4 ms·

Not related to the ads industry but GDPR compliance in general for smaller companies (which is discussed in various other comments to this article), I would lik

by havkom 8y ago

Not related to the ads industry but GDPR compliance in general for smaller companies (which is discussed in various other comments to this article), I would like to add these remarks: I think ”GDPR compliance” is not a binary thing - there are levels of compliance. No smaller normal company or Google or Facebook will be able to “fully comply” at any point in time. There will always have to be incremental improvements over time, hopefully in the right direction. Also recognize that the obligations in GDPR “scales” with the size of operation/amount of data that is processed. For example smaller companies: - are exempted from some of the record keeping obligations, - may not have to appoint a data protection officer, - may often not have to do data protection impact assessments, - may not have to set up and implement some policies relating to data protection - may also have less obligations when it comes to Privacy by Design (since reasonable costs are a recognized factor) - may generally have fewer data processing activities that requires consent (most normal personal data processing does not) I would also forget about scares of 4% fines unless you are doing something really bad or do not care at all even after a fine, repremand or warning from a Data Protection Authority. My guess is that the “normal level of fine amount” will not change with GDPR for data protection violations in the EU (compared to current UK levels). This seems to be what the UK:s Data Protection Authroity (ICO) is going around and telling everyone as well (if I have not misunderstood).

downandout 8y ago
No smaller normal company or Google or Facebook will be able to “fully comply” at any point in time. Which makes it ripe for abuse. By making a regulation that is impossible to fully comply with, they have created a situation where any (or all) of the 28 countries in the EU can fine any company at will, because they're never fully in compliance. Further, individual users can seek compensation under GDPR - companies will be deluged with such claims. Just having to depend on the goodwill of regulators who you think will just be attempting to enforce the spirit of the law is a terrible position to put companies in. When these countries and individual citizens are starved for cash, all of a sudden the letter of the law will be the only thing that matters, as is always the case with regulations that put all market participants in violation by default.
- havkom 8y ago
  The level of fines looks like it will be harmonized by EDPB (a board of all Data Protection Authorities) so individual DPAs will probably not be able to set arbitrary levels. There are also the one-stop-shop rules so a company will normally only have to deal with one DPA. When it comes to compensation, you have to show what material or non-material damages you’ve suffered. Class actions are generally not a big thing in the EU. Sure, there is an exposure here but in practice I think it will be very limited, especially for smaller companies.
  - downandout 8y ago
    When it comes to compensation, you have to show what material or non-material damages you’ve suffered You realize that "material or non-material damages" can mean just about anything right? If it were limited to "material" damages, that would at least impose some form of sanity. The way this is written, it's a free-for-all. Saying "I have had alot of trouble sleeping since I found out that only 45 of 46 tracking companies were listed on the disclosure" is all it would take for an individual to obtain money from a company under this absurd regulation.
    - havkom 8y ago
      Yes. Exactly what non-material damages means will be up to CJEU to decide eventually. I do not think many ppl expects it to mean “free-for-all” and I do not think your “sleeping example” would suffice. Admittedly, no one can know for sure at this point in time though.
    - DanBC 8y ago
      They'd have to prove in court (to the balance of probabilities) that they have insomnia and that the insomnia was caused by the non-disclosure. They would also have to show that this is an expected result of non-disclosure. Assuming they do this - how much do you think a compensation payput for insomnia is worth? How many thousands of pounds do you think people would get?
      - 8y ago

by havkom 8y ago

downandout 8y ago

No smaller normal company or Google or Facebook will be able to “fully comply” at any point in time. Which makes it ripe for abuse. By making a regulation that is impossible to fully comply with, they have created a situation where any (or all) of the 28 countries in the EU can fine any company at will, because they're never fully in compliance. Further, individual users can seek compensation under GDPR - companies will be deluged with such claims. Just having to depend on the goodwill of regulators who you think will just be attempting to enforce the spirit of the law is a terrible position to put companies in. When these countries and individual citizens are starved for cash, all of a sudden the letter of the law will be the only thing that matters, as is always the case with regulations that put all market participants in violation by default.

havkom 8y ago
The level of fines looks like it will be harmonized by EDPB (a board of all Data Protection Authorities) so individual DPAs will probably not be able to set arbitrary levels. There are also the one-stop-shop rules so a company will normally only have to deal with one DPA. When it comes to compensation, you have to show what material or non-material damages you’ve suffered. Class actions are generally not a big thing in the EU. Sure, there is an exposure here but in practice I think it will be very limited, especially for smaller companies.
- downandout 8y ago
  When it comes to compensation, you have to show what material or non-material damages you’ve suffered You realize that "material or non-material damages" can mean just about anything right? If it were limited to "material" damages, that would at least impose some form of sanity. The way this is written, it's a free-for-all. Saying "I have had alot of trouble sleeping since I found out that only 45 of 46 tracking companies were listed on the disclosure" is all it would take for an individual to obtain money from a company under this absurd regulation.
  - havkom 8y ago
    Yes. Exactly what non-material damages means will be up to CJEU to decide eventually. I do not think many ppl expects it to mean “free-for-all” and I do not think your “sleeping example” would suffice. Admittedly, no one can know for sure at this point in time though.
  - DanBC 8y ago
    They'd have to prove in court (to the balance of probabilities) that they have insomnia and that the insomnia was caused by the non-disclosure. They would also have to show that this is an expected result of non-disclosure. Assuming they do this - how much do you think a compensation payput for insomnia is worth? How many thousands of pounds do you think people would get?
    - 8y ago