7 ms·

Is it scaremongering to assume the maximum fine? Of course - years of legal precedent for current DPA clearly demonstrates this. If the track record showed hund

Is it scaremongering to assume the maximum fine? Of course - years of legal precedent for current DPA clearly demonstrates this. If the track record showed hundreds of small business people rendered destitute thanks to half million fines it wouldn't be, but it doesn't. It's a maximum not a fixed penalty as one would typically get for a parking offence. If they're not fining anyone £500k why are they going to suddenly fine everyone £17m? Even TalkTalk were only fined £400k for the most ridiculous incompetence leading to 4 breaches in 18 months and failing SQL injection 101. They make profit in the tens of millions yet still didn't hit the maximum (They should have in my opinion). I think at the time that was the largest penalty yet issued. Same goes for other data protection bodies across the EU - there will be few instances of maximum penalty under current data protection. I'm sure some countries have never imposed the current maximum. nb It's not a ridiculous law - I'm fully in favour of it, as are many others over here.

YeGoblynQueenne 8y ago
>> nb It's not a ridiculous law - I'm fully in favour of it, as are many others over here. That's the most interesting thing about the GDPR. While some developers are picking up their ball and huffing off home, others are actually 100% behind the regulation. It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software.
- SahAssar 8y ago
  Probably in part because it's exactly those developers that see how easy it is to leak data to third parties that won't respect it at all and will track the everliving shit out of it. I'm fully behind the GDPR. It might not be perfect, but I've read the law and it's surprisingly straightforward and sane.
  - jimktrains2 8y ago
    > I'm fully behind the GDPR. It might not be perfect, but I've read the law and it's surprisingly straightforward and sane. Why is it sane to assume data I've sent to a service is my data to control?
    - YeGoblynQueenne 8y ago
      With respect but it's you who says it isn't. You need to explain why it isn't.
    - SahAssar 8y ago
      I started writing a lengthy reply, but instead let me ask you this: why would a service be privileged to do anything with your data that they did not ask you for permission to do?
- pgeorgi 8y ago
  > It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software. Or the competitors' software. Consider some business that was doing what GDPR requires already: users could delete their data, they could request a complete copy of it as well as an explanation what it is used for, and it was only used for defined purposes that the user signed off prior anyway. Sadly, that reduces flexibility somewhat, but they're doing it because they consider it the right thing. For them, GDPR levels the playing field and makes sure that they never have to stray from this conduct just to remain competitive with companies that aren't so nice to their users.
- jimktrains2 8y ago
  > It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software. Nothing about the gdpr solves the problems of companies having insecure systems that _leak_ user data. I also don't believe that data about me is data I own. To me, the gdpr feels ineffective at the real issues causing me harm (leaked info) and also a giant burden on companies that fundamentally changes how the industry has worked, but in a way that quite frankly, doesn't make any sense to me. The data about my order isn't my data to control.
  - aninhumer 8y ago
    >Nothing about the gdpr solves the problems of companies having insecure systems It doesn't directly prevent insecure systems, but discouraging companies from storing information they don't need and transferring it on to third parties for whatever reason they feel like massively reduces most people's exposure to this risk. >The data about my order isn't my data to control. If you believe people have a right to privacy, then you believe they have a right to decide who gets to know what information about them.
    - jimktrains2 8y ago
      > If you believe people have a right to privacy, then you believe they have a right to decide who gets to know what information about them. That's not even remotely true. A right to privacy does not mean I get to control the actions of others.
      - riffraff 8y ago
