Italy lifts ban on ChatGPT after data privacy improvements | Hacker News Reader

Italy lifts ban on ChatGPT after data privacy improvements

dw.com

120 pointsjacooper38 comments

Astonishing how governments just take foreign corporations by their word when they promise they won't use data for a certain purpose. For all we know (and I doubt the Italian government knows much more), they could have just added an "opt out" checkbox that does absolutely nothing.

One has to assume some level of good faith, or it would be impossible to agree on anything. Plus, if OpenAI lied about this and it became known that they lied, they'd be shut down again and have much harder path back. Every privacy organization across the world would consider them an untrustworthy organization, and all good faith, friendly interaction would end.

Technology corporations have been blatantly breaking European law for the past 15 years, and received multiple billion-dollar fines for it. Car manufacturers have committed fraud to deceive regulators into believing their products comply with emission standards.

What "good faith" are you talking about?

Good faith that maybe they fixed it this time, and that even a multi-national company doesn’t have the stones to bold face lie to a government, when they’re under scrutiny for past deception.

Without some level of good faith, there’s no path back for organisations. The only acceptable form of remediation would be dissolving the company entirely, which huge impacts on many people.

Certainly past regulation has been a little toothless. But laws like GDPR with their maximum set as a percentage of global revenue show that governments are catching up. Those fines can be large enough to inflict real pain and damage to corporations that repeatedly misbehave.

> Those fines can be large enough to inflict real pain and damage to corporations that repeatedly misbehave.

To my knowledge, such a large fine has never been imposed in 5 years, despite rampant noncompliance across the entire industry, including Big Tech, with countless complaints having been filed but gone nowhere.

There’s site tracking the fines: https://www.enforcementtracker.com/

Already on the first page I found a case (ETid-1788) where the operator of a public toilet was fined for installing a hidden camera inside a toilet stall(!!!) to secretly record people who used it.

The fine was 25,000 Euros. That's insane. That business should have been closed down and the responsible person jailed. GDPR enforcement is a joke.

This seems to be a fine for an individual, "Accused: A**, born on XXX"

https://www-ris-bka-gv-at.translate.goog/Dokumente/Dsk/DSBT_...

Individuals don't run public toilets normally. My guess is the accused is the owner of the business that operates those toilets.

That fine is just for the GDPR aspect the case. Authorities or the victims would pursue criminal or civil cases against the company or the individual who installed the camera for the other unrelated aspects.

None of those organizations are OpenAI, which has yet to establish a history of dishonest dealing. It's not usually a good idea for government agencies to assume that every company in a particular field is maximally dishonest and criminally inclined.

The goal is compliance, not punishment. So it's better to give them a chance to comply, a warning, and then prosecute and fine if they continue to flout the rules.

Switching entire business models to exploit the market, after receiving goodwill contributions/collaborations under their nonprofit model already sets a bad precedent.

So I don't think they have a clean record now, and people are simply wise to be skeptical.

What reasonable action could they take to satisfy your skepticism?

> It's not usually a good idea for government agencies to assume that every company in a particular field is maximally dishonest and criminally inclined.

Depends what you mean by "maximally." I think it's safe to assume that every company tries to maximize dishonesty after accounting for its cost (i.e. fines).

Way more than 15 years lol. Corporations skirt laws all the time. In the US they just don't get punished for it because it's bad for the market.

To me it appears to be an indirect form of taxation.

While the EU can't make corporations pay their share of taxes, it can at least rely on them willing to break the law rather than change their business model.

I don't if that's really the case though.

That's always a concern with law enforcement. I say "concern" because it creates perverse incentives for the enforcing body. An extreme case is civil forfeiture, where in some states police depts get to keep the lion share of the seized goods.

> One has to assume some level of good faith

From the tech industry which known for its surveillance capitalism? They should be imposing regular audits of the systems as a pre-condition for allowing them to even exist.

the EU has repeatedly doled out fines in the billion dollar range which is enough to even hurt big corps for non-compliance, most recently Meta in January so it really doesn't make any sense to act in bad faith with intent.

I've worked at several large companies and I've honestly never once seen someone advocate to ignore legislation intentionally . It's stupid even from the POV of companies themselves. A lot of data leaks happen out of incompetence or indifference before someone got a slap on the wrist, but the calculus to fake a textbox that comes with a 9 figure fine doesn't make a lot of sense

> the EU has repeatedly doled out fines in the billion dollar range which is enough to even hurt big corps for non-compliance

Wrong. Unless the fines are larger than the profits made from the illegal practices, they are just cost of doing business.

