5 ms·

Enforcement factsheet: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sit

Enforcement factsheet: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... Pretty clearly primarily enforced by national regulatory agencies, who are the only ones who can apply fines. It mentions citizens taking companies to court, but https://ec.europa.eu/commission/sites/beta-political/files/data-protection-overview-citizens_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... says that's for monetary damages, not for fines. This is unchanged from previous laws. Can people stop freaking out now?

tobltobs 8y ago
In Germany offenses against the GDPR can cause a "Abmahnung" which do not result in a fine but a charge. There a legions of filthy lawyers waiting for the 25.5.
- nils-m-holm 8y ago
  This is a big problem here in Germany and might very well be a reason to shut down my site on 5/24.
  - nils-m-holm 8y ago
    Would the downvoters care to explain what offended them? Looking the other way does not help solve a problem.
    - Dayshine 8y ago
      Well, my immediate thoughts in response to that reply were: "Why is some extra law specific to Germany relevant to my comment? This is a discussion about the GDPR, not about national data protection laws."
      - nils-m-holm 8y ago
        It's not about national laws, it's about the implementation of the GDPR on a national level (namely C&D letters).
- rorykoehler 8y ago
  Sounds like the piracy law. I was getting letters for downloading movies and shows I had never even heard of let alone seen. Chancers were casting a wide net hoping people would panic and pay.
- deleted 8y ago
  [deleted]
- teamhappy 8y ago
  I don't think that's possible. Do you have a source to back that up? (Also, they don't automatically result in a charge.) "Abmahnungen" are cease and desist letters by the way.
davidgl 8y ago
Great site that summarises GDRP in plain english: https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
mattmanser 8y ago
Also: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/enforcement-and-sanctions/sanctions/what-if-my-company-organisation-fails-comply-data-protection-rules_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... The authority must ensure that fines imposed in each individual case are effective, proportionate and dissuasive. It will take into account a number of factors such as the nature, gravity and duration of the infringement, its intentional or negligent character, any action taken to mitigate the damage suffered by individuals, the degree of cooperation of the organisation, etc.
- lucio 8y ago
  There's a problem when "The authority must ensure...", i.e. when there's a lot of discretion granted to "The authority", that's because "The authority" will use any law available to try to silence or harm dangerous individuals when there are "hidden" political reason to do so. Example: http://www.bbc.com/news/world-europe-39973864 http://www.bbc.com/news/world-europe-39973864 An antidote to this potential abuse is to make laws scarce and highly specific and make judges apply laws in the most textual form possible.
  - rdlecler1 8y ago
    And a will the EU favor European companies over foreign companies in enforcement practices?
tylermenezes 8y ago
And: > Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. (emphasis mine)
- someguy2018 8y ago
  Correct me if I'm wrong, but I think that changes as soon as you have one paying customer located in the EU (even if you were not specifically targeting the EU). I would guess most people selling something on the internet have at least some small percentage of customers in the EU.
  - grabeh 8y ago
    GDPR applicability for those outside the EU still requires at least some active targeting of users (website in EU languages, currencies) in the EU rather than EU users passively coming to your website to purchase. If I make a purchase from a bespoke banjo shop in Guatemala whose site is in Spanish and prices in Cuetzals that I've stumbled across on the internet then they don't go into scope of GDPR.
    - eli 8y ago
      Article 3 says it applies when -EITHER- of the following is true: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
      - grabeh 8y ago
        Yes, that's right. Are you implying that our notional Guatemalan banjo seller is monitoring the behaviour of EU based subjects? I confess I was working on the basis that out the two potential options, Art 3(2)(b) would be inapplicable here, but you may know more than me about their activities!

tobltobs 8y ago

In Germany offenses against the GDPR can cause a "Abmahnung" which do not result in a fine but a charge. There a legions of filthy lawyers waiting for the 25.5.

nils-m-holm 8y ago
This is a big problem here in Germany and might very well be a reason to shut down my site on 5/24.
- nils-m-holm 8y ago
  Would the downvoters care to explain what offended them? Looking the other way does not help solve a problem.
  - Dayshine 8y ago
    Well, my immediate thoughts in response to that reply were: "Why is some extra law specific to Germany relevant to my comment? This is a discussion about the GDPR, not about national data protection laws."
    - nils-m-holm 8y ago
      It's not about national laws, it's about the implementation of the GDPR on a national level (namely C&D letters).
rorykoehler 8y ago
Sounds like the piracy law. I was getting letters for downloading movies and shows I had never even heard of let alone seen. Chancers were casting a wide net hoping people would panic and pay.
deleted 8y ago
[deleted]
teamhappy 8y ago
I don't think that's possible. Do you have a source to back that up? (Also, they don't automatically result in a charge.) "Abmahnungen" are cease and desist letters by the way.

davidgl 8y ago

Great site that summarises GDRP in plain english: https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

mattmanser 8y ago

Also: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/enforcement-and-sanctions/sanctions/what-if-my-company-organisation-fails-comply-data-protection-rules_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... The authority must ensure that fines imposed in each individual case are effective, proportionate and dissuasive. It will take into account a number of factors such as the nature, gravity and duration of the infringement, its intentional or negligent character, any action taken to mitigate the damage suffered by individuals, the degree of cooperation of the organisation, etc.

lucio 8y ago
There's a problem when "The authority must ensure...", i.e. when there's a lot of discretion granted to "The authority", that's because "The authority" will use any law available to try to silence or harm dangerous individuals when there are "hidden" political reason to do so. Example: http://www.bbc.com/news/world-europe-39973864 http://www.bbc.com/news/world-europe-39973864 An antidote to this potential abuse is to make laws scarce and highly specific and make judges apply laws in the most textual form possible.
- rdlecler1 8y ago
  And a will the EU favor European companies over foreign companies in enforcement practices?

tylermenezes 8y ago

And: > Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR. (emphasis mine)

someguy2018 8y ago
Correct me if I'm wrong, but I think that changes as soon as you have one paying customer located in the EU (even if you were not specifically targeting the EU). I would guess most people selling something on the internet have at least some small percentage of customers in the EU.
- grabeh 8y ago
  GDPR applicability for those outside the EU still requires at least some active targeting of users (website in EU languages, currencies) in the EU rather than EU users passively coming to your website to purchase. If I make a purchase from a bespoke banjo shop in Guatemala whose site is in Spanish and prices in Cuetzals that I've stumbled across on the internet then they don't go into scope of GDPR.
  - eli 8y ago
    Article 3 says it applies when -EITHER- of the following is true: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
    - grabeh 8y ago
      Yes, that's right. Are you implying that our notional Guatemalan banjo seller is monitoring the behaviour of EU based subjects? I confess I was working on the basis that out the two potential options, Art 3(2)(b) would be inapplicable here, but you may know more than me about their activities!