17 ms·

There is nothing - and I do mean nothing - written into the GDPR that requires any warnings of any kind, or places any limits on fines, except for $10/$20 milli

There is nothing - and I do mean nothing - written into the GDPR that requires any warnings of any kind, or places any limits on fines, except for $10/$20 million or 4% of revenue, whichever is greater. Period. A multimillion-dollar fine without warning for a first, minor violation is perfectly lawful under GDPR. The idea that "yes it says that but we can trust EU regulators to not assess large fines against foreign companies, even though they would benefit handsomely from them" rings hollow to me.

laumars 8y ago
In principle I might agree with you, however the EU has a long history of striking a fair balance between consumer rights and commercial interests. There is no point, in history, of the EU doing anything remotely like you've described. Which actually gives me more faith in the GDPR than legislation in a corrupt ecosystem as corrupt individuals will find a way to warp legislation in their favor anyway. So yes, I do trust the EU and their history has proven that the aforementioned idea isn't a hollow one.
- deleted 8y ago
  [deleted]
- ajeet_dhaliwal 8y ago
  Related to this, there is a difference in culture that may had add to the fear for people running SMEs outside of Europe. I am talking about a difference in the culture of fines, at least at the local level of government based on my personal experience. When I lived in Canada (and the US briefly) it was common for me to get fined for various trivial offences. I used to joke I should have a fine budget, or at least fine schedule for attending court. The local authorities set speed traps, fine for crossing the road at the wrong place, not shoveling snow quickly etc. My parents in-law and everyone on their whole street got fined for parking their cars on the street by a by-law officer instead of their driveways when the houses were new builds still getting constructed and new drive ways were clearly in the process of being constructed and could not be entered. There was someone in the news who got arrested for not mowing their lawn. I'm not making this up, just do a search, in fact it seems dozens of people have been sent to jail for not paying fines for not keeping up with landscaping in the US. Now since being back in the UK for six years I've not received a single fine, had any interaction with the police or courts. There is a big difference in how fines are applied in Europe and I agree with your comment that I do trust the EU more in this regard, based on the way they operate historically.
  - distances 8y ago
    This is true, I have never received a fine -- and furthermore, I personally don't even know anyone who has received a fine! Could of course be that some did and kept it to themselves.
  - dwild 8y ago
    > Now since being back in the UK for six years I've not received a single fine, had any interaction with the police or courts. I'm 26, have always been Canadian and I never seen what you talk about there. It's disturbing that you had this experience. The only fine I ever heard someone get where relative to the road and were mostly parking and speed tickets. Even then, I also don't know anyone that doesn't drive 120 kph on a 100 kph road and about the parking, the signs are pretty self explanatory (though they can become pretty complicated where there's more than one). If you consider that you follow what any signs, well that would means you shouldn't get any of theses fines. Theses fines are also defined and you know what you risk if you don't follow the signs. Now say the same about GDPR... pretty harder I would say. People drive at 120 on a 100 road and that's alright even though cars kills thousand each year, much more than keeping your shipping information in a database, yet you risk a much bigger fine for keeping that information without following the "signs".
    - hartator 8y ago
      Yes, literally nobody has die for misuse of privacy data, and now you can go to jail over it.
  - merinowool 8y ago
    I think UK is a special case here. In other EU countries it is not uncommon for corrupt civil servants to drown companies in fines to the point of bankruptcy.
- gowld 8y ago
  Considering Europe's history of bloody nationalism, and the recent resurgence in that nationalism, as a non-European I don't trust Europe to refrain from using GDPR to persecute non-European companies.
omginternets 8y ago
>we can trust EU regulators I want to stress that this is a major point of political polarization in Europe at the moment. Even if this claim is true, it warrants a clear and articulated defense.
- sailfast 8y ago
  Also any Americans reading “we can trust X” will likely get a good laugh out of this. It is irresponsible not to assume that if the law is written a certain way then at some point, the law can (and likely will) be enforced that way when it suits the government.
  - justin66 8y ago
    > It is irresponsible not to assume that if the law is written a certain way then at some point, the law can (and likely will) be enforced that way when it suits the government. With the caveat that "the law" in this case isn't just the GDPR, it's the entirety of EU case law. GDPR exists in a particular legal context.
    - sailfast 8y ago
