Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Europe is scaling back GDPR and relaxing AI laws

theverge.com

Post reply on HN
Print view View original

281–290 of 1001 posts

Re: Europe is scaling back GDPR and relaxing AI laws

#281

Post by xvector »

zrn900 wrote: post #243

While they are at it, the EU should also correct another sh*tty law: The Digital 'Resilience' Act (or whatever it was) that holds the Open Source developers responsible for unlimited fines for security issues in their projects. The Open Source community fought it, and thought that it won a concession, but it really was not a concession: The Eu commission will 'interpret' the law. So it will be interpreted politically…

Big players don't want this either, we rely on open source software and frequently contribute back

This is just another dumb EU reg that hurts everyone

Re: Europe is scaling back GDPR and relaxing AI laws

#282

Post by sojsurf »

hdgvhicv wrote: post #123
cm2012 wrote: post #91

This is such an important change for Europe. I've worked with 100+ start-ups as a consultant, and I've talked to EU ones who have been strangled by some of the regulations.

What were they doing with user data?

Probably using off-the-shelf analytics because rolling your own analytics takes time away from solving the central problems your users are paying you for. No one is _using_ the data. It's often not even really PII except that GDPR's net is incredibly broad.

I have not seen GDPR reduce the amount of data people track. It's just resulted in piles of cash being burned on lawyers' advice to make sure the company has as little GDPR-related liability as possible. Subprocessor agreements, updated Terms and Conditions, etc.

Some good has come out of it, such as less backup retention, and some basic data breach plans, but a lot of it is theater.

Re: Europe is scaling back GDPR and relaxing AI laws

#284

Post by oezi »

Anonymization unfortunately is completely broken under GDPR. In principle it providesa clean path for personal data to become usable outside of the restrictions of GDPR, but in practice it turns out to be impossible based on current definitions.

The key issue is that anonymization under GDPR requires that a link to a real person can never be re-established even considering the person doing the anonymization. Consider a clincial study on 100 patients and their some diagnostic parameter such as creatinine or H1bc which was legally collected using consent and everything. Lets assume we would like to share only the 100 values of the diagnostic without any personal data. It would seem quite anonymous, but GDPR would put a simple test if anybody using reasonable efforts could re-establish an identity. And sure the original researcher can because s/he has a master file containing the mapping. So the data isn't anonymous and actually can never be anonymous.

Re: Europe is scaling back GDPR and relaxing AI laws

#285

Post by impossiblefork »

johndhi wrote: post #280

Protecting users in the bargains we strike with big tech is a worthwhile and noble effort, but privacy law has generally woefully failed to do this. Millions upon millions have been spent on cookie banners -- people are still arguing about them in this thread -- but there is almost zero benefit to this expense. The main thing that's good about this, IMO, is that fundamentally training a large language model and priva…

I don't see how training an LLM has anything to do with privacy laws.

It is perfectly possible to not train them on personal information, to remove or rewrite names, to remove IP addresses, etc.

Re: Europe is scaling back GDPR and relaxing AI laws

#286

Post by bigfatkitten »

lenerdenator wrote: post #274
recursive wrote: post #263

Earlier quoted context omitted.

Do Not Track was a spectacular failure. You can still turn cookies off in your user agent though.

It was a spectacular failure because the people who thought of it didn't stick to it.

In no small part because the people who thought of it (the browser makers) had a powerful commercial incentive to ditch it, because they are funded by advertising.

Re: Europe is scaling back GDPR and relaxing AI laws

#287

Post by betaby »

rckt wrote: post #270

I get that too many regulations is a bad thing. But when we talk privacy and personal data there should be no gray zone. It has to be black and white. When I see a stupid cookie banner I search for "Reject all". There's no some data that companies can collect and process without my consent, they just shouldn't be able to collect anything without me actively opting in. Business never respects anything, but profits. Se…

That cookie thing should a browser's default.

Re: Europe is scaling back GDPR and relaxing AI laws

#288

Post by jakub_g »

ChrisArchitect wrote: post #53

Related: Europe's cookie nightmare is crumbling. EC wants preference at browser level https://news.ycombinator.com/item?id=45979527

> European Commission wants browsers to manage cookie preferences instead of pop-ups on every website.

Better late than never, but it's insane it took them almost a decade to figure this out.

Re: Europe is scaling back GDPR and relaxing AI laws

#289

Post by pseudalopex »

legitster wrote: post #258
pseudalopex wrote: post #256

Earlier quoted context omitted.

> Imagine running a store, and then I ask you how many customers you had yesterday and what they are looking at. Server logs can provide this information.

Not for the amount of stuff on the web now that is client-side rendered.

Client side rendering means in practice clicking a product retrieves JSON and images instead of HTML and images. This can be logged.

Re: Europe is scaling back GDPR and relaxing AI laws

#290

Post by l-one-lone »

legitster wrote: post #124

Let me steelman the new proposal a little bit: You run a merch store. You want to share with your suppliers order data so that you can get the right number of sizes/colors/etc. Is this PII under GDPR rules? Technically, yes! Not only is there information on gender, but also people's height and weight and maybe even family makeup. Does it make sense to call this data sub-processing? Eh? Maybe? (To my knowledge, I don'…

I think you don't understand the GDPR. The GDPR does not disallow the processing of personal data, nor does it disallow the sharing of personal data with suppliers or other entities in the supply chain. For example, if you run a merch store, it's perfectly OK to share the buyer's address with DHL or whoever does the shipping.

What the GDPR requires is that the user is informed about the processing and the suppliers used, and in some cases, provides consent to the processing.

The new proposal which suggests that pseudonymized data is not always PII is a different thing. It actually opens the door to a lot of new problems in my opinion. For example, with this new interpretation, big tech might question whether IP addresses are still personal data (which is something EU top courts had previously established)? What about cryptographically hashed values of your social security number (easy to break)?

Post reply on HN