I can see why the Hamburg conclusion is convenient for policy reasons, but it does seem like a massive loophole through which sophisticated controllers are goig to be able to drive a coach and horses.
By way of a quick example, how would the Hamburg authority distinguish their findings on personal data in LLMs from the findings the DPC (eventually) made about "lossy hashes" in the WhatsApp case? Facebook's approach there was to take people's contact lists, represent them in an abstract mathematical fashion, map relationships between them, add some indeterminacy, and declare that they weren't storing personal data. AFAICT, under Hamburg's reasoning, they would have been right?
Really stellar piece, Madhi -- your explainer on how LLMs work was excellent and you made me realize I needed to add even more to my own post to reflect the technical complexity.
I also am conflicted by the various conflicting views on the personal data question (California has also weighed in on this, as well as a few other jurisdictions.
I hope we'll get some clarity by the end of the year.
A bit of both, I suspect. The tech companies are engaged in a pretty egregious game of FAFO, which doesn't help, but policymakers are also living in a bit of a fantasy world thinking that generative AI is something that can be easily smushed into the round hole that is existing law.
There is a fundamental technical difference (as you articulated very clearly) between LLMs/DNNs (and other tech that is in the pipeline) and the traditional structured/file system data concepts that policymakers were thinking of 40 yeas ago. That's a fact. They need to own up to that fact and all its consequences -- or be more assertive in banning the technology and explaining why.
Good article.
I can see why the Hamburg conclusion is convenient for policy reasons, but it does seem like a massive loophole through which sophisticated controllers are goig to be able to drive a coach and horses.
By way of a quick example, how would the Hamburg authority distinguish their findings on personal data in LLMs from the findings the DPC (eventually) made about "lossy hashes" in the WhatsApp case? Facebook's approach there was to take people's contact lists, represent them in an abstract mathematical fashion, map relationships between them, add some indeterminacy, and declare that they weren't storing personal data. AFAICT, under Hamburg's reasoning, they would have been right?
Good point, I wasn’t aware of the Facebook contacts list case with the DPC. Will look into it.
Really stellar piece, Madhi -- your explainer on how LLMs work was excellent and you made me realize I needed to add even more to my own post to reflect the technical complexity.
I also am conflicted by the various conflicting views on the personal data question (California has also weighed in on this, as well as a few other jurisdictions.
I hope we'll get some clarity by the end of the year.
Thanks, and sorry for creating more work for you!
I’m just wondering at this point whether DP law is breaking LLMs or if LLMs are breaking DP law…
A bit of both, I suspect. The tech companies are engaged in a pretty egregious game of FAFO, which doesn't help, but policymakers are also living in a bit of a fantasy world thinking that generative AI is something that can be easily smushed into the round hole that is existing law.
There is a fundamental technical difference (as you articulated very clearly) between LLMs/DNNs (and other tech that is in the pipeline) and the traditional structured/file system data concepts that policymakers were thinking of 40 yeas ago. That's a fact. They need to own up to that fact and all its consequences -- or be more assertive in banning the technology and explaining why.
This waffling benefits no one.
Great article!
Thanks