      I get the impression I am misunderstanding EU law (not necessarily a surprise) when folks say things like "Civil law vs. Common Law" or "legal context." If a law is on the books, it can be enforced in the EU, right? I understand there is precedent but precedent is not law, it's merely the common understanding of that law in that particular context. Precedent is overturned all the time (not to mention ignored when convenient), as it should be. Is there a critical difference here that I am not understanding? Perhaps it has to do with the fact that the EU is not a state, but a high level guiding body for a number of states?
      - justin66 8y ago
        That is a fine analysis but I'm not sure what your question is. All laws exist in a legal context and analyzing them while being ignorant of that context is futile. That's all I was saying. I think almost all the people armchair-analyzing the GDPR in a hyperbolic manner would be equally useless at analyzing their own laws, in their own countries, for what it's worth. (someone in another comment said something contrasting the EU with places where laws are "not open to interpretation." Dear lord...) That doesn't mean Jacques' analysis is not worthwhile, by the way. He is not ignorant of the legal context. Judging by the reaction to the article, this is going to be one of those situations where you can lead a horse to water but you can't make him drink.
simion314 8y ago
Isn't there wording that says the punishment is proportional with your transgression?
- oblio 8y ago
  There is... Article 83.
pjc50 8y ago
There is actually an over-arching requirement for proportionality in all EU regulation: https://ukhumanrightsblog.com/2015/06/27/supreme-court-on-eu-and-echr-proportionality-back-to-basics/ https://ukhumanrightsblog.com/2015/06/27/supreme-court-on-eu...
- downandout 8y ago
  But that is in the eye of the beholder. With a maximum fine of $20 million, a country like Germany might say, for example, "Ok, small American company, yours was a minor violation. We'll only assess a $2 million fine - that's only 10% of the maximum! See how lenient and proportional we are? Danke und tschüss!"
  - pjc50 8y ago
    You can litigate disproportionate fines, and there's a general requirement for proportionality in both EU law and under the ECHR. Again, people are assuming that this is the first and only directive that has fines associated with it. It isn't. You don't hear a lot of people talking about the three month prison sentences possible for CE marking, for example - because very few of them have been handed out and only for egregious violations such as unsafe machinery that has caused injury.
    - downandout 8y ago
      You can litigate disproportionate fines Who's to say that 10% of the maximum for a minor violation isn't proportionate? Also, most small businesses do not have the resources to hire competent counsel on the other side of the planet to litigate these things.
      - jbreckmckye 8y ago
        > Who's to say that 10% of the maximum for a minor violation isn't proportionate? A large body of case law, well-defined guidelines for evaluating harms and mapping them to fines, and the EU's general fear of stymieing economically productive activity (the motivation behind GDPR is to enable more data trading, not less, but within better-defined legal boundaries). We have had laws with "open ended" sentencing guidelines since the very beginning of organised society. This is a solved problem.
jdietrich 8y ago
In England and Wales, you could be fined £10^99 for having a crumb of cannabis in your pocket. There is nothing - and I do mean nothing - written in the Misuse of Drugs Act that requires any warnings of any kind, or places any limits on fines. The maximum sentence for possession of a Class B controlled substance is five years imprisonment and an unlimited fine. Period. A fine larger than the number of atoms in the universe is perfectly lawful under the Misuse of Drugs Act. The idea that we can trust judges and sentencing guidelines rings hollow to me.
- pjc50 8y ago
  Yes, but the point I'm trying to get across to people is that there's a general legal requirement that the legal and administrative systems be proportionate, even if it's not incorporated by explicit reference in every piece of legslative text. (I can't lay hands on it at the moment but there are clear guidelines to UK judges on what constitutes reasonable fines for offences, such that it should be feasible for the person to actually pay the fine)
  - jdietrich 8y ago
    There's a proportionality requirement written into the GDPR. The commenter I was replying to is making a completely specious argument. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/
  - merinowool 8y ago
    UK judges don't have to follow the guidelines - these are just guidelines, but judge can use his/hers own discretion within the law. In case of drugs some judges expose almost psychotic hatred towards drug users and can deal punishment outside of the guidelines.
- DanBC 8y ago
  > In England and Wales, you could be fined £10^99 for having a crumb of cannabis in your pocket. There is nothing - and I do mean nothing - written in the Misuse of Drugs Act Not true. https://www.legislation.gov.uk/ukpga/1971/38/section/25 https://www.legislation.gov.uk/ukpga/1971/38/section/25 > The fourth, fifth and sixth columns show respectively the punishments which may be imposed on a person convicted of the offence in the way specified in relation thereto in the third column (that is to say, summarily or on indictment) according to whether the controlled drug in relation to which the offence was committed was a Class A drug, a Class B drug or a Class C drug; and https://www.legislation.gov.uk/ukpga/1971/38/schedule/4 https://www.legislation.gov.uk/ukpga/1971/38/schedule/4 Cannabis is currently class B, thus > [F8 3 months or [F4 £2,500], or both].
