Hacker News Reader

Comment by yreg | Hacker News Reader

GDPR is rather vague and perhaps it might be an intended feature.

They could:

1. Set up a content filter that filters op's name from the output. OpenAI would still need to keep record of the name, exposing it to leaks.

2. Remove the name from the dataset and retrain the model, which is obviously infeasible with each GDPR request.

I expect there are other instances where it is impractical or impossible to completely forget someone's data upon a request. Does Google send people spelunking into cold storage archives and actually destroy tapes (while migrating the data that is not supposed to be erased) every time they receive a request?

View on HN

"obviously infeasible" is the interesting part. A) the law doesn't care if its infeasible or not. If someone actually challenges GPT3 on this, and GPT3 loses, then these kind of models are obliged to find a way to comply with the law, or stop what they are doing - technical difficulty is not much of a defense. Also B) I think that there is probably a way to do this with either clever training data or algorithmics, which doesn't require retraining of the whole model. We need a precise theory to explain what these models are actually doing anyway. There are so many applications where we need more than a vague or probabilistic response.

>the law doesn't care if its infeasible or not.

Sure, option 3 is to stop offering the products. But simplistically, I expect companies to obey these laws when it is feasible. I'm not surprised that they shrug it over when they have no idea what to do. As you say, when (or if) it comes to a trial, the interpretation of the law for this particular case will be clarified.

I think part of the reason why lawmakers made GDPR so vague was to not outright ban things which didn't even cross their minds (like GPT models), but instead let a court evaluate these cases in context down the line.

Of course it's not the best situation, especially for small businesses which cannot risk working on a product that might or might not be illegal.

Most likely, they don't keep any backups with user data longer than a short threshold, e.g 60 days. This is pretty common practice.

Reply on news.ycombinator.com