4 ms·

Not yet because it's not even in effect until May 25th. Then enforcement can begin. But yes, in the legal industry we expect it to be very uneven enforcement.

Not yet because it's not even in effect until May 25th. Then enforcement can begin. But yes, in the legal industry we expect it to be very uneven enforcement. The German regulator may be more worked up than the Spanish one, for example. And again, it's going to be low hanging fruit. Why would a regulator bring an enforcement action against some solo practitioner making $100k a year to maybe get $4k in fines when they can go after Facebook?

maxxxxx 8y ago
"Why would a regulator bring an enforcement action against some solo practitioner making $100k a year to maybe get $4k in fines when they can go after Facebook?" Because the little guy won't put up much resistance? I think GDPR is a good thing BTW.
codexon 8y ago
Why would they do 4k in fines when they can charge 20 million euro in fines?
- detaro 8y ago
  Because they can't just charge 20 million, and don't want a court explaining them why?
  - codexon 8y ago
    Have you even read the GDPR? It literally says this. "4% of annual global turnover or €20 Million (whichever is greater)"
    - mrunkel 8y ago
      It literally doesn't. What it literally says is: "...subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher." It also says "...the fines imposed shall be effective, proportionate and dissuasive."
      - codexon 8y ago
        Ok close enough? Forgive me for not remembering the exact wording of the GDPR and taking the first result that comes up on Google. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:" Proportionate how? That's obviously up to them to decide and they probably mean that large companies like Google will be subject to the 4% instead of 20 million euro. Are you going to bet your life savings that they will fine you 4k euro instead of 1 million euro? Why would they bother to add the phrase with "whichever is higher" if they were even going to consider a fine lower than 20 million euro? Think about it. They don't care about the fine being proportionate to the downside, they are just worried about it not being strict enough to companies like Facebook and Google.
        detaro 8y ago
        Really? There is a long list of criteria to consider on that exact page you link, and those will be checked by courts if the DPAs appear unreasonable. I didn't say a 20 million fine is impossible, but it'll need a very good basis. Yes, the maxima are high, but it's crazy to believe the DPAs will be able (both legally and politically) to hand fines even close to that out left and right, even if you assumed they over night suddenly turn into organizations hell-bent to do maximum damage. It's weird how people see that maximum amount and somehow believe those will be the norm, throwing all experience with both the DPAs and other regulations out of the window. How many undeserving businesses have been fined to death in other areas (financial regulation, environmental protection, ...) and why should this suddenly start with privacy law? No government has an interest in its enforcement arm ruining business, of course they care about downsides. Regulation and its enforcement doesn't exist in a vacuum, as much as the revenge-boner some "privacy advocates" (ideally selling some GDPR advice on the side...) get right now wishes it were otherwise. (On the other hand, these numbers seem to be the only thing motivating some business owners to care, so even if they're never used they've served a purpose. Really, the amount of conversations you see that go "And they are complaining that suddenly doing X is so much work", "Didn't they have to do X under previous law as well?" "..." is mind-boggling)

maxxxxx 8y ago

"Why would a regulator bring an enforcement action against some solo practitioner making $100k a year to maybe get $4k in fines when they can go after Facebook?" Because the little guy won't put up much resistance? I think GDPR is a good thing BTW.

codexon 8y ago

Why would they do 4k in fines when they can charge 20 million euro in fines?

detaro 8y ago
Because they can't just charge 20 million, and don't want a court explaining them why?
- codexon 8y ago
  Have you even read the GDPR? It literally says this. "4% of annual global turnover or €20 Million (whichever is greater)"
  - mrunkel 8y ago
    It literally doesn't. What it literally says is: "...subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher." It also says "...the fines imposed shall be effective, proportionate and dissuasive."
    - codexon 8y ago
      Ok close enough? Forgive me for not remembering the exact wording of the GDPR and taking the first result that comes up on Google. https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:" Proportionate how? That's obviously up to them to decide and they probably mean that large companies like Google will be subject to the 4% instead of 20 million euro. Are you going to bet your life savings that they will fine you 4k euro instead of 1 million euro? Why would they bother to add the phrase with "whichever is higher" if they were even going to consider a fine lower than 20 million euro? Think about it. They don't care about the fine being proportionate to the downside, they are just worried about it not being strict enough to companies like Facebook and Google.
      - detaro 8y ago
        Really? There is a long list of criteria to consider on that exact page you link, and those will be checked by courts if the DPAs appear unreasonable. I didn't say a 20 million fine is impossible, but it'll need a very good basis. Yes, the maxima are high, but it's crazy to believe the DPAs will be able (both legally and politically) to hand fines even close to that out left and right, even if you assumed they over night suddenly turn into organizations hell-bent to do maximum damage. It's weird how people see that maximum amount and somehow believe those will be the norm, throwing all experience with both the DPAs and other regulations out of the window. How many undeserving businesses have been fined to death in other areas (financial regulation, environmental protection, ...) and why should this suddenly start with privacy law? No government has an interest in its enforcement arm ruining business, of course they care about downsides. Regulation and its enforcement doesn't exist in a vacuum, as much as the revenge-boner some "privacy advocates" (ideally selling some GDPR advice on the side...) get right now wishes it were otherwise. (On the other hand, these numbers seem to be the only thing motivating some business owners to care, so even if they're never used they've served a purpose. Really, the amount of conversations you see that go "And they are complaining that suddenly doing X is so much work", "Didn't they have to do X under previous law as well?" "..." is mind-boggling)