Hacker News Reader

Comment by ithkuil | Hacker News Reader

Should it apply to the whole of Europe?

If openai perceives this to be just a problem for one 60M people country, not particularly known for tech enterprises, they may just shrug it off and close off service to Italy and call it a day.

That's exactly what they did. My plus account got refunded and blocked. VPN only allows me to access the free service, so no GPT-4 for me.

So unless other countries are following on and ensuring that tech giants are respecting privacy, this will just hurt Italian citizens and their ability to compete globally.

View on HN

Well, only Italy is complaining for now, but it applies to the whole EU.

At least some of the big companies take this seriously, because I've worked in consultants and seen it. It would be completely reasonable for OpenAI to be more private in the paid models - make the weights readonly, encrypt conversations, allow permanent deletion.

For the free models, I'd find it OK to train on the input, but GDPR says users should be able to request data deletion - not sure how viable that is for LLMs, where training frons scratch regularly (without the requested deletions) is probably expensive as fuck.

The internet has been a wild west with lots of privacy abuse, it's good to see some rules and enforcement!

Fwiw I used to work for large ML models for a well know big Ads company and we did indeed made sure to retain all the models on all historical logs within a time bound after users have requested for their data to be deleted. This predated GDPR.

It was expensive but we had to retrain models frequently anyway because of other reasons so this just added a more strict cadence and time bound checks but didn't really inflate costs dramatically

AFAIK training on API is opt-in, training on the consumer interface is opt out. And one must also say that there are enough levers in the GDPR to argue a legal basis for processing PII, not the least of which is the catch all "legitimate interest". But you need to implement appropriate controls, otherwise data privacy regulators will complain.

> Should it apply to the whole of Europe?

That's a political question, I just want to point out that this measure is backed by the GDPR, for better or worse.

Reply on news.ycombinator.com