4 ms·

So if you're a startup owner who happens to not be well connected, or have a bad lawyer, you get hit with the full $20M fine, while a huge corporation that is p

So if you're a startup owner who happens to not be well connected, or have a bad lawyer, you get hit with the full $20M fine, while a huge corporation that is politically well connected gets fined proportionally much less? There's no good way to frame this for a small business. Are you seriously suggesting that the mere benevolent feelings of a judge or board and how their mood is that day is the only thing standing between a startup and bankruptcy? If you're saying a small business should never be fined that much, why isn't that the letter of the law? Why does the court even have the option to completely destroy a startup like that? > So where does this ludicrous assumption that everyone is always going to be hit with the maximum fine from here on in come from? Where are you getting this ludicrous assumption that the law won't apply the maximum fine? If you don't think they should be able to, why isn't the law simply sensible, and should apply a lesser fine?

mcbits 9y ago
> Why does the court even have the option to completely destroy a startup like that? Supposing 100% of the startup's revenue comes from GDPR violations and they've been doing so for, say, 5 years, then the fine should really be 500% of annual revenue. Or even multiply that by 2 or 3 for punitive purposes. It may or may not destroy the startup, depending on how well funded they are. They could be breaching privacy for reasons other than revenue.
- bronson 9y ago
  So why doesn't this apply to larger companies?
  - mcbits 9y ago
    I'm not disputing that it's biased in favor of larger companies.
- pgeorgi 9y ago
  > Or even multiply that by 2 or 3 for punitive purposes The only place and time where the concept of punitive damages and GDPR overlap is the United Kingdom between May 25, 2018 and March 29, 2019. [edit: and Ireland. They might want to reconsider, given that they host many of the European HQs of US companies.]
oldcynic 9y ago
I don't know how the legal system works in the US (I'm starting to think not very well), but that's not how it works. The process in the UK is something along the lines of the court will assess means to pay, then a fine will be levied. I wouldn't expect any business to go bust as a result. They might go bust from the bad press causing a mass exodus of customers, they might get to look extremely stupid, they might find themselves tight for the forthcoming year. > Where are you getting this ludicrous assumption that the law won't apply the maximum fine They have never yet applied the maximum in 20 years of the current DPA, why presume they're itching to start next month? This makes no sense to me. Under the DPA 1998 the largest fine was issued in 2016, to a multi million pound company. £400k, so still only 80% of the maximum. Look to precedent across the entire EU.
deleted 9y ago
[deleted]

mcbits 9y ago

> Why does the court even have the option to completely destroy a startup like that? Supposing 100% of the startup's revenue comes from GDPR violations and they've been doing so for, say, 5 years, then the fine should really be 500% of annual revenue. Or even multiply that by 2 or 3 for punitive purposes. It may or may not destroy the startup, depending on how well funded they are. They could be breaching privacy for reasons other than revenue.

bronson 9y ago
So why doesn't this apply to larger companies?
- mcbits 9y ago
  I'm not disputing that it's biased in favor of larger companies.
pgeorgi 9y ago
> Or even multiply that by 2 or 3 for punitive purposes The only place and time where the concept of punitive damages and GDPR overlap is the United Kingdom between May 25, 2018 and March 29, 2019. [edit: and Ireland. They might want to reconsider, given that they host many of the European HQs of US companies.]

oldcynic 9y ago

I don't know how the legal system works in the US (I'm starting to think not very well), but that's not how it works. The process in the UK is something along the lines of the court will assess means to pay, then a fine will be levied. I wouldn't expect any business to go bust as a result. They might go bust from the bad press causing a mass exodus of customers, they might get to look extremely stupid, they might find themselves tight for the forthcoming year. > Where are you getting this ludicrous assumption that the law won't apply the maximum fine They have never yet applied the maximum in 20 years of the current DPA, why presume they're itching to start next month? This makes no sense to me. Under the DPA 1998 the largest fine was issued in 2016, to a multi million pound company. £400k, so still only 80% of the maximum. Look to precedent across the entire EU.

deleted 9y ago

[deleted]