4 ms·

Liability for what? $20 million in fines that - despite the protestations of everyone that has ever commented in these threads - can be imposed for a first, s

Liability for what? $20 million in fines that - despite the protestations of everyone that has ever commented in these threads - can be imposed for a first, single violation, without any warnings. If they meant for there to be any safeguards for companies, that language would have been built into the GDPR. But it wasn't. There are no limits, other than $10/$20 million.

einarfd 8y ago
People have tried to have insurance against speeding tickets in my part of the world (Scandinavia), and those have been deemed illegal and stopped from paying out. I would expect a GDPR insurance would end up getting the same treatment. I can't guarantee that this would happen in all of Europe, but I do expect it would. When it comes to getting the max fine at first strike. The GDPR is not the first law in the EU with teeth. There are strict laws about corruption, pollution and antitrust here as well. Do companies get dinged with max penalty from the start violating these laws, not that I've seen. Why should enforcement of the GDPR be different from the current laws?
hluska 8y ago
Do yourself a favour. Spend some time and read other EU laws with teeth. Look at the theoretical maximum versus the practical. Then come back and try these same arguments.
- Karunamon 8y ago
  I don't care what the regulators might assess as a fine out of the goodness of their heart or how annoyed they are or how late they ate lunch that day[1]. I care what the law says and provides for. http://blogs.discovermagazine.com/notrocketscience/2011/04/11/justice-is-served-but-more-so-after-lunch-how-food-breaks-sway-the-decisions-of-judges/ http://blogs.discovermagazine.com/notrocketscience/2011/04/1...
  - hluska 8y ago
    Then, you should give articles 58 and 83 a read. 58 details EU powers under GDPR. 83 details the factors that should be taken into account before levying administrative fines. In 83, you'll notice that the character of the infringement and any acts to mitigate the damage of the infringement are relevant. GDPR has strong language around the purpose of fines and the kinds of considerations that should be made before imposing them. Being overly punitive, especially if a company shows good faith effort to comply, would only welcome judicial oversight. What would the EU gain in such a scenario? And what could the EU lose in such a scenario?
    - downandout 8y ago
      What would the EU gain in such a scenario? And what could the EU lose in such a scenario? It gains the millions of dollars from the fines, in addition to aiding local EU competitors by bankrupting or hobbling their international foes. It loses nothing. You can’t see why that’s an incentive and indeed an invitation to abuse GDPR?
      - hluska 8y ago
        That's highly unlikely. First, I have significant trouble believing that the entire European Union would collude to attack international companies in favour of local companies. For a perfect example of this, do some research into the International Procurement Instrument. The IPI is an example of when the EU as a whole has bent over backwards to make sure that non-EU companies have fair access to EU public contracts, even if the playing fields are not level and EU companies don't have equivalent access to the non-EU markets. I assume that you're North American (I am too), so reading about the IPI will seem like comedy hour at Bizarro world, particularly when you see how difficult protectionism is in the EU. Second, it's worth noting that your scenario as described gets uncomfortably close to a definition of passive corruption. Again, I have significant trouble believing that you could get so many people to agree to do something so potentially explosive. And third, the EU currently has a very strong tool in its arsenal to enhance data security. The GDPR is very strong because it's ambiguous and people like you are scared of it. The moment that GDPR starts to face legal challenges, that ambiguity will get chipped away.
jdietrich 8y ago
European courts and regulatory agencies are not run by gibbering morons. They do not levy multimillion dollar fines against small businesses for making honest mistakes. Art. 83(1) of the GDPR explicitly states that fines must be proportionate. Art. 83(2) states that fines must take into account the number of subjects affected, the level of damage suffered, the intentional or negligent character of the infringement, action taken to mitigate the breach, previous breaches and any other aggravating or mitigating factors. The GDPR replaces the Data Protection Directive, which left the levels of penalty to the discretion of individual member states. In the UK, the maximum fine for a breach of the Data Protection Act (the British implementation of the DPD) is £500,000. You can see a full list of enforcement action taken by the Information Commissioner's Office at the link below. I defy you to find a single example of a monetary penalty that was disproportionate. https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/

