4 ms·

People who say this quite simply haven't looked at the law or tried to comply themselves. There was someone else in another thread spouting something about how

People who say this quite simply haven't looked at the law or tried to comply themselves. There was someone else in another thread spouting something about how easy the law was to comply with, having helped implement GDPR for his employer. When I visited his employer's site - through an EU proxy no less - I found an undisclosed Google Analytics and Facebook pixel automatically loaded on the page. In 20 days, that 1 visit could mean a $20 million fine for them.

the_mitsuhiko 8y ago
> I found an undisclosed Google Analytics and Facebook pixel automatically loaded on the page. In 20 days, that 1 visit could mean a $20 million fine for them. You will not be fined 20 million for that. This argument is beyond absurd.
- downandout 8y ago
  It is absurd, but the letter of the law says they can do it, and there is nothing stopping them from doing it.
  - dvfjsdhgfv 8y ago
    Your statement is false. What it is is the upper bound. The letter of the law clearly says the punishment must be adequate.
dvfjsdhgfv 8y ago
> that 1 visit could mean a $20 million fine for them. I don't know what is more absurd: people repeating this on HN or those who actually started to believe this FUD.
- downandout 8y ago
  Show me where it is written in the GDPR that this could not possibly be the result of a single violation. It's not there. Yes, it says they should consider some things when determining the fine amount. But they still have the statutory authority to impose the maximum at their discretion regardless of any other considerations. It's not FUD when that's what the law says in black and white.
  - the_mitsuhiko 8y ago
    Honestly: what banana republic do you assume the EU is? No way a 20 million euro fine for a first infringement of a small company would be seen as reasonable. Scaremongering neither helps you nor anyone else here.
    - downandout 8y ago
      If they intended for there to be safeguards, those would have been built in. They. Are. Not. There.
      - stordoff 8y ago
        A 20€ million fine for that would not be proportionate, nor would they have taken into account the relevant factors ("the nature, gravity and duration of the infringement [...] as well as [...] and the level of damage suffered by them"). Edit: typo (proportional->proportionate)
        downandout 8y ago
        A 20€ million fine for that would not be proportionate By whose definition? Germany might disagree with you.
        DanBC 8y ago
        Can you point to any excessive fines imposed by the German regulators under existing law?
        downandout 8y ago
        No, but they've never had the extraterritorial reach being claimed by the EU within the GDPR either.
      - portent 8y ago
        I'm sure technically you are right on the written wording of the law, but you can be technically right on many subjects and make the wrong business calls. Avoiding a vanishingly small regulatory risk by making real damage to your company seems like a bad call. You could totally eliminate the risk of meteorite impact on your business by relocating down a mineshaft...
- jotm 8y ago
  The GDPR is pretty restrictive, and if it's a law, the risk of a high fine is real and companies will think twice before doing business in the EU. Good for those who can comply, terrible for the rest...
  - gerdesj 8y ago
    I'm a UK (IT) business owner, you insensitive clod 8) I like the GDPR. It's a lot easier than ISO9001/27001 and actually nearly falls out if you have those. How many times have we whined and opined about a lack of responsibility displayed towards our personal data? Now a major bloc in the world is trying to get to grips with that issue with some pretty decent legislation (IMNSHO.) Do you have any idea how difficult it is to get something like this ratified by the EU? Do you have any idea how diverse the EU actually is? Getting this thing out is a massive feat. In the EU, we all have to comply with GDPR by default - all of us from cobblers to rocket scientists. I'm sure you'll manage.
    - rdiddly 8y ago
      And if they can't manage, those of us who know how to do business will be there waiting to eat their lunch.
    - jotm 8y ago
      Thank God for Brexit heh
      - M2Ys4U 8y ago
        Not really. GDPR is already law and EU law in force before brexit will continue to remain in force when (if) brexit happens.
    - joejerryronnie 8y ago
      Wait a minute, you're not in the EU anymore! Shouldn't you be railing against the self-serving protectionist agenda of those horrible bureaucrats of Brussels?!!
matwood 8y ago
> People who say this quite simply haven't looked at the law or tried to comply themselves. I have, and it's things you should have been doing anyway. I'm curious what your business is that complying is too onerous. There are some parts that are inexact, like how must a company protect data and exactly what data is considered PII. Thing is, if you treat any data that could identify a person as PII and a) Protect it as such b) Keep a living document on your site listing the data you capture and why c) Get and store consent d) Allow a user to 'be forgotten' and/or export their data e) If you change the data you capture or what you do with it, you must get consent again If you follow those steps you have complied with the spirit of the law [1]. Too many companies today capture more data than they need to provide the service the user signed up for, and then sell that data later when the service can't support itself. The high end of the fines are high, but that is the only way to get companies like FB and Google to fully comply. Hopefully spammers who I never gave consent to email me will also get put out of business, but they are like cockroaches and impossible to kill. [1] There are other points like you can't force consent, i.e. download this white paper only after you consent to accept marketing emails.
- downandout 8y ago
  If you follow those steps you have complied with the spirit of the law The spirit of the law is not the letter of the law. And as we all know, a single violation of the letter of the law can result in fines of up to $20 million.
  - dvfjsdhgfv 8y ago
    No, this is not how the law works, at least not in Europe. While doing business in Europe I sometimes got some things wrong, for example with taxes. I wasn't really punished even once - I just had to pay what was missing and correct the documents, even if the maximum punishment for what I did (or failed to do) was some years in jail.

