3 ms·

I'm just getting really tired of people that hysterically throw around large numbers in order to instill fear. The large numbers ARE BUILT INTO THE LAW you are

I'm just getting really tired of people that hysterically throw around large numbers in order to instill fear. The large numbers ARE BUILT INTO THE LAW you are so vehemently defending. We are just supposed to ignore them? Pretend they don’t exist? Everyone should be afraid of laws that offer possible massive fines that are incredibly easy to violate on technicalities.

DanBC 8y ago
The numbers are the MAXIMUM POSSIBLE fine, for the most serious, repeated breach. Here's an organisation that lost video interviews of children who'd been sexually abused because the organisation sent unencrpyted DVDs via mail. This was a repeat occurance of a very similar thing they did before. They didn't get the maximum fine. https://ico.org.uk/action-weve-taken/enforcement/crown-prosecution-service/ https://ico.org.uk/action-weve-taken/enforcement/crown-prose... Here's an organisation that lost half a million customers details (names, addresses, and telephone numbers) because they lost some unencrypted backup tapes. Again, they were not fined the maximum: https://ico.org.uk/for-organisations/guide-to-data-protection/encryption/scenarios/backups/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Here's an organisation that is handling sensitive personal data - medical data - who had a legal obligation to register with ICO. They didn't. They didn't even get a fine. (Last para) https://www.bloomberg.com/news/articles/2018-04-26/u-k-healthcare-startup-cera-is-said-to-have-posted-fake-reviews https://www.bloomberg.com/news/articles/2018-04-26/u-k-healt... We have countless examples of severe data breaches for dumb stuff, and the maximum fine is never ever applied.
- downandout 8y ago
  The fines you mention - 325,000 EUR and 150,000 EUR - seem pretty stiff to me and would kill most small businesses. They aren’t the maximum, but that doesn’t really matter if the fine is a death sentence for your business. I’m not sure how any of this makes the point you seem to be trying to make that GDPR is lenient.

DanBC 8y ago

The numbers are the MAXIMUM POSSIBLE fine, for the most serious, repeated breach. Here's an organisation that lost video interviews of children who'd been sexually abused because the organisation sent unencrpyted DVDs via mail. This was a repeat occurance of a very similar thing they did before. They didn't get the maximum fine. https://ico.org.uk/action-weve-taken/enforcement/crown-prosecution-service/ https://ico.org.uk/action-weve-taken/enforcement/crown-prose... Here's an organisation that lost half a million customers details (names, addresses, and telephone numbers) because they lost some unencrypted backup tapes. Again, they were not fined the maximum: https://ico.org.uk/for-organisations/guide-to-data-protection/encryption/scenarios/backups/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Here's an organisation that is handling sensitive personal data - medical data - who had a legal obligation to register with ICO. They didn't. They didn't even get a fine. (Last para) https://www.bloomberg.com/news/articles/2018-04-26/u-k-healthcare-startup-cera-is-said-to-have-posted-fake-reviews https://www.bloomberg.com/news/articles/2018-04-26/u-k-healt... We have countless examples of severe data breaches for dumb stuff, and the maximum fine is never ever applied.

downandout 8y ago
The fines you mention - 325,000 EUR and 150,000 EUR - seem pretty stiff to me and would kill most small businesses. They aren’t the maximum, but that doesn’t really matter if the fine is a death sentence for your business. I’m not sure how any of this makes the point you seem to be trying to make that GDPR is lenient.