einarfd 8y ago

People have tried to have insurance against speeding tickets in my part of the world (Scandinavia), and those have been deemed illegal and stopped from paying out. I would expect a GDPR insurance would end up getting the same treatment. I can't guarantee that this would happen in all of Europe, but I do expect it would. When it comes to getting the max fine at first strike. The GDPR is not the first law in the EU with teeth. There are strict laws about corruption, pollution and antitrust here as well. Do companies get dinged with max penalty from the start violating these laws, not that I've seen. Why should enforcement of the GDPR be different from the current laws?

hluska 8y ago

Do yourself a favour. Spend some time and read other EU laws with teeth. Look at the theoretical maximum versus the practical. Then come back and try these same arguments.

Karunamon 8y ago
I don't care what the regulators might assess as a fine out of the goodness of their heart or how annoyed they are or how late they ate lunch that day[1]. I care what the law says and provides for. http://blogs.discovermagazine.com/notrocketscience/2011/04/11/justice-is-served-but-more-so-after-lunch-how-food-breaks-sway-the-decisions-of-judges/ http://blogs.discovermagazine.com/notrocketscience/2011/04/1...
- hluska 8y ago
  Then, you should give articles 58 and 83 a read. 58 details EU powers under GDPR. 83 details the factors that should be taken into account before levying administrative fines. In 83, you'll notice that the character of the infringement and any acts to mitigate the damage of the infringement are relevant. GDPR has strong language around the purpose of fines and the kinds of considerations that should be made before imposing them. Being overly punitive, especially if a company shows good faith effort to comply, would only welcome judicial oversight. What would the EU gain in such a scenario? And what could the EU lose in such a scenario?
  - downandout 8y ago
    What would the EU gain in such a scenario? And what could the EU lose in such a scenario? It gains the millions of dollars from the fines, in addition to aiding local EU competitors by bankrupting or hobbling their international foes. It loses nothing. You can’t see why that’s an incentive and indeed an invitation to abuse GDPR?
    - hluska 8y ago
      That's highly unlikely. First, I have significant trouble believing that the entire European Union would collude to attack international companies in favour of local companies. For a perfect example of this, do some research into the International Procurement Instrument. The IPI is an example of when the EU as a whole has bent over backwards to make sure that non-EU companies have fair access to EU public contracts, even if the playing fields are not level and EU companies don't have equivalent access to the non-EU markets. I assume that you're North American (I am too), so reading about the IPI will seem like comedy hour at Bizarro world, particularly when you see how difficult protectionism is in the EU. Second, it's worth noting that your scenario as described gets uncomfortably close to a definition of passive corruption. Again, I have significant trouble believing that you could get so many people to agree to do something so potentially explosive. And third, the EU currently has a very strong tool in its arsenal to enhance data security. The GDPR is very strong because it's ambiguous and people like you are scared of it. The moment that GDPR starts to face legal challenges, that ambiguity will get chipped away.

jdietrich 8y ago

European courts and regulatory agencies are not run by gibbering morons. They do not levy multimillion dollar fines against small businesses for making honest mistakes. Art. 83(1) of the GDPR explicitly states that fines must be proportionate. Art. 83(2) states that fines must take into account the number of subjects affected, the level of damage suffered, the intentional or negligent character of the infringement, action taken to mitigate the breach, previous breaches and any other aggravating or mitigating factors. The GDPR replaces the Data Protection Directive, which left the levels of penalty to the discretion of individual member states. In the UK, the maximum fine for a breach of the Data Protection Act (the British implementation of the DPD) is £500,000. You can see a full list of enforcement action taken by the Information Commissioner's Office at the link below. I defy you to find a single example of a monetary penalty that was disproportionate. https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/