4 ms·

While not “automatically applied,” what part of what you linked to says they won’t use their discretion to assess the maximum penalty in most situations? What s

While not “automatically applied,” what part of what you linked to says they won’t use their discretion to assess the maximum penalty in most situations? What stops them?

mygo 9y ago
> What stops them? Some people just accept it when someone says they won’t do something that they totally can. I know, it doesn’t really make sense. If someone tells me “well it says that we can do that if you go by what’s on paper, but we wouldn’t actually do that”, then change it so that it says on paper that you won’t, or I’m inclined to think that you totally will, because you totally can.
- lanbanger 9y ago
  Agreed. Sounds like every employment contract I've ever read (and usually not signed).
a_bonobo 9y ago
There is a set of rules that are followed when determining a fine: https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/ These rules look at whether your company has infringed before, whether you've notified the state on your own, etc. pp. The current Information Commissioner Office system has a similar system in place. Out of 17,300 cases reported in 2017, 16 resulted in a fine. Source: https://www.infosecurity-magazine.com/opinions/gdpr-timebomb-huge-fines/ https://www.infosecurity-magazine.com/opinions/gdpr-timebomb...
- downandout 9y ago
  There are no rules in what you linked to that would prevent or even deter maximum fines in every single case. The only limits imposed are $10 million for lower level fines and $20 million for upper level (or percentages of revenue, whichever is higher - the static amount will always be higher for smaller businesses). Edit: to those downvoting this (and all of my other comments) - this comment contains only facts. So please show me where it says that there are circumstances under which they must fine you less than the maximum. Otherwise there is nothing to downvote.
  - deleted 9y ago
    [deleted]
  - detaro 9y ago
    Explicit criteria existing deter maximum fines, since it opens up the authorities to counter-claims that they did not take criteria in your favor into account.
    - downandout 9y ago
      To most small businesses, whether the fine is $5 million or $20 million doesn’t matter - they still can’t pay it. So if some of these factors are considered and “only” $5 or $7 million is assessed, that’s still a company killer.
      - outsideoflife 9y ago
        Under what circumstances are you expecting to receive a $5m dollar fine? To me (who is assessing this risk at a UK SME) the idea of an SME receiving this kind of fine is absurd. As the poster above said, the law asks for proportionate fines. The big number max fines in GDPR are there to deal with companies like Google and Facebook who can write of $5m as a rounding error. People who have been fined at all under the existing DPA, being enforced by the very same people as GDPR, have been negligent, repeat offenders. I don't believe anyone has ever received the maximum fine in the existing regulations. That just isn't how UK law works
  - ckastner 9y ago
    It's in article 83 of the GDOR: Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. Note: proportionate
    - syshum 9y ago
      I think this highlights the EU vs US perspective on Government nicely In the EU you tend to trust your bureaucrats to make a "Fair and Just" application of the law In the US we tend to expect our bureaucrats to be vindictive, corrupt, petty, and generally impose fines and penalties not based on the law but based on their personal feelings about the target of their "legal action" Thus such open ended wording like you posted being classified as a "rule" scares the shit out of most Americans
DanBC 9y ago
> what part of what you linked to says they won’t use their discretion to assess the maximum penalty in most situations? There's at least twenty years of regulation under existing DPA law, where the maximum fine has never been asked for nor applied.
ahartman00 9y ago
They need tax revenue, jobs for their citizens, and goods and services that their citizens want?? It doesnt even make sense for them to run around, shutting down every business they can. It would hurt them.

While not “automatically applied,” what part of what you linked to says they won’t use their discretion to assess the maximum penalty in most situations? What stops them?

mygo 9y ago

> What stops them? Some people just accept it when someone says they won’t do something that they totally can. I know, it doesn’t really make sense. If someone tells me “well it says that we can do that if you go by what’s on paper, but we wouldn’t actually do that”, then change it so that it says on paper that you won’t, or I’m inclined to think that you totally will, because you totally can.

lanbanger 9y ago
Agreed. Sounds like every employment contract I've ever read (and usually not signed).

a_bonobo 9y ago

There is a set of rules that are followed when determining a fine: https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/ These rules look at whether your company has infringed before, whether you've notified the state on your own, etc. pp. The current Information Commissioner Office system has a similar system in place. Out of 17,300 cases reported in 2017, 16 resulted in a fine. Source: https://www.infosecurity-magazine.com/opinions/gdpr-timebomb-huge-fines/ https://www.infosecurity-magazine.com/opinions/gdpr-timebomb...

downandout 9y ago
There are no rules in what you linked to that would prevent or even deter maximum fines in every single case. The only limits imposed are $10 million for lower level fines and $20 million for upper level (or percentages of revenue, whichever is higher - the static amount will always be higher for smaller businesses). Edit: to those downvoting this (and all of my other comments) - this comment contains only facts. So please show me where it says that there are circumstances under which they must fine you less than the maximum. Otherwise there is nothing to downvote.
- deleted 9y ago
  [deleted]
- detaro 9y ago
  Explicit criteria existing deter maximum fines, since it opens up the authorities to counter-claims that they did not take criteria in your favor into account.
  - downandout 9y ago
    To most small businesses, whether the fine is $5 million or $20 million doesn’t matter - they still can’t pay it. So if some of these factors are considered and “only” $5 or $7 million is assessed, that’s still a company killer.
    - outsideoflife 9y ago
      Under what circumstances are you expecting to receive a $5m dollar fine? To me (who is assessing this risk at a UK SME) the idea of an SME receiving this kind of fine is absurd. As the poster above said, the law asks for proportionate fines. The big number max fines in GDPR are there to deal with companies like Google and Facebook who can write of $5m as a rounding error. People who have been fined at all under the existing DPA, being enforced by the very same people as GDPR, have been negligent, repeat offenders. I don't believe anyone has ever received the maximum fine in the existing regulations. That just isn't how UK law works
- ckastner 9y ago
  It's in article 83 of the GDOR: Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. Note: proportionate
  - syshum 9y ago
    I think this highlights the EU vs US perspective on Government nicely In the EU you tend to trust your bureaucrats to make a "Fair and Just" application of the law In the US we tend to expect our bureaucrats to be vindictive, corrupt, petty, and generally impose fines and penalties not based on the law but based on their personal feelings about the target of their "legal action" Thus such open ended wording like you posted being classified as a "rule" scares the shit out of most Americans

DanBC 9y ago

> what part of what you linked to says they won’t use their discretion to assess the maximum penalty in most situations? There's at least twenty years of regulation under existing DPA law, where the maximum fine has never been asked for nor applied.

ahartman00 9y ago

They need tax revenue, jobs for their citizens, and goods and services that their citizens want?? It doesnt even make sense for them to run around, shutting down every business they can. It would hurt them.