raverbashing 8y ago
Yes and there's nothing saying I won't be arrested and thrown into a cell for the rest of my life if I say something incorrect by mistake when entering the US. There's nothing that says IRS won't prosecute you if someone buys you a soda and you don't declare it as income. Or that you won't be prosecuted by someone in the US if your blog has a copyrighted image and you don't receive a DMCA request that was sent to you. See how ridiculous that sounds? All fines can be administratively and judicially appealed.
- downandout 8y ago
  Yes and there's nothing saying I won't be arrested and thrown into a cell for the rest of my life if I say something incorrect by mistake when entering the US. That simply isn't true. That would probably be considered lying to a federal agent. There are strict federal sentencing guidelines that spell out exactly what the sentence should be based on several factors . This is how civilized laws work - you don't simply say "max is $20 million, good luck everybody!"
  - raverbashing 8y ago
    You're right, laws in Europe are uncivilized, maybe that's why they have the highest rate of incarceration in the world.
    - downandout 8y ago
      GDPR is extremely uncivilized. Forgetting the absurd fines and burdens it places on companies for a moment, consider the extraterritorial reach that EU is claiming for itself. The EU has declared itself Grand Emperor of the Internet. Wars have been fought over less.
      - barry-cotter 8y ago
        Many countries believe their law applies extraterritorially. The US Foreign Corrupt Practices Act applies to any company that does any business in the US. A German director of a Canadian company that pays a bribe to an Ethiopian government official can be prosecuted under the FCPA if they set foot in the US. Sweden will prosecute citizens, and I presume residents, who purchase the services of a sex worker abroad. I don’t believe Kim Dotcom ever set foot in the US before the New Zealand government arrested him on foot of a US extradition warrant.
meredydd 8y ago
I think you and everyone making similar points in this thread are getting tripped up by the difference between rules-based regulation and principles-based regulation. This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation. In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an automaton once the rules are set. In principles-based regulation, the rules are extensive rather than complete and you expect the regulator to have some lattitude (and, if the system is well designed, a mechanism of recourse if they do something stupid). An advocate of rules-based regulation would say this can make regulators unpredictable and capricious. An advocate of principles-based regulation would say it is an important safeguard against "rules-lawyering" and regulatory capture (especially the kind that ties new entrants up in check-box compliance that doesn't actually affect your business because all the rules have been worked around). A classic example would be the time PayPal tried to tell the UK regulators they shouldn't be regulated like a financial institution (which is a claim they successfully made in the US). They pointed to chapter and verse of the relevant law, and said that according to subparagraph 2.b.c(iii)... and the relevant regulator essentially told them "shut up, you keep consumers' money for them and will be treated accordingly". As a result, the worst "PayPal took all my money and I can't get it back" stories generally do not come from the UK. (And when they do, they are accompanied by referrals to the Financial Conduct Authority, who have teeth.) You can approve of this way of working or not, but the GDPR is a principles-based regulation, and you'll have to engage with it on those terms.
- ajeet_dhaliwal 8y ago
  This is it. Thank you, I commented about my local experiences with government in Europe and US/Canada but did not know the correct terms and you're right, I think this is the big difference and a driver of fear outside of the EU. In Canada I found the police, by-law enforcers, and almost any official are essentially rules based robots, very much different to my experience in the UK. Thank you for teaching me about rules-based and principles-based regulation. This is one of the big reasons I enjoy living in Europe tbh, a bit of discretion and old 'common sense' is actually quite an awesome thing.
Certhas 8y ago
That is absurd and wrong. The law says the fine needs to be proportionate: GDPR 83.1: Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
- downandout 8y ago
  Proportionate is in the eye of the beholder. As I stated in another response, an example might be that a low-level offense receives a fine of only 10% of the maximum - just $2 million. And apparently I don't need to worry, because I can just spend six figures hiring an attorney in a country I've never been to, who possibly speaks a language I don't, who will fight the case for me if the fine is out of line. Sounds very workable.
  - madmoose 8y ago
