Hacker News new | ask | show | jobs
by encrux 36 days ago
For everyone in the EU: Copying and pasting sensitive data (like customer data) into AI tools is a violation of the GDPR, and potentially the AI act, which will be enforced soon.

These violations come with hefty fines.

3 comments

I would be cautious to advocate these laws that strongly in the context of AI tools:

Companies and employees always make their decisions based on a risk/reward basis.

Sometimes a commercial contract (like Microsoft Copilot) is enough to cover your ass and to meet the needs of the regulator.

Even if the operator is exactly the same.

Laws are constraints to navigate, but if you are successful enough (ahem, rich) then they don’t apply to you.

At the moment what the EU wants is to make sure that in the long-term they can access your private information.

Realistically if you are in the EU you have more risks telling your darkest secrets to a EU-hosted model that the government will arrest you, than to a Chinese-model (who doesn’t collaborate).

EU Chat Control, is here to protect kids and protect you from terrorists; you don’t want to claim you support pedophiles right ?

So following these rules is always a matter of choice.

Respect and you will be stuck with your shitty Mistral and no privacy, not respect and you have your shiny Claude that you have to think what to input inside.

What is it with this new one line paragraph style?

EDIT: Needless to say I loath it and I don't know why.

I agree with you I could have made it more compact by making 1 point = 1 paragraph, sometimes it’s a bit difficult to cleanly articulate my ideas, and I try not to clean them up with GPT first in order to keep the original tone.

For the not liking it part, I guess that if someone writes a long text, there are more chances to find at least a point of disagreement than a very short sentence

It depends heavily on what type of data though. As far as I understand if you have no PII or anything close to it you are mostly safe - especially if it's customer data but aggregated.
You’re brushing too broad a stroke GDPR only affects personal information. There’s plenty of sensitive business information that is not covered by GDPR - for example per business customer revenue data - that is legal to put into an AI tool but your employer may not want you to.
> business customer revenue data

Usually this would require the respective customer to agree to sharing that data with a third party.

But the normalisation of copying and pasting internal data into external tools is a recipe for complete disaster.

I'd be surprised if there weren't already phishing attacks that work by pretending to be a LLM.