        That's not what's grandparent wrote, it wrote that you have a right to know what is done with your data. Nothing restricts what others can do with them, they just have to state it so I can decide whether that's ok for me or not. The lack of this clearly defies the right to privacy, just consider the extreme case of "I'll dump your data on GitHub next week"
  - YeGoblynQueenne 8y ago
- oldcynic 8y ago
  Interesting part for me is the hilarious FUD where we got none when DPA came in. A good part of GDPR is already here with EU Data Protection Acts and what constitutes personal data is much the same. Many of the Kafkaesque and corruption scenarios should be possible under DPA and other laws yet haven't been happening. GDPR increases maximum penalty to be high enough that it could be a penalty to a Google or Facebook for a serious, wilful, breach of regs, in an environment where the tiniest fraction of reported cases get any fine at all (16 of 17,300 reports for 2017 in the UK) let alone the maximum. Internet now certain that one man software companies and hobbyists with non-commercial regex sites will receive £17m fines, every time and it will be used as a stick to beat one's political enemies with or, most comically of all, pay for local infrastructure improvements. I don't understand why - the regs seem reasonable and not especially difficult to meet unless your business is built on wilful abuse of personal data. Just a reasonable effort to enhance DPA taking into account new techniques and misuses of data. Deletion for everyone, not just a minority - thanks to FB et al feeling it's fine to never delete, and run shadow profiles on all. The highest penalty will be saved for the most offensive cases involving multi-nationals. It will be interesting in a few years to see how many maximum fines have been levied. My bet is none at all, once or twice if there's an especially egregious breach from an Amazon or Google. I've little doubt that just as I feel more should have attracted fines under DPA I'll feel more should have got GDPR fines.
  - YeGoblynQueenne 8y ago
    >> I don't understand why - the regs seem reasonable and not especially difficult to meet unless your business is built on wilful abuse of personal data. My intuition is that the people who complain are that fraction of developers who actually care about their profits more than their users' privacy.
    - oldcynic 8y ago
      I'm sure that's a big part of it when every app wants to do a data grab. I'm also left thinking US law doesn't really do proportionate after a few of these discussions! :) For us in Europe 20 years of DPA must help - I doubt there's many here would want to go back to pre-data protection.
firic 8y ago
So you did the research and found out that England probably won't endorse a law to the fullest extent. My point is that a simple tech guy building a company won't know that statistic and how it relates to their specific case.
- matthewmacleod 8y ago
  Then what you do is hire a lawyer for an afternoon, who will tell you the same thing then give you a list of stuff to do that will bring you into compliance. It’s so, so easy.
  - megaman22 8y ago
    Laws that are stupid and not widely enforced because they are stupid are damaging to the entire concept of law. Particularly if they can hang over like a sword of Damocles if you piss off the wrong people.
    - oldcynic 8y ago
      This is getting silly. The law will be enforced, just as current data protection is. The law can be enforced without every case attracting the maximum penalty. That's why nearly every law has a range of penalties. Accidental and minor breaches can attract a minor penalty or a letter asking you try harder. Wilful and repeated breaches affecting many customers will attract harsher penalties. Same goes for speeding offences - go 40 in a 30 limit, get a fixed penalty ticket. go 140 with the GoPro race footage of you and your buddy posted to twitter expect a much larger fine and a driving ban. In neither instance is it not enforced, or damaging to the concept of law.
      - megaman22 8y ago
        The speed limit analogy is terrible. Or maybe perfect, for my point. Because speed limits are not enforced, everyone goes somewhere between 5 and 15 mph over, all the time. But catch a pissy cop, or one in a town that uses speed traps as a revenue source, and you can get pinched for hundreds of dollars arbitrarily. Yeah, the jackhole that burns tire at 110 past a school-zone is most likely to get pinched, but almost everyone on the road could.