    > who possibly speaks a language I don't I'm assuming you speak English. Do you really think there's any lawyer in the EU, competent to litigate EU law, who doesn't speak near-fluent English? (Actually, if the lawyer is from continental Europe, and you only speak English, they do speak at least one language you don't, but I'm guessing that's not what you meant.)
  - Certhas 8y ago
    The mandate of the regulator is to create compliance. Of course any institution can randomly decide to act outside of their mandate. If they would start to do so, the courts would rule them in. Same as anything. Doing business in the US, with it's notion of punitive damages that are completely unconstrained by law is a much larger risk. On that token, have you actually at all looked into how "proportionate" is interpreted legally? After all this isn't new and there are a vast number of regulations using the same legal language. Yet somehow business in Europe has not stopped. So prima facie your concerns are absurd, you have not brought evidence that there is an issue (or anything at all unprecedented really) and I have to wonder what motivates you. As others have said, if you have no interest in complying with laws that protect my privacy, then it's appropriate for you to not do business here.
p49k 8y ago
> A multimillion-dollar fine without warning for a first, minor violation is perfectly lawful under GDPR Come on, this is just scaremongering. Newsflash: If you run a business, you are already responsible for adhering to hundreds of other laws in which the fines could reach millions. But you don't see people running around screaming that the world is ending, because they know that the laws will generally be applied fairly, given that a large economy (like that of the EU) relies on just application of laws to maintain stability. Running a business, like anything else in life, requires the ability to make reasoned choices from somewhat ambiguous data. And the data here is somewhat ambiguous for good reason - it's to prevent businesses from exploiting loopholes and rendering the law ineffective. If you are going to crank the anxiety to 10 every time a situation like this occurs, you probably shouldn't be running a business or handling others' data in the first place.
- frereubu 8y ago
  I have a feeling there are a significant number of people who are young enough to have only worked in digital media, and who aren't used to the idea that businesses are regulated. It's been such a free-for-all until now that they're not used to the idea that there might be externally-imposed limitations on what they can do. I don't mean that in a dismissive way - nobody willingly reads complex legislation in industries that they're not involved in - but it would explain some of the more naive complaints.
- dwild 8y ago
  > you are already responsible for adhering to hundreds of other laws in which the fines could reach millions. Source please? > If you are going to crank the anxiety to 10 every time a situation like this occurs, you probably shouldn't be running a business or handling others' data in the first place. I'm not running one right now. It's not the situation that give me anxiety, it's just that it no longer seems interesting to support European customer for a potential business if that imply that I risk that much over their information. They just removed a big bunch of potential customer for a potential company. I would already try my best to limit the amount of PII but there's many time you just can't. I'm from Quebec. Here we have laws over lottery. You know what it imply? If you make a lottery here in Quebec, you need to follow some simple regulations (I personally know people that did it essentially for fun (not for profit)) so they are pretty easy to follow, and pay the taxes for the winner. You know what I had to endure each time I went on an online contest, a broad exclusion because it was just not worth it to follow theses regulations. It's crazy the number of contest where you could literally do CTRL+F "Quebec" in the rule and find our little province (nowadays I see more of "where law forbid it" or stuff like that, but I haven't try to participate for a long time on a contest either). Do theses companies had too much anxiety for our regulation? None at all, they were some multi billions companies that did this. It was just not worth it.
madeofpalk 8y ago
> If you have a broad distrust of any government activity then I suppose any new laws with "fines up to €X" might feel like "I run a small site on a Digital Ocean droplet and I'm at risk of a €2m fine out of the blue." But that doesn't make it true.
Tomte 8y ago
It doesn‘t need to be written there. It has been written elsewhere, long ago. All state action is subject to judicial review, where proportionality is a big factor. It‘s an aspect of due process that is being reviewed and enforced by every court, up to the constitutional courts. Example: the German criminal code threatens „up to five years“ in prison for theft. That does not mean that a first-time theft of a not-too-valuable object could get you five years. Impossible. But not written in the statute itself. But even if a court was mad enough to hand out such a sentence, the revision stage would be swift and without any uncertainty. Actually, it‘s hard to conceive of a first-time theft-offender going to prison, instead of paying a fine or at least having the prison sentence suspended.

