4 ms·

Please folks, GDPR investigations are only undertaken by the EU. No single actor can try to 'sue' you for infringment. The maximum they can do is to complain to

Please folks, GDPR investigations are only undertaken by the EU. No single actor can try to 'sue' you for infringment. The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years. Don't be afraid, if you receive one of those letters just ignore it.

vertex-four 8y ago
If your failure to comply with the GDPR has cost someone damages, they can recover those damages in civil court by suing you, though.
- gsnedders 8y ago
  But, unlike the US, in most (all?) of the EU, the most you can sue for damages is the total damages incurred (plus court expenses).
  - deleted 8y ago
    [deleted]
- 0x4f3759df 8y ago
  What's "damages"? Does "emotional distress" count?
  - vertex-four 8y ago
    Emotional distress isn’t a thing in the EU in general, and definitely not out of proportion to actual damages. If someone incurred costs as a result of your failure to comply with the GDPR, those would be damages. If, for some reason, they wound up in therapy as a result of your failure to comply and had to pay money/take holidays from work/etc for that, that’d be the closest thing to emotional distress we have.
- ainiriand 8y ago
  Fines are not always incurred for GDPR infringements. Sometimes you can be asked to delete the data, to block dealing with EU customers, etc...
  - vertex-four 8y ago
    Sure, and in fact that’s meant to be the primary enforcement mechanism. But fines aren’t what I’m talking about there - civil lawsuits without a regulator involved are possible under the GDPR, although their potential damage is limited to actual damages and the cost of hiring a lawyer.
    - ainiriand 8y ago
      The first enforcement mechanism is going to be a letter detailing the complaint and asking for information about how you deal with user's data. If they think you are not handling it properly, you are asked to change it, that's it.
jacquesm 8y ago
> Don't be afraid, if you receive one of those letters just ignore it. You probably should not be making such blanket statements. Keep in mind that the companies that receive such requests may have substantial assets in the EU (or may even be based entirely in the EU). This is akin to telling people to break copyright law because the courts are too busy to go after everybody and it could take years before it is your turn.
- ainiriand 8y ago
  Take a look at my comment above. Disclaimer: We are a GDPR model company in Ireland. This means that we are implementing the mechanisms that the country is going to take as default for every other company. We had EU folks over here for months.
  - jacquesm 8y ago
    > Take a look at my comment above. I'm assuming everybody responding to you did just that so this is a null statement. > Disclaimer: We are a GDPR model company in Ireland. This means that we are implementing the mechanisms that the country is going to take as default for every other company. We had EU folks over here for months. So it's do as I say, not as I do.
- ainiriand 8y ago
  You know the concept of FUD. We saw it many times before. Please take a look at the full enforcement process: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... You don't have to take my word for it, this is not legal counsel, it is just reading the law before jumping to extreme conclusions.
  - jacquesm 8y ago
    I'll happily bet that I spent more time reading the GDPR than you did (such as: for the last year as a part of my day job) and you are spreading some pretty dangerous information in this thread up to and including telling people to ignore legitimate requests under the law. If you give out that kind of advise and in such an unqualified manner you should not then follow up by saying that 'this is not legal counsel'. A DSAR is a legitimate request under the law if you feel that this particular letter is not a legitimate request then you should address that with specifics.
JumpCrisscross 8y ago
> The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years. Years of regulatory investigation sounds expensive. Furthermore, willfully ignoring regulators is a good way to piss them off. The only winning strategies here are (a) lawyer and lobbyist up and (b) block users in countries where you don't have (a).
- ainiriand 8y ago
  Take a small look a the overall process here: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... First you should receive an enquiry about yor DPA asking for the information they need and your processes, if they deem it necessary they will do an in-depth investigation. After that, they can reach a conclusion. Then if you are still not GDPR complaint, you will be fined.
  - JumpCrisscross 8y ago
    Each of the EU's twenty-eight members will have their own interpretation of the process. In any case, the fines aren't the problem. It's the cost and distraction of going through this process. That cost is imposed irrespective of whether one is doing everything correctly. Responding to DPA requests, investigations, et cetera is a reasonable burden for a company like Facebook. For many start-ups, it may make sense to partition and/or delay their European roll-outs.
    - ainiriand 8y ago
      But as the PDF says, fines are an exception. There are other machanisms to protect the users.
      - JumpCrisscross 8y ago
        > In any case, the fines aren't the problem. It's the cost and distraction of going through this process. >> fines are an exception. There are other machanisms to protect the users Fines aren’t the problem. It’s the cost and distraction of going through this process. Those “other mechanisms” are still costly and distracting, even if you did nothing wrong.
junto 8y ago
I think that the primary target for GDPR investigations is going to be the big actors like Facebook, Google and Advertising networks who's single business model is profiting from user data. Big online marketing companies are looking at a variety of technologies to turn their user's into buying customers of their advertising customers both online and in-store. Look at Facebook as an example with their dreadful user interface attempt to trick EU customers into opting-in to facial recognition technology. https://venturebeat.com/2018/04/18/facebook-engages-in-privacy-zuckering-to-get-user-consent-for-facial-recognition/ https://venturebeat.com/2018/04/18/facebook-engages-in-priva... But there's a good reason for this. The ability for stores to know who their customer is, what they buy and re-market to them is powerful, and incredibly creepy. https://www.pymnts.com/facebook/2017/facebook-patent-facial-recognition-authentication/ https://www.pymnts.com/facebook/2017/facebook-patent-facial-... http://www.thedrum.com/news/2017/12/01/facebook-reportedly-develop-facial-recognition-technology-help-shops-enhance http://www.thedrum.com/news/2017/12/01/facebook-reportedly-d... I now turn my phone into flight mode before I enter a high street store. https://www.kaspersky.com/blog/offline-tracking-ads/16510/ https://www.kaspersky.com/blog/offline-tracking-ads/16510/ GDPR is a good reminder to all companies that the individual user owns their data, not the company. I personally like this shift, which will over time make companies think about the business models they implement, encouraging us to have customers rather than users.