YeGoblynQueenne 8y ago

>> nb It's not a ridiculous law - I'm fully in favour of it, as are many others over here. That's the most interesting thing about the GDPR. While some developers are picking up their ball and huffing off home, others are actually 100% behind the regulation. It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software.

SahAssar 8y ago
Probably in part because it's exactly those developers that see how easy it is to leak data to third parties that won't respect it at all and will track the everliving shit out of it. I'm fully behind the GDPR. It might not be perfect, but I've read the law and it's surprisingly straightforward and sane.
- jimktrains2 8y ago
  > I'm fully behind the GDPR. It might not be perfect, but I've read the law and it's surprisingly straightforward and sane. Why is it sane to assume data I've sent to a service is my data to control?
  - YeGoblynQueenne 8y ago
    With respect but it's you who says it isn't. You need to explain why it isn't.
  - SahAssar 8y ago
    I started writing a lengthy reply, but instead let me ask you this: why would a service be privileged to do anything with your data that they did not ask you for permission to do?
pgeorgi 8y ago
> It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software. Or the competitors' software. Consider some business that was doing what GDPR requires already: users could delete their data, they could request a complete copy of it as well as an explanation what it is used for, and it was only used for defined purposes that the user signed off prior anyway. Sadly, that reduces flexibility somewhat, but they're doing it because they consider it the right thing. For them, GDPR levels the playing field and makes sure that they never have to stray from this conduct just to remain competitive with companies that aren't so nice to their users.
jimktrains2 8y ago
> It says something when tech-savvy people agree to sacrifice time and effort and probably profits to protect their users from their own software. Nothing about the gdpr solves the problems of companies having insecure systems that _leak_ user data. I also don't believe that data about me is data I own. To me, the gdpr feels ineffective at the real issues causing me harm (leaked info) and also a giant burden on companies that fundamentally changes how the industry has worked, but in a way that quite frankly, doesn't make any sense to me. The data about my order isn't my data to control.
- aninhumer 8y ago
  >Nothing about the gdpr solves the problems of companies having insecure systems It doesn't directly prevent insecure systems, but discouraging companies from storing information they don't need and transferring it on to third parties for whatever reason they feel like massively reduces most people's exposure to this risk. >The data about my order isn't my data to control. If you believe people have a right to privacy, then you believe they have a right to decide who gets to know what information about them.
  - jimktrains2 8y ago
    > If you believe people have a right to privacy, then you believe they have a right to decide who gets to know what information about them. That's not even remotely true. A right to privacy does not mean I get to control the actions of others.
    - riffraff 8y ago
      That's not what's grandparent wrote, it wrote that you have a right to know what is done with your data. Nothing restricts what others can do with them, they just have to state it so I can decide whether that's ok for me or not. The lack of this clearly defies the right to privacy, just consider the extreme case of "I'll dump your data on GitHub next week"
- YeGoblynQueenne 8y ago
oldcynic 8y ago
Interesting part for me is the hilarious FUD where we got none when DPA came in. A good part of GDPR is already here with EU Data Protection Acts and what constitutes personal data is much the same. Many of the Kafkaesque and corruption scenarios should be possible under DPA and other laws yet haven't been happening. GDPR increases maximum penalty to be high enough that it could be a penalty to a Google or Facebook for a serious, wilful, breach of regs, in an environment where the tiniest fraction of reported cases get any fine at all (16 of 17,300 reports for 2017 in the UK) let alone the maximum. Internet now certain that one man software companies and hobbyists with non-commercial regex sites will receive £17m fines, every time and it will be used as a stick to beat one's political enemies with or, most comically of all, pay for local infrastructure improvements. I don't understand why - the regs seem reasonable and not especially difficult to meet unless your business is built on wilful abuse of personal data. Just a reasonable effort to enhance DPA taking into account new techniques and misuses of data. Deletion for everyone, not just a minority - thanks to FB et al feeling it's fine to never delete, and run shadow profiles on all. The highest penalty will be saved for the most offensive cases involving multi-nationals. It will be interesting in a few years to see how many maximum fines have been levied. My bet is none at all, once or twice if there's an especially egregious breach from an Amazon or Google. I've little doubt that just as I feel more should have attracted fines under DPA I'll feel more should have got GDPR fines.
- YeGoblynQueenne 8y ago
  >> I don't understand why - the regs seem reasonable and not especially difficult to meet unless your business is built on wilful abuse of personal data. My intuition is that the people who complain are that fraction of developers who actually care about their profits more than their users' privacy.
  - oldcynic 8y ago
    I'm sure that's a big part of it when every app wants to do a data grab. I'm also left thinking US law doesn't really do proportionate after a few of these discussions! :) For us in Europe 20 years of DPA must help - I doubt there's many here would want to go back to pre-data protection.

firic 8y ago

So you did the research and found out that England probably won't endorse a law to the fullest extent. My point is that a simple tech guy building a company won't know that statistic and how it relates to their specific case.

matthewmacleod 8y ago
Then what you do is hire a lawyer for an afternoon, who will tell you the same thing then give you a list of stuff to do that will bring you into compliance. It’s so, so easy.
- megaman22 8y ago
  Laws that are stupid and not widely enforced because they are stupid are damaging to the entire concept of law. Particularly if they can hang over like a sword of Damocles if you piss off the wrong people.
  - oldcynic 8y ago
    This is getting silly. The law will be enforced, just as current data protection is. The law can be enforced without every case attracting the maximum penalty. That's why nearly every law has a range of penalties. Accidental and minor breaches can attract a minor penalty or a letter asking you try harder. Wilful and repeated breaches affecting many customers will attract harsher penalties. Same goes for speeding offences - go 40 in a 30 limit, get a fixed penalty ticket. go 140 with the GoPro race footage of you and your buddy posted to twitter expect a much larger fine and a driving ban. In neither instance is it not enforced, or damaging to the concept of law.
    - megaman22 8y ago
      The speed limit analogy is terrible. Or maybe perfect, for my point. Because speed limits are not enforced, everyone goes somewhere between 5 and 15 mph over, all the time. But catch a pissy cop, or one in a town that uses speed traps as a revenue source, and you can get pinched for hundreds of dollars arbitrarily. Yeah, the jackhole that burns tire at 110 past a school-zone is most likely to get pinched, but almost everyone on the road could.