> I've honestly never once seen someone advocate to ignore legislation intentionally

Of course not. There is usually a complex system of plausible deniability in place that executives use to cover their asses, while everyone involved silently understands what is happening.

Do you seriously think that the people who designed the "defeat devices" revealed in the context of the emissions scandal believed they weren't breaking the law?

And which of those fines have not been repealed or decimated after appeal? Companies rightfully laugh at those initial fines because the appeals process consistently manages to shave off at least 50% of the total amount.

The problem solved is not what openai does with the data, it's what it's telling the users.

The regulation in question required better disclosure which is now available.

Fwiw, the title is wrong too: Italy never banned chatgpt, openai decided to block Italy to avoid legal risk.

(They also added some support to erase data or some such, which either they will do or it will cause massive consequences)

I am confused. This is simply how all human interactions work to some degree: In good faith.

Any entity has some angle to be a crook (no matter if company, country, handyman, physician, programmer, spouse, kid). It's really easy to find answers to both the how and the why, and while fraud and lies are ubiquitous, our world is simply not set up to be managed by front loading all the proof.

I don't know how that would work. I don't think anyone does.

Just a small nitpick: GDPR forbids opt out checkboxes, non-essential data collection must be opt-in (and unchecked by default)

I guess that the promise is done under oath. Which means that if it turns out later that it was a lie, the company exposes itself to a more severe punishment than if it had simply violated some privacy regulation.

Governments don't have the ressources to check every little detail about everything. And it would be quite invasive if they did, so they usually assume good faith unless they have suspicions not to.

I wonder if they were looking for a way to back out without losing face or if those changes were genuinely enough.

I'd say 50-50

This change by itself fixed a pretty big issue, but at the same time they probably realised they jumped the gun, especially with regards to the issues stemming from the training method

I would have loved to see it go on at least for a year and then see what happens.

This is the full set of requests and outcomes (scroll for English): https://www.garanteprivacy.it/home/docweb/-/docweb-display/d...

The only missing one is this: "introduced mechanisms to enable data subjects to obtain erasure of information that is considered inaccurate, whilst stating that it is technically impossible, as of now, to rectify inaccuracies". It is not clear to me however how one would request removal of information about themselves.

Are these new „privacy“ features also available for users based in the US?

Nadella has been pushing AI at the WEF to gullible EU politicians. Maybe someone like von der Leyen had a word with the current Italian government, which has caved on other issues as well.

That's how the EU works.

Wdym gullible? I'd hope that politicians and policy makers alike are keeping an eye on AI. Transformative AI isn't here yet, but it's coming and if politicians stay clueless until that day, then I don't have high hopes.

I'd much rather see a lot of policy ideas thrown around, even if some of them don't turn out great. If Microsoft is the one making politicians notice that AI is important than I'm all for that, even if they have their own incentives. The default outcome is that they don't care at all until it's way too late.

This gives me a little hope: https://english.kyodonews.net/news/2023/04/19a16a0f9bad-g-7-...

You want new policies and laws?

How is that even a question? AI will be the most powerful technology ever invented. More powerful than nuclear tech. Obviously it follows that we will need policies and laws at least as strong and comprehensive as those surrounding nuclear technology.

Absolutely. I'm surprised you find that noteworthy.

I think it's very important that we:

- slow down AI capabilities research - fast-track alignment and safety research - guide the development and integration of transformative ai into society by putting responsible policies in place

It's obvious that ai offers an incredible opportunity for humanity. This could very well be the defining century for our species.

But there are so many ways this can wrong. Even if alignment turns out to be easy, our society is just not ready to cope with the radical changes that transformative ai would bring.

All of these challenges are solvable, but they require a dedicated effort from all involved players. We cannot afford a capabilities race and we cannot afford that just a handful of companies end up as the sole wielders of the most impactful technology to ever exist. Capabilities cannot come at the cost of safety and we need policymakers to enforce this. Self regulation is not going to solve this for us.

Unfortunately, politicians have been years behind the curve when it comes to technological process. That's not good enough for transformative ai and so we need to get them in the loop now.

So yes, I do want new policies and laws. And I do want people to go into politics and work on policies to help shape this future.

> That's how the EU works.

Do you have any basis for that claim?

> Maybe someone like von der Leyen had a word with the current Italian government, which has caved on other issues as well.

Von der Leyen can have as many words with the current Italian government as she wants, but the Garante per la Protezione dei Dati Personali is an independent administrative authority, and its current president got his mandate in 2020.

Reply on news.ycombinator.com