laumars 8y ago

In principle I might agree with you, however the EU has a long history of striking a fair balance between consumer rights and commercial interests. There is no point, in history, of the EU doing anything remotely like you've described. Which actually gives me more faith in the GDPR than legislation in a corrupt ecosystem as corrupt individuals will find a way to warp legislation in their favor anyway. So yes, I do trust the EU and their history has proven that the aforementioned idea isn't a hollow one.

deleted 8y ago
[deleted]
ajeet_dhaliwal 8y ago
Related to this, there is a difference in culture that may had add to the fear for people running SMEs outside of Europe. I am talking about a difference in the culture of fines, at least at the local level of government based on my personal experience. When I lived in Canada (and the US briefly) it was common for me to get fined for various trivial offences. I used to joke I should have a fine budget, or at least fine schedule for attending court. The local authorities set speed traps, fine for crossing the road at the wrong place, not shoveling snow quickly etc. My parents in-law and everyone on their whole street got fined for parking their cars on the street by a by-law officer instead of their driveways when the houses were new builds still getting constructed and new drive ways were clearly in the process of being constructed and could not be entered. There was someone in the news who got arrested for not mowing their lawn. I'm not making this up, just do a search, in fact it seems dozens of people have been sent to jail for not paying fines for not keeping up with landscaping in the US. Now since being back in the UK for six years I've not received a single fine, had any interaction with the police or courts. There is a big difference in how fines are applied in Europe and I agree with your comment that I do trust the EU more in this regard, based on the way they operate historically.
- distances 8y ago
  This is true, I have never received a fine -- and furthermore, I personally don't even know anyone who has received a fine! Could of course be that some did and kept it to themselves.
- dwild 8y ago
  > Now since being back in the UK for six years I've not received a single fine, had any interaction with the police or courts. I'm 26, have always been Canadian and I never seen what you talk about there. It's disturbing that you had this experience. The only fine I ever heard someone get where relative to the road and were mostly parking and speed tickets. Even then, I also don't know anyone that doesn't drive 120 kph on a 100 kph road and about the parking, the signs are pretty self explanatory (though they can become pretty complicated where there's more than one). If you consider that you follow what any signs, well that would means you shouldn't get any of theses fines. Theses fines are also defined and you know what you risk if you don't follow the signs. Now say the same about GDPR... pretty harder I would say. People drive at 120 on a 100 road and that's alright even though cars kills thousand each year, much more than keeping your shipping information in a database, yet you risk a much bigger fine for keeping that information without following the "signs".
  - hartator 8y ago
    Yes, literally nobody has die for misuse of privacy data, and now you can go to jail over it.
- merinowool 8y ago
  I think UK is a special case here. In other EU countries it is not uncommon for corrupt civil servants to drown companies in fines to the point of bankruptcy.
gowld 8y ago
Considering Europe's history of bloody nationalism, and the recent resurgence in that nationalism, as a non-European I don't trust Europe to refrain from using GDPR to persecute non-European companies.

omginternets 8y ago

>we can trust EU regulators I want to stress that this is a major point of political polarization in Europe at the moment. Even if this claim is true, it warrants a clear and articulated defense.

