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#13

Post by foxfluff »

SAI_Peregrinus wrote: post #12
kelnos wrote: post #11

Earlier quoted context omitted.

I think the point is they, based on the file content, no human could have been involved in the decision. If there was a human involved, the files never would have been flagged.

You're assuming the human both has agency, and gives a damn. It's more likely the human just rubber-stamps all bans, to get their KPI of number of appeals processed per day up!

They are required to have agency and give a damn. Of course, it is hard to (dis)prove that they actually do.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#14

Post by CodesInChaos »

lambada wrote: post #2

From memory I believe FAANG etc all _claim_ that appeals you lodge are reviewed by a human. Now if you don’t believe them then you’d need to take them to court and show why you think that’s not the case. Which I guess means my question is why don’t you believe them and how likely is it that they are lying when they claim thy appeals are reviewed by a human?

I think the better question is what a "human review" entails. I assume they have some kind of "human review" in there, but no meaningful human review.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#15

Post by advisedwang »

GDPR Article 22 (the rule you refer to) also has exceptions:

> Paragraph 1 shall not apply if the decision...is necessary for...performance of, a contract between the data subject and a data controller

Which I can see applying as they probably have something in the ToS to enforce here.

It also allows automated decision making to comply with EU law. I don't know EU copyright law well enough, maybe Google has a responsibility to take down that data under copyright law and so this exception applies too.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#16

Post by saghm »

SAI_Peregrinus wrote: post #12
kelnos wrote: post #11

Earlier quoted context omitted.

I think the point is they, based on the file content, no human could have been involved in the decision. If there was a human involved, the files never would have been flagged.

You're assuming the human both has agency, and gives a damn. It's more likely the human just rubber-stamps all bans, to get their KPI of number of appeals processed per day up!

If the human doesn't have agency, then it's not really a "human review", is it?

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#17

Post by lmkg »

delroth wrote: post #6

Not speaking for my employer, but the actual quote from GDPR is: > The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her . Emphasis mine. This would not include the vast majority of automated bans. It's more meant as a way to prevent e.g. automated…

This is correct. The Article 22 rights are the most narrowly-restricted of any data subject rights granted by GDPR. It only applies to things that are a Very Big Deal, like prison sentences, voting rights, or eligibility for government services.

While not tested by the courts, there is a plausible argument that "similarly significantly affects him or her" might apply to bans that impact your ability to earn a living. So streamers getting banned from YouTube, or AdWords bans for businesses where that's their main source of revenue. Bans that are lower-stakes than that get harder to justify under Article 22.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#18

Post by gpm »

jeffbee wrote: post #7
tyingq wrote: post #3

Earlier quoted context omitted.

There was a recent example with Google Drive where it explicitly disabled any way to appeal. I was able to reproduce the issue where it was flagging files that consisted of a single byte, sometimes followed by \r\n or \n. Here's the HN story: https://news.ycombinator.com/item?id=30060405 Screenshots of trying to "appeal" (Request a review) from when I recreated the issue show pretty clearly there is no human involved…

Are you suggesting that Europe has established a fundamental human right to have Google provide free static hosting services?

No, they're suggesting that given that Google has chosen to provide free static hosting, Europe has decided they can't moderate it with purely automated systems with no appeals process.

This is like running a restaurant in the US, and not being able to discriminate by race. You're not required to run a restaurant, and certainly aren't required to run one that gives away free food, but if you are certain obligations come attached.

I'd also argue that your use of the phrase "fundamental human right" is misleading. Europe can and does require you do things for reasons other than respecting fundamental human rights. So does pretty much every other law making authority.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#19

Post by rat9988 »

saghm wrote: post #16
SAI_Peregrinus wrote: post #12

Earlier quoted context omitted.

You're assuming the human both has agency, and gives a damn. It's more likely the human just rubber-stamps all bans, to get their KPI of number of appeals processed per day up!

If the human doesn't have agency, then it's not really a "human review", is it?

It still is.

Re: Ask HN: Has anyone leveraged GDPR to overturn automated bans?

#20

Post by foxfluff »

delroth wrote: post #6

Not speaking for my employer, but the actual quote from GDPR is: > The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her . Emphasis mine. This would not include the vast majority of automated bans. It's more meant as a way to prevent e.g. automated…

I agree that it probably does not include the vast majority of automated bans.. but I'd prompt anyone interested to read the relevant guidelines to understand what might be in scope as far as legal effects or "significant effects" are concerned; it goes well beyond profiling by authorities, and commercial data controllers are far from exempt.

One example of a legal effect is cancellation of a contract. Examples of significant effect include automatic refusal of an online credit application, and e-recruiting practices without any human intervention.

Advertising is in scope too: "For example, someone known or likely to be in financial difficulties who is regularly targeted with high interest loans may sign up for these offers and potentially incur further debt."

Pricing is in scope too: "Automated decision-making that results in differential pricing based on personal data or personal characteristics could also have a significant effect if, for example, prohibitively high prices effectively bar someone from certain goods or services."

Finally, there's an example of profiling reducing a credit card limit. "This could mean that someone is deprived of opportunities based on the actions of others."

Anecdotally, getting kicked out of my email account has had far bigger effects on me than being rejected my credit card application.

https://ec.europa.eu/newsroom/article29/items/612053/en

Post reply on HN