vertex-four 8y ago

If your failure to comply with the GDPR has cost someone damages, they can recover those damages in civil court by suing you, though.

gsnedders 8y ago
But, unlike the US, in most (all?) of the EU, the most you can sue for damages is the total damages incurred (plus court expenses).
- deleted 8y ago
  [deleted]
0x4f3759df 8y ago
What's "damages"? Does "emotional distress" count?
- vertex-four 8y ago
  Emotional distress isn’t a thing in the EU in general, and definitely not out of proportion to actual damages. If someone incurred costs as a result of your failure to comply with the GDPR, those would be damages. If, for some reason, they wound up in therapy as a result of your failure to comply and had to pay money/take holidays from work/etc for that, that’d be the closest thing to emotional distress we have.
ainiriand 8y ago
Fines are not always incurred for GDPR infringements. Sometimes you can be asked to delete the data, to block dealing with EU customers, etc...
- vertex-four 8y ago
  Sure, and in fact that’s meant to be the primary enforcement mechanism. But fines aren’t what I’m talking about there - civil lawsuits without a regulator involved are possible under the GDPR, although their potential damage is limited to actual damages and the cost of hiring a lawyer.
  - ainiriand 8y ago
    The first enforcement mechanism is going to be a letter detailing the complaint and asking for information about how you deal with user's data. If they think you are not handling it properly, you are asked to change it, that's it.

jacquesm 8y ago

> Don't be afraid, if you receive one of those letters just ignore it. You probably should not be making such blanket statements. Keep in mind that the companies that receive such requests may have substantial assets in the EU (or may even be based entirely in the EU). This is akin to telling people to break copyright law because the courts are too busy to go after everybody and it could take years before it is your turn.