sailfast 8y ago
Also any Americans reading “we can trust X” will likely get a good laugh out of this. It is irresponsible not to assume that if the law is written a certain way then at some point, the law can (and likely will) be enforced that way when it suits the government.
- justin66 8y ago
  > It is irresponsible not to assume that if the law is written a certain way then at some point, the law can (and likely will) be enforced that way when it suits the government. With the caveat that "the law" in this case isn't just the GDPR, it's the entirety of EU case law. GDPR exists in a particular legal context.
  - sailfast 8y ago
    I get the impression I am misunderstanding EU law (not necessarily a surprise) when folks say things like "Civil law vs. Common Law" or "legal context." If a law is on the books, it can be enforced in the EU, right? I understand there is precedent but precedent is not law, it's merely the common understanding of that law in that particular context. Precedent is overturned all the time (not to mention ignored when convenient), as it should be. Is there a critical difference here that I am not understanding? Perhaps it has to do with the fact that the EU is not a state, but a high level guiding body for a number of states?
    - justin66 8y ago
      That is a fine analysis but I'm not sure what your question is. All laws exist in a legal context and analyzing them while being ignorant of that context is futile. That's all I was saying. I think almost all the people armchair-analyzing the GDPR in a hyperbolic manner would be equally useless at analyzing their own laws, in their own countries, for what it's worth. (someone in another comment said something contrasting the EU with places where laws are "not open to interpretation." Dear lord...) That doesn't mean Jacques' analysis is not worthwhile, by the way. He is not ignorant of the legal context. Judging by the reaction to the article, this is going to be one of those situations where you can lead a horse to water but you can't make him drink.

simion314 8y ago

Isn't there wording that says the punishment is proportional with your transgression?

oblio 8y ago
There is... Article 83.

pjc50 8y ago

There is actually an over-arching requirement for proportionality in all EU regulation: https://ukhumanrightsblog.com/2015/06/27/supreme-court-on-eu-and-echr-proportionality-back-to-basics/ https://ukhumanrightsblog.com/2015/06/27/supreme-court-on-eu...

downandout 8y ago
But that is in the eye of the beholder. With a maximum fine of $20 million, a country like Germany might say, for example, "Ok, small American company, yours was a minor violation. We'll only assess a $2 million fine - that's only 10% of the maximum! See how lenient and proportional we are? Danke und tschüss!"
- pjc50 8y ago
  You can litigate disproportionate fines, and there's a general requirement for proportionality in both EU law and under the ECHR. Again, people are assuming that this is the first and only directive that has fines associated with it. It isn't. You don't hear a lot of people talking about the three month prison sentences possible for CE marking, for example - because very few of them have been handed out and only for egregious violations such as unsafe machinery that has caused injury.
  - downandout 8y ago
    You can litigate disproportionate fines Who's to say that 10% of the maximum for a minor violation isn't proportionate? Also, most small businesses do not have the resources to hire competent counsel on the other side of the planet to litigate these things.
    - jbreckmckye 8y ago
      > Who's to say that 10% of the maximum for a minor violation isn't proportionate? A large body of case law, well-defined guidelines for evaluating harms and mapping them to fines, and the EU's general fear of stymieing economically productive activity (the motivation behind GDPR is to enable more data trading, not less, but within better-defined legal boundaries). We have had laws with "open ended" sentencing guidelines since the very beginning of organised society. This is a solved problem.

jdietrich 8y ago

In England and Wales, you could be fined £10^99 for having a crumb of cannabis in your pocket. There is nothing - and I do mean nothing - written in the Misuse of Drugs Act that requires any warnings of any kind, or places any limits on fines. The maximum sentence for possession of a Class B controlled substance is five years imprisonment and an unlimited fine. Period. A fine larger than the number of atoms in the universe is perfectly lawful under the Misuse of Drugs Act. The idea that we can trust judges and sentencing guidelines rings hollow to me.

pjc50 8y ago
Yes, but the point I'm trying to get across to people is that there's a general legal requirement that the legal and administrative systems be proportionate, even if it's not incorporated by explicit reference in every piece of legslative text. (I can't lay hands on it at the moment but there are clear guidelines to UK judges on what constitutes reasonable fines for offences, such that it should be feasible for the person to actually pay the fine)
- jdietrich 8y ago
  There's a proportionality requirement written into the GDPR. The commenter I was replying to is making a completely specious argument. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/
- merinowool 8y ago
  UK judges don't have to follow the guidelines - these are just guidelines, but judge can use his/hers own discretion within the law. In case of drugs some judges expose almost psychotic hatred towards drug users and can deal punishment outside of the guidelines.
DanBC 8y ago
> In England and Wales, you could be fined £10^99 for having a crumb of cannabis in your pocket. There is nothing - and I do mean nothing - written in the Misuse of Drugs Act Not true. https://www.legislation.gov.uk/ukpga/1971/38/section/25 https://www.legislation.gov.uk/ukpga/1971/38/section/25 > The fourth, fifth and sixth columns show respectively the punishments which may be imposed on a person convicted of the offence in the way specified in relation thereto in the third column (that is to say, summarily or on indictment) according to whether the controlled drug in relation to which the offence was committed was a Class A drug, a Class B drug or a Class C drug; and https://www.legislation.gov.uk/ukpga/1971/38/schedule/4 https://www.legislation.gov.uk/ukpga/1971/38/schedule/4 Cannabis is currently class B, thus > [F8 3 months or [F4 £2,500], or both].

