Hacker News Reader

Comment by schleck8 | Hacker News Reader

I think they've realized that privacy centrism creates an industry in which the EU can compete well, independently from the US and China. Or at least I hope so.

View on HN

Here's the issue. Google can use private data in the US to design a model such as say a personal voice assistant. It then deploys this model in the EU and then uses no EU private data either for training or running it live. Google can then use non-private data to adjust the model to the EU market.

A company in the EU has to design the whole model with no private data which means they will have more difficulty competing with Google rather than less.

Poverty wages, child labor, ignoring emissions regulations, evading taxes, etc are all ways a company could improve margins and charge lower prices. That doesn't mean you want to legalize all of that just to compete in the global market.

Why do you put words in my mouth that we should legalize something when I said nothing of the kind? If this is how you react when someone points out flaws with a legislative approach then good luck ever getting one that isn't flawed.

It's ultimately going to be a race to the bottom if you allow companies who engage in those practices all over the world into your market on even terms. That's honestly what tariffs are for. Tax your citizens for engaging in commerce with companies that gain efficiencies through operating in ways that disagree with local values.

Couldn’t you use the same line of argument for tariffs on a vast number of imports? (Electronics, software, services, etc.)

It could even extend to most consumer product. e.g. Some obscure chemical compound for plastics is much more costly to produce in an environmentally friendly way, therefore it’s nearly all produced in the least regulated jurisdictions, therefore the compound and all derivative products have to be tariffed from those jurisdictions?

That would only work for the percentage of the European population who uses English as their primary language. It'd be damned near useless.

I already noted that and plenty of languages are spoken outside the EU aside from just English.

>Google can then use non-private data to adjust the model to the EU market.

Google can do everything a EU-only company can do. They can also do things a EU-only company cannot do. The reverse is not true. So at worst they'll be roughly as good and at best much better.

And why is the company EU-only? What X-only company is trying to compete with Google anyways?

No they won't.

There are regional differences between the same language that can be pretty severe, all the way down to the pronoun level.

So, no they can't.

I don't think you understand the point. Google can get all the same data as an EU company. They literally can do the same job an an EU company by simply not leveraging US data. The fact they have US data doesn't mean they are forbidden of getting EU compliant data like any other company.

They can also get US data that doesn't follow EU privacy requirements. So Google has two source of data they can combine into a better product.

The same goes for the US. but there are always regional differences, the bigger point is that people are not just a simple lookup table, they can adapt to a personal assistant that only understands an imperfect understanding by changing they way they speak to the device. People will do this without even being conscious of it.

Nope.

In the US the dialects are very similar and usually separated mostly by accent.

When dealing with different countries, entire groups of words do not mean the same thing because either (a) the language has changed, or (b) those things literally did not exist at the time the split occurred. Training an AI on Parisian French will result in an utterly broken experience for Haitian French and Cajun French.

My point is, that if you trained an AI on Parisian French, people in Quebec would be annoyed but could adapt to the differences if they wanted to use the system. People in southern Germany may be annoyed they have to speak high German, but they know it. There are very few people, if any, who only understand Cajun French and the issue.

Also, the biggest difference would be the pronunciation differences vs words being different. The word differences are easily modeled after any ASR, if the developer understands the differences and plans for it in their NLU models.

It just pours cement on industry~wide invention and replaces it with bureaucratic innovation.

Take it far enough and it will force new innovations in the fields of p2p and distributed networks, homomorphic encryption, etc.

It’s still profitable enough with data silos that this is not happening yet

Which invention/innovation couldn't have come out with better privacy laws? I guess Palantir? Do you have another example? Theranos?

It's not about what you can and can't do, it's the friction and cost associated with achieving compliance. I'm not against privacy protections, but having released digital products in Europe I can say that the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not.

I wonder if these kinds of discussions can be easier to have if concerns and critiques brought up were framed, from the start with an understanding that the cost to achieve and maintain compliance with the standard is a cost that gets paid either in money or work-hours (like for example SOC2 or PCI), that it can very tangibly halt non-compliance workloads and rollouts; instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy.

Understanding full well each standard solves different problems, for some of us in tech achieving compliance is a non-trivial amount of critical work and maintaining it similarly isn’t always something you easily drop everything and make happen in a day or two.

I think that’s 100% relevant and shouldn’t be immediately responded to as others have by assuming the relevance comes from a position of opposing the regulation or standing against user privacy

> instead of starting from a footing of assuming complaints are the cloaked dressing for being against user privacy.

The problem with this is twofold:

a: 'Most' (by loudness or other perception) of the complaints are known to be bad faith because they're coming from malicious actors like Facebook or Google which we know are against user privacy (since that's their business model).

b: You have to go out of your way to build a site that interferes with actual user privacy, for example by actively adding Google Analytics scripts or faux-CAPTCHAs, or actively demanding a real name and actively doing something about it if the user lies to you. (Technically you get IP addresses by default, but much like mailing addresses, obscuring these pretty much has to be the user's responsibility, since how else would you respond to them.)

So if you want a assumption of good faith, you need to be clear that you're complaining about the bureaucratic compliance overhead (eg having a particular data processing officer or whatever GDPR calls it), rather than about having to change your object-level service to eliminate spyware that you went out of your way to incorporate in the first place.

>> the cost of achieving GDPR compliance could very well make the difference between whether some companies can succeed or not.

