4 ms·

> a single violation would financially destroy the company If you refer to the flowchart on how enforcement is to be handled (notably including referring to "p

> a single violation would financially destroy the company If you refer to the flowchart on how enforcement is to be handled (notably including referring to "proportionate"), the FAQs on regulator sites, and even the track record of penalties under DPA you'll find this is not the case. Why there are some who keep wanting to catastrophise this is beyond me.

downandout 8y ago
I’ve said this repeatedly throughout this thread, and hopefully this will be the last time I have to. So I’ll try to be extremely clear here. There is nothing written in the GDPR limiting the ability of regulators to issue maximum fines for any violation - even the first, minor violation. Not a single sentence. The limits are $10 million for less serious violations and $20 million for more serious ones. If I’m wrong, show me the clause. It simply doesn’t exist. If there were meant to be safeguards, those would have been written into it. They are not. The section you are referring to that uses the word “proportionate” gives a brief list of suggestions of the kinds of things that regulators should consider when issuing fines. But it no way limits their legal ability to issue maximum or multimillion dollar fines for minor violations, and doesn’t even define “proportionate”. A hardline country like Germany may easily decide that because they so value their privacy, “proportionate” is a maximum fine for a single violation.
- germanier 8y ago
  No, Germany could not issue such a fine for a minor single violation. "Proportionate" is a so-called indeterminate legal term that is open to full judicial review with no interpretative power left to the administration. Our law is littered with clauses stating "fines up to 50 Mio. €" and courts have developed a system of how to make sure everyone gets treated fairly. Other European countries have the same. This is simply a difference in legal traditions between Europe and the US. We don't simply cling onto the exact text of a law and call it a day. Interpretation of laws goes far beyond that. It may be scary to someone not used to such clauses but I can assure you companies around here do business just fine even though they have to comply with a long list of such laws threatening fines this high. Anyway, "proportionate" isn't as ill-defined as you claim. It's a term of art used in many laws and we (and the courts) know pretty well what the legislator meant with it. Heck, they even list some criteria. If those aren't fulfilled a maximum fine isn't possible. Also, "proportionate" implies that a more severe violation must have a higher fine meaning the maximum can hardly ever be reached. A law isn't code and shouldn't be read as such.
  - downandout 8y ago
    No, Germany could not issue such a fine for a minor single violation Yes, they could, as is clearly stated within the text of the GDPR. Regardless, most websites outside the EU aren't going to want to put up with the headache, and will block EU traffic. Who wants the risk?
    - germanier 8y ago
      The text of the GDPR is not the whole body of law. It exists within an old and large legal framework. You can't take just the GDPR and ignore all context around it. And yes, it's much different that what people from other legal traditions are used to. If you don't want to learn about our laws that regulate enforcement of the GDPR – fine. But in that case please stop spreading unwarranted FUD. For example, "due regard shall be given to" has a very specific meaning with decades of precedent and does not mean whatever pops into a layman's head when reading the text.

downandout 8y ago

I’ve said this repeatedly throughout this thread, and hopefully this will be the last time I have to. So I’ll try to be extremely clear here. There is nothing written in the GDPR limiting the ability of regulators to issue maximum fines for any violation - even the first, minor violation. Not a single sentence. The limits are $10 million for less serious violations and $20 million for more serious ones. If I’m wrong, show me the clause. It simply doesn’t exist. If there were meant to be safeguards, those would have been written into it. They are not. The section you are referring to that uses the word “proportionate” gives a brief list of suggestions of the kinds of things that regulators should consider when issuing fines. But it no way limits their legal ability to issue maximum or multimillion dollar fines for minor violations, and doesn’t even define “proportionate”. A hardline country like Germany may easily decide that because they so value their privacy, “proportionate” is a maximum fine for a single violation.

germanier 8y ago
No, Germany could not issue such a fine for a minor single violation. "Proportionate" is a so-called indeterminate legal term that is open to full judicial review with no interpretative power left to the administration. Our law is littered with clauses stating "fines up to 50 Mio. €" and courts have developed a system of how to make sure everyone gets treated fairly. Other European countries have the same. This is simply a difference in legal traditions between Europe and the US. We don't simply cling onto the exact text of a law and call it a day. Interpretation of laws goes far beyond that. It may be scary to someone not used to such clauses but I can assure you companies around here do business just fine even though they have to comply with a long list of such laws threatening fines this high. Anyway, "proportionate" isn't as ill-defined as you claim. It's a term of art used in many laws and we (and the courts) know pretty well what the legislator meant with it. Heck, they even list some criteria. If those aren't fulfilled a maximum fine isn't possible. Also, "proportionate" implies that a more severe violation must have a higher fine meaning the maximum can hardly ever be reached. A law isn't code and shouldn't be read as such.
- downandout 8y ago
  No, Germany could not issue such a fine for a minor single violation Yes, they could, as is clearly stated within the text of the GDPR. Regardless, most websites outside the EU aren't going to want to put up with the headache, and will block EU traffic. Who wants the risk?
  - germanier 8y ago
    The text of the GDPR is not the whole body of law. It exists within an old and large legal framework. You can't take just the GDPR and ignore all context around it. And yes, it's much different that what people from other legal traditions are used to. If you don't want to learn about our laws that regulate enforcement of the GDPR – fine. But in that case please stop spreading unwarranted FUD. For example, "due regard shall be given to" has a very specific meaning with decades of precedent and does not mean whatever pops into a layman's head when reading the text.