raverbashing 8y ago

Yes and there's nothing saying I won't be arrested and thrown into a cell for the rest of my life if I say something incorrect by mistake when entering the US. There's nothing that says IRS won't prosecute you if someone buys you a soda and you don't declare it as income. Or that you won't be prosecuted by someone in the US if your blog has a copyrighted image and you don't receive a DMCA request that was sent to you. See how ridiculous that sounds? All fines can be administratively and judicially appealed.

downandout 8y ago
Yes and there's nothing saying I won't be arrested and thrown into a cell for the rest of my life if I say something incorrect by mistake when entering the US. That simply isn't true. That would probably be considered lying to a federal agent. There are strict federal sentencing guidelines that spell out exactly what the sentence should be based on several factors . This is how civilized laws work - you don't simply say "max is $20 million, good luck everybody!"
- raverbashing 8y ago
  You're right, laws in Europe are uncivilized, maybe that's why they have the highest rate of incarceration in the world.
  - downandout 8y ago
    GDPR is extremely uncivilized. Forgetting the absurd fines and burdens it places on companies for a moment, consider the extraterritorial reach that EU is claiming for itself. The EU has declared itself Grand Emperor of the Internet. Wars have been fought over less.
    - barry-cotter 8y ago
      Many countries believe their law applies extraterritorially. The US Foreign Corrupt Practices Act applies to any company that does any business in the US. A German director of a Canadian company that pays a bribe to an Ethiopian government official can be prosecuted under the FCPA if they set foot in the US. Sweden will prosecute citizens, and I presume residents, who purchase the services of a sex worker abroad. I don’t believe Kim Dotcom ever set foot in the US before the New Zealand government arrested him on foot of a US extradition warrant.

meredydd 8y ago

I think you and everyone making similar points in this thread are getting tripped up by the difference between rules-based regulation and principles-based regulation. This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation. In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an automaton once the rules are set. In principles-based regulation, the rules are extensive rather than complete and you expect the regulator to have some lattitude (and, if the system is well designed, a mechanism of recourse if they do something stupid). An advocate of rules-based regulation would say this can make regulators unpredictable and capricious. An advocate of principles-based regulation would say it is an important safeguard against "rules-lawyering" and regulatory capture (especially the kind that ties new entrants up in check-box compliance that doesn't actually affect your business because all the rules have been worked around). A classic example would be the time PayPal tried to tell the UK regulators they shouldn't be regulated like a financial institution (which is a claim they successfully made in the US). They pointed to chapter and verse of the relevant law, and said that according to subparagraph 2.b.c(iii)... and the relevant regulator essentially told them "shut up, you keep consumers' money for them and will be treated accordingly". As a result, the worst "PayPal took all my money and I can't get it back" stories generally do not come from the UK. (And when they do, they are accompanied by referrals to the Financial Conduct Authority, who have teeth.) You can approve of this way of working or not, but the GDPR is a principles-based regulation, and you'll have to engage with it on those terms.

ajeet_dhaliwal 8y ago
This is it. Thank you, I commented about my local experiences with government in Europe and US/Canada but did not know the correct terms and you're right, I think this is the big difference and a driver of fear outside of the EU. In Canada I found the police, by-law enforcers, and almost any official are essentially rules based robots, very much different to my experience in the UK. Thank you for teaching me about rules-based and principles-based regulation. This is one of the big reasons I enjoy living in Europe tbh, a bit of discretion and old 'common sense' is actually quite an awesome thing.