Is this a bad thing? If we take privacy seriously then it shouldn’t be. We don’t see too many people fighting food or drug regulations intended to keep us safe because it might be costly for companies to comply. Maybe if a company cannot afford to comply with privacy regulation they should not be handling our personal information. I guess the reason it seems heavy handed in the tech/web world is that the barrier to entry started at next to zero and so much of what we put on the web is not monetised that any cost/compliance seems like a massive burden.

It is a trade-off which is not always acknowledged. It is not something that has 0 potentially negative consequences. And the competition and innovation that is stifled is often invisible (hard to see what could have been).

If you had less intervention with respect to privacy would there be more dynamic market-driven initiatives to fill the gaps? Would there be more incentive to develop technology that would be effective for privacy? I don't know.

Regulation is just hard because reality is complex and dynamic and regulation is often complex but not very dynamic.

> If you had less intervention with respect to privacy would there be more dynamic market-driven initiatives to fill the gaps?

This is hilarious. Because we had that, and it was lacking, to put it mildly. And some people still have that, in a way that's easy to compare (e.g. EU vs US, CA vs other states). For me, the results are in and obvious. Privacy regulations are the only thing that reflects the privacy externalities they might impose on society back onto them (and the shareholders).

I don't think it's necessarily a bad thing. Like you say, some regulations are needed, and we wouldn't want to allow unsafe cars on the road just because crash-tests are a barrier to entry for startups.

However it does serve as a moat for players with more capital, and that's something we should also be mindful of. For instance, maybe we could have some of the requirements scale and only kick in when a product meets certain thresholds in terms of numbers of users.

Theranos is largely agnostic to privacy laws; it came about due to shoddy medical regulation (specifically, while medicines and medical devices deployed to hospitals and homes are heavily regulated in the US, medical labs are not).

Also, arguably, shoddy financial regulation. In many countries, large private companies have to submit audited accounts to the regulators, and that would likely have raised alarms about the other problems with the business earlier.

Medical labs are heavily regulated. Theranos mislead inspectors by not showing them their entire lab.

Well, depends on how you define ‘heavily’. Theranos did hide a lab, but even beyond that they were depending on rules that allowed novel tests with very minimal oversight, provided they were done in a lab rather than in the field.

(Also, the regulator was presumably aware that Theranos made proprietary medical devices; it said so on their website. So, when they were shown a lab full of Siemens stuff, they should probably have asked about that. The problem here was really hiding in plain sight, and a competent, sufficiently empowered regulator would have caught it)

Theranos happened because the founders chose to lie. Plenty of laws were violated there. Medical regulation is not to blame. Investor hubris is.

Oh, sure! But the primary purpose of regulatory enforcement is to catch people lying, and Holmes was pretty effective at exploiting the weak points in the regulatory regime to avoid that detection.

What? Holmes (allegedly) misled people that were willing accomplices in being misled. There wasn't a regulatory failure, just investors that did not do their homework.

So beyond the investors, Theranos injured quite a lot of real people. They were actually doing blood tests, which largely did not work. With different regulation, some of this might have been averted (in particular, if the FDA was responsible for diagnostic labs, that might have helped).

Frankly, dodgy companies screw over the people unwise enough to invest in them every day. Theranos was unusual in that it also directly screwed over members of the public.

> while medicines and medical devices deployed to hospitals and homes are heavily regulated in the US, medical labs are not

Relatively speaking, this is as it should be. There are ways to cope with arbitrarily-convincingly fake lab reports (most generically, do multiple tests and compare them), whereas there's not a procedural fix for your X-ray machines occasionally going THERAC. Those measures generally aren't actually in place, but they should be anyway to cope with eg human error.

But the regulations actually in place on both patient-proximate and lab-based equipment are insufficiently stringent. (Annoyingly, they're also gratuitously burdensome.)

I shrunk down the interactive (with server-side or external functionality, like third-party comment-boxes) features my sites a lot because of being worried about GDPR, basically killing a small community and having a direct negative effect on users. The overhead/worry is real, even if as a consumer I'm a big fan of it. The toolchain/conventions may eventually catch up so that things are GDPR-compliant by default, but the downsides are still very palpable.

[ And even with all of those cutbacks, I'm still not really compliant on all my sites... (legacy software/not knowing what exactly my data server is logging/etc.) ]

But, as a direct answer to your question: I don't think many things in principle are impossible with the current privacy laws. But that doesn't mean it's not having a chilling effect.

Although I understand your worry about not being compliant, from my understanding it’s unwarranted. The intent of any enforcement action is not punitive but to enforce compliance. In other words small companies will be told “please comply” and given a chance to comply. It’s only if they refuse that action such as fines is taken. Maybe this has changed but at least when I was studying this a few years ago this seemed to be the case.

Alternately, it may counter incentives towards digital monopolies.

I’m not convinced that large amounts of personal data is required for search to work well, at the very least I’m not convinced the personal data must leave an individuals control.

We don’t see a lot of innovation in this direction as hyper personalized search seems to work reasonably well and the startup costs to compete are massive.

I’d love it if Duck Duck Go would let me assign priority to websites. Prefer Wikipedia, GitHub, StackOverflow over spammy copy cats. Maybe the ability to flag results as spammy copy cats would also be nice.

I'd love it if DDG didn't pointlessly ignore operands.

> may counter incentives towards digital monopolies.

Doesn't the cost of compliance inherently favor larger companies with better lawyers and deep experience in passing audits?

because that strategy has worked well so far?

Reply on news.ycombinator.com