4 ms·

The problem is that there is a lower floor of a $20m fine. Big corps can risk a 4% hit, but for anyone struggling to get a small startup off the ground the fine

The problem is that there is a lower floor of a $20m fine. Big corps can risk a 4% hit, but for anyone struggling to get a small startup off the ground the fine is too onerous. As far as I'm concerned the process should be like this: 1. EU issues warning and cuts off traffic to the domain after 30 days. 2. Startup fixes GDPR compliance. 3. EU unblocks startup. Only after the company breaks GDPR after getting unblocked should they be hit with this massive fine. For those of us that don't give a shit about Europe it's so frustrating having to worry about how we have to comply. And before someone says something about "it's only for companies targeting the EU" that isn't as clear as people make it out to be. An errant ad, or a single conference talk, or even engagement on social media can be construed into requiring GDPR compliance. But of course the reason the EU didn't want to block corporations flouting the GDPR technically is because they saw the arms race happening in China and decided that they didn't want a second firewall. So instead they went the lazy route and they pushed the whole mess on small startups that aren't the problem in the first place. Large corporations are the problem. The fundamental design of the internet and web is the problem.

Tomte 8y ago
> The problem is that there is a lower floor of a $20m fine I don‘t believe that you truly believe that, after it has been refuted a dozen times in every single GDPR discussion. There is no lower floor. There is not even an obligation to hand out fines.
- Mirioron 8y ago
  There is nothing stopping them from doing so though. Maybe they're having a bad day or simply don't like you very much. Some of the data protection authorities have like one to two dozen people working at it total.
  - Tomte 8y ago
    There is a lot stopping them, namely the law itself and the courts. But that is irrelevant in this thread. There is no lower floor. That was a lie! The authorities can easily fine someone a thousand Euros or a million Euros.
    - Mirioron 8y ago
      You mention the law here. Where in the law does it indicate that the DPA can't assign the maximum fine on the first offense even if it is trivial?
      - detaro 8y ago
        In the long list of factors to consider when determining the fine, which the DPA will be found to not have given the legally required consideration on appeal of the fine, if you assume a DPA is going to be stupid enough to try.
      - Tomte 8y ago
        Search for the word "proportionate". Again, you're derailing. I was replying to the claim that no fine lower than 20 million Euros could possibly be imposed.
    - relics443 8y ago
      Oh the law. Good one. The same law that fined me $1,800 because a posted notice fell off my door in a blizzard? The same law that allowed the judge to uphold the fine by saying "I don't believe you". Bureaucracy sucks, and the second it gets its tentacles on you, no amount of cheek clenching is gonna delay the inevitable.
GiuseppaAcciaio 8y ago
It's not a 20m / 4% floor, the fines will be discretionary and most importantly are likely to be incremental. EU regulatory authorities do not usually operate in a "shut your service off for non-compliance" mode: assuming they receive a tip-off about your business not being compliant with GDPR 1) they send you a notice and ask for proof of compliance. If you produce evidence, the case is likely closed. 2) assuming you can't produce that evidence, they will give you a warning and a deadline by which to become compliant. A small fine may be levied at this time 3) if the deadline passes without you having done anything, they will eventually get round to giving you a new date, issue a sterner warning and increase the fine for non compliance. To get a $20m fine you'd have to be a massive corporation and be caught repeatedly flaunting the regulation in an outrageous and damaging way (for the consumer); any idea of closing off your small service / website / whatever to EU users because of the perceived risk of a fine is a massive overreaction.
- 3pt14159 8y ago
  The max fine is 4% with a $20m floor. People play games with language and try to pretend that just because judges have discretion that this isn't somehow ridiculous. It is not mandatory that the EU issue a warning. What the EU should have done if they didn't want small startup owners to freak out is they should have made the process clearer and if the $20m level is only aimed at massive corporations then why make it $20m at all? Why not just make it 10% of revenue? I'm not from the EU, I have no idea how the EU court system works. They did not make this easy for small startups.
  - GiuseppaAcciaio 8y ago
    Let's read the actual document then shall we? It's written in plain enough language for anyone to understand: http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 20m is one of the two ceilings (the other being 10m) for fines, and in several paragraphs in the document I linked the principles of discretionality, effectiveness and proportionality are stated. If a regulator tried to levy a $20m fine against a startup for a first offence, there would be a strong case to appeal the ruling at an EU court

Tomte 8y ago

> The problem is that there is a lower floor of a $20m fine I don‘t believe that you truly believe that, after it has been refuted a dozen times in every single GDPR discussion. There is no lower floor. There is not even an obligation to hand out fines.

Mirioron 8y ago
There is nothing stopping them from doing so though. Maybe they're having a bad day or simply don't like you very much. Some of the data protection authorities have like one to two dozen people working at it total.
- Tomte 8y ago
  There is a lot stopping them, namely the law itself and the courts. But that is irrelevant in this thread. There is no lower floor. That was a lie! The authorities can easily fine someone a thousand Euros or a million Euros.
  - Mirioron 8y ago
    You mention the law here. Where in the law does it indicate that the DPA can't assign the maximum fine on the first offense even if it is trivial?
    - detaro 8y ago
      In the long list of factors to consider when determining the fine, which the DPA will be found to not have given the legally required consideration on appeal of the fine, if you assume a DPA is going to be stupid enough to try.
    - Tomte 8y ago
      Search for the word "proportionate". Again, you're derailing. I was replying to the claim that no fine lower than 20 million Euros could possibly be imposed.
  - relics443 8y ago
    Oh the law. Good one. The same law that fined me $1,800 because a posted notice fell off my door in a blizzard? The same law that allowed the judge to uphold the fine by saying "I don't believe you". Bureaucracy sucks, and the second it gets its tentacles on you, no amount of cheek clenching is gonna delay the inevitable.

GiuseppaAcciaio 8y ago

It's not a 20m / 4% floor, the fines will be discretionary and most importantly are likely to be incremental. EU regulatory authorities do not usually operate in a "shut your service off for non-compliance" mode: assuming they receive a tip-off about your business not being compliant with GDPR 1) they send you a notice and ask for proof of compliance. If you produce evidence, the case is likely closed. 2) assuming you can't produce that evidence, they will give you a warning and a deadline by which to become compliant. A small fine may be levied at this time 3) if the deadline passes without you having done anything, they will eventually get round to giving you a new date, issue a sterner warning and increase the fine for non compliance. To get a $20m fine you'd have to be a massive corporation and be caught repeatedly flaunting the regulation in an outrageous and damaging way (for the consumer); any idea of closing off your small service / website / whatever to EU users because of the perceived risk of a fine is a massive overreaction.

3pt14159 8y ago
The max fine is 4% with a $20m floor. People play games with language and try to pretend that just because judges have discretion that this isn't somehow ridiculous. It is not mandatory that the EU issue a warning. What the EU should have done if they didn't want small startup owners to freak out is they should have made the process clearer and if the $20m level is only aimed at massive corporations then why make it $20m at all? Why not just make it 10% of revenue? I'm not from the EU, I have no idea how the EU court system works. They did not make this easy for small startups.
- GiuseppaAcciaio 8y ago
  Let's read the actual document then shall we? It's written in plain enough language for anyone to understand: http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 20m is one of the two ceilings (the other being 10m) for fines, and in several paragraphs in the document I linked the principles of discretionality, effectiveness and proportionality are stated. If a regulator tried to levy a $20m fine against a startup for a first offence, there would be a strong case to appeal the ruling at an EU court