ainiriand 8y ago
Take a look at my comment above. Disclaimer: We are a GDPR model company in Ireland. This means that we are implementing the mechanisms that the country is going to take as default for every other company. We had EU folks over here for months.
- jacquesm 8y ago
  > Take a look at my comment above. I'm assuming everybody responding to you did just that so this is a null statement. > Disclaimer: We are a GDPR model company in Ireland. This means that we are implementing the mechanisms that the country is going to take as default for every other company. We had EU folks over here for months. So it's do as I say, not as I do.
ainiriand 8y ago
You know the concept of FUD. We saw it many times before. Please take a look at the full enforcement process: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... You don't have to take my word for it, this is not legal counsel, it is just reading the law before jumping to extreme conclusions.
- jacquesm 8y ago
  I'll happily bet that I spent more time reading the GDPR than you did (such as: for the last year as a part of my day job) and you are spreading some pretty dangerous information in this thread up to and including telling people to ignore legitimate requests under the law. If you give out that kind of advise and in such an unqualified manner you should not then follow up by saying that 'this is not legal counsel'. A DSAR is a legitimate request under the law if you feel that this particular letter is not a legitimate request then you should address that with specifics.

JumpCrisscross 8y ago

> The maximum they can do is to complain to the GDPR office in your country. And then, maybe, the office is gonna undertake an investigation. This whole is process can be a matter of years. Years of regulatory investigation sounds expensive. Furthermore, willfully ignoring regulators is a good way to piss them off. The only winning strategies here are (a) lawyer and lobbyist up and (b) block users in countries where you don't have (a).

ainiriand 8y ago
Take a small look a the overall process here: https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-role-edpb_en.pdf https://ec.europa.eu/commission/sites/beta-political/files/d... First you should receive an enquiry about yor DPA asking for the information they need and your processes, if they deem it necessary they will do an in-depth investigation. After that, they can reach a conclusion. Then if you are still not GDPR complaint, you will be fined.
- JumpCrisscross 8y ago
  Each of the EU's twenty-eight members will have their own interpretation of the process. In any case, the fines aren't the problem. It's the cost and distraction of going through this process. That cost is imposed irrespective of whether one is doing everything correctly. Responding to DPA requests, investigations, et cetera is a reasonable burden for a company like Facebook. For many start-ups, it may make sense to partition and/or delay their European roll-outs.
  - ainiriand 8y ago
    But as the PDF says, fines are an exception. There are other machanisms to protect the users.
    - JumpCrisscross 8y ago
      > In any case, the fines aren't the problem. It's the cost and distraction of going through this process. >> fines are an exception. There are other machanisms to protect the users Fines aren’t the problem. It’s the cost and distraction of going through this process. Those “other mechanisms” are still costly and distracting, even if you did nothing wrong.

junto 8y ago

I think that the primary target for GDPR investigations is going to be the big actors like Facebook, Google and Advertising networks who's single business model is profiting from user data. Big online marketing companies are looking at a variety of technologies to turn their user's into buying customers of their advertising customers both online and in-store. Look at Facebook as an example with their dreadful user interface attempt to trick EU customers into opting-in to facial recognition technology. https://venturebeat.com/2018/04/18/facebook-engages-in-privacy-zuckering-to-get-user-consent-for-facial-recognition/ https://venturebeat.com/2018/04/18/facebook-engages-in-priva... But there's a good reason for this. The ability for stores to know who their customer is, what they buy and re-market to them is powerful, and incredibly creepy. https://www.pymnts.com/facebook/2017/facebook-patent-facial-recognition-authentication/ https://www.pymnts.com/facebook/2017/facebook-patent-facial-... http://www.thedrum.com/news/2017/12/01/facebook-reportedly-develop-facial-recognition-technology-help-shops-enhance http://www.thedrum.com/news/2017/12/01/facebook-reportedly-d... I now turn my phone into flight mode before I enter a high street store. https://www.kaspersky.com/blog/offline-tracking-ads/16510/ https://www.kaspersky.com/blog/offline-tracking-ads/16510/ GDPR is a good reminder to all companies that the individual user owns their data, not the company. I personally like this shift, which will over time make companies think about the business models they implement, encouraging us to have customers rather than users.