Certhas 8y ago

That is absurd and wrong. The law says the fine needs to be proportionate: GDPR 83.1: Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.

downandout 8y ago
Proportionate is in the eye of the beholder. As I stated in another response, an example might be that a low-level offense receives a fine of only 10% of the maximum - just $2 million. And apparently I don't need to worry, because I can just spend six figures hiring an attorney in a country I've never been to, who possibly speaks a language I don't, who will fight the case for me if the fine is out of line. Sounds very workable.
- madmoose 8y ago
  > who possibly speaks a language I don't I'm assuming you speak English. Do you really think there's any lawyer in the EU, competent to litigate EU law, who doesn't speak near-fluent English? (Actually, if the lawyer is from continental Europe, and you only speak English, they do speak at least one language you don't, but I'm guessing that's not what you meant.)
- Certhas 8y ago
  The mandate of the regulator is to create compliance. Of course any institution can randomly decide to act outside of their mandate. If they would start to do so, the courts would rule them in. Same as anything. Doing business in the US, with it's notion of punitive damages that are completely unconstrained by law is a much larger risk. On that token, have you actually at all looked into how "proportionate" is interpreted legally? After all this isn't new and there are a vast number of regulations using the same legal language. Yet somehow business in Europe has not stopped. So prima facie your concerns are absurd, you have not brought evidence that there is an issue (or anything at all unprecedented really) and I have to wonder what motivates you. As others have said, if you have no interest in complying with laws that protect my privacy, then it's appropriate for you to not do business here.

p49k 8y ago

> A multimillion-dollar fine without warning for a first, minor violation is perfectly lawful under GDPR Come on, this is just scaremongering. Newsflash: If you run a business, you are already responsible for adhering to hundreds of other laws in which the fines could reach millions. But you don't see people running around screaming that the world is ending, because they know that the laws will generally be applied fairly, given that a large economy (like that of the EU) relies on just application of laws to maintain stability. Running a business, like anything else in life, requires the ability to make reasoned choices from somewhat ambiguous data. And the data here is somewhat ambiguous for good reason - it's to prevent businesses from exploiting loopholes and rendering the law ineffective. If you are going to crank the anxiety to 10 every time a situation like this occurs, you probably shouldn't be running a business or handling others' data in the first place.

frereubu 8y ago
I have a feeling there are a significant number of people who are young enough to have only worked in digital media, and who aren't used to the idea that businesses are regulated. It's been such a free-for-all until now that they're not used to the idea that there might be externally-imposed limitations on what they can do. I don't mean that in a dismissive way - nobody willingly reads complex legislation in industries that they're not involved in - but it would explain some of the more naive complaints.
dwild 8y ago
> you are already responsible for adhering to hundreds of other laws in which the fines could reach millions. Source please? > If you are going to crank the anxiety to 10 every time a situation like this occurs, you probably shouldn't be running a business or handling others' data in the first place. I'm not running one right now. It's not the situation that give me anxiety, it's just that it no longer seems interesting to support European customer for a potential business if that imply that I risk that much over their information. They just removed a big bunch of potential customer for a potential company. I would already try my best to limit the amount of PII but there's many time you just can't. I'm from Quebec. Here we have laws over lottery. You know what it imply? If you make a lottery here in Quebec, you need to follow some simple regulations (I personally know people that did it essentially for fun (not for profit)) so they are pretty easy to follow, and pay the taxes for the winner. You know what I had to endure each time I went on an online contest, a broad exclusion because it was just not worth it to follow theses regulations. It's crazy the number of contest where you could literally do CTRL+F "Quebec" in the rule and find our little province (nowadays I see more of "where law forbid it" or stuff like that, but I haven't try to participate for a long time on a contest either). Do theses companies had too much anxiety for our regulation? None at all, they were some multi billions companies that did this. It was just not worth it.

madeofpalk 8y ago

> If you have a broad distrust of any government activity then I suppose any new laws with "fines up to €X" might feel like "I run a small site on a Digital Ocean droplet and I'm at risk of a €2m fine out of the blue." But that doesn't make it true.

Tomte 8y ago

It doesn‘t need to be written there. It has been written elsewhere, long ago. All state action is subject to judicial review, where proportionality is a big factor. It‘s an aspect of due process that is being reviewed and enforced by every court, up to the constitutional courts. Example: the German criminal code threatens „up to five years“ in prison for theft. That does not mean that a first-time theft of a not-too-valuable object could get you five years. Impossible. But not written in the statute itself. But even if a court was mad enough to hand out such a sentence, the revision stage would be swift and without any uncertainty. Actually, it‘s hard to conceive of a first-time theft-offender going to prison, instead of paying a fine or at least having the prison sentence suspended.