the_mitsuhiko 8y ago

> I found an undisclosed Google Analytics and Facebook pixel automatically loaded on the page. In 20 days, that 1 visit could mean a $20 million fine for them. You will not be fined 20 million for that. This argument is beyond absurd.

downandout 8y ago
It is absurd, but the letter of the law says they can do it, and there is nothing stopping them from doing it.
- dvfjsdhgfv 8y ago
  Your statement is false. What it is is the upper bound. The letter of the law clearly says the punishment must be adequate.

dvfjsdhgfv 8y ago

> that 1 visit could mean a $20 million fine for them. I don't know what is more absurd: people repeating this on HN or those who actually started to believe this FUD.

downandout 8y ago
Show me where it is written in the GDPR that this could not possibly be the result of a single violation. It's not there. Yes, it says they should consider some things when determining the fine amount. But they still have the statutory authority to impose the maximum at their discretion regardless of any other considerations. It's not FUD when that's what the law says in black and white.
- the_mitsuhiko 8y ago
  Honestly: what banana republic do you assume the EU is? No way a 20 million euro fine for a first infringement of a small company would be seen as reasonable. Scaremongering neither helps you nor anyone else here.
  - downandout 8y ago
    If they intended for there to be safeguards, those would have been built in. They. Are. Not. There.
    - stordoff 8y ago
      A 20€ million fine for that would not be proportionate, nor would they have taken into account the relevant factors ("the nature, gravity and duration of the infringement [...] as well as [...] and the level of damage suffered by them"). Edit: typo (proportional->proportionate)
      - downandout 8y ago
        A 20€ million fine for that would not be proportionate By whose definition? Germany might disagree with you.
        DanBC 8y ago
        Can you point to any excessive fines imposed by the German regulators under existing law?
        downandout 8y ago
        No, but they've never had the extraterritorial reach being claimed by the EU within the GDPR either.
    - portent 8y ago
      I'm sure technically you are right on the written wording of the law, but you can be technically right on many subjects and make the wrong business calls. Avoiding a vanishingly small regulatory risk by making real damage to your company seems like a bad call. You could totally eliminate the risk of meteorite impact on your business by relocating down a mineshaft...
jotm 8y ago
The GDPR is pretty restrictive, and if it's a law, the risk of a high fine is real and companies will think twice before doing business in the EU. Good for those who can comply, terrible for the rest...
- gerdesj 8y ago
  I'm a UK (IT) business owner, you insensitive clod 8) I like the GDPR. It's a lot easier than ISO9001/27001 and actually nearly falls out if you have those. How many times have we whined and opined about a lack of responsibility displayed towards our personal data? Now a major bloc in the world is trying to get to grips with that issue with some pretty decent legislation (IMNSHO.) Do you have any idea how difficult it is to get something like this ratified by the EU? Do you have any idea how diverse the EU actually is? Getting this thing out is a massive feat. In the EU, we all have to comply with GDPR by default - all of us from cobblers to rocket scientists. I'm sure you'll manage.
  - rdiddly 8y ago
    And if they can't manage, those of us who know how to do business will be there waiting to eat their lunch.
  - jotm 8y ago
    Thank God for Brexit heh
    - M2Ys4U 8y ago
      Not really. GDPR is already law and EU law in force before brexit will continue to remain in force when (if) brexit happens.
  - joejerryronnie 8y ago
    Wait a minute, you're not in the EU anymore! Shouldn't you be railing against the self-serving protectionist agenda of those horrible bureaucrats of Brussels?!!

matwood 8y ago

> People who say this quite simply haven't looked at the law or tried to comply themselves. I have, and it's things you should have been doing anyway. I'm curious what your business is that complying is too onerous. There are some parts that are inexact, like how must a company protect data and exactly what data is considered PII. Thing is, if you treat any data that could identify a person as PII and a) Protect it as such b) Keep a living document on your site listing the data you capture and why c) Get and store consent d) Allow a user to 'be forgotten' and/or export their data e) If you change the data you capture or what you do with it, you must get consent again If you follow those steps you have complied with the spirit of the law [1]. Too many companies today capture more data than they need to provide the service the user signed up for, and then sell that data later when the service can't support itself. The high end of the fines are high, but that is the only way to get companies like FB and Google to fully comply. Hopefully spammers who I never gave consent to email me will also get put out of business, but they are like cockroaches and impossible to kill. [1] There are other points like you can't force consent, i.e. download this white paper only after you consent to accept marketing emails.

downandout 8y ago
If you follow those steps you have complied with the spirit of the law The spirit of the law is not the letter of the law. And as we all know, a single violation of the letter of the law can result in fines of up to $20 million.
- dvfjsdhgfv 8y ago
  No, this is not how the law works, at least not in Europe. While doing business in Europe I sometimes got some things wrong, for example with taxes. I wasn't really punished even once - I just had to pay what was missing and correct the documents, even if the maximum punishment for what I did (or failed to do) was some years in jail.