5 ms·
If GDPR was an environment law, it would say, "Hurting the environment means you can be subject to a $20,000,000 fine." Which sounds great! Except the biggest t
by cm2012 8y ago
If GDPR was an environment law, it would say, "Hurting the environment means you can be subject to a $20,000,000 fine." Which sounds great! Except the biggest thing most people can do to hurt the environment, by far, is international flights. And everyone is wondering if the law meant to cover flights. And lots of people are saying, "You shouldn't be flying far anyway." And one expert is saying, obviously flights are excluded, and another is saying, fines are very likely. Etc etc.
- lykr0n 8y ago> subject up to a $20,000,000 fine Up to 4% or 20Mill. A small startup won't get slapped with that size of a fine. If you are worried about those numbers, you should be able to hire a lawyer and ensure you are in compliance.
- Godel_unicode 8y agoIt's whichever is higher, not whichever is lower. In other words, the minimum (higher level, lower level is of course lower) fine is €20m. https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/
- jacquesm 8y agoThis has been rehashed to death: the maximum fine is 4% or 20M, the minimum is zero. So the fine is in range(0 ... max(4% gt, 20M)) Ok?
- sanderjd 8y agoBut would you agree that without any history of enforcement to look at yet, it may be prudent to base risk analyses on that maximum number?
- jacquesm 8y agoNo, that would not be prudent. In fact, the opposite.
- sanderjd 8y agoWhy?
- jacquesm 8y agoBecause of the evidence documenting the last 20+ years of enforcement.
- sanderjd 8y agoEnforcement of which regulations? Do you mean all commercial enforcement in the EU's history, or enforcement of internet related technologies specifically? I'm not trying to be dense, I suspect you know more about this than me, so I'm honestly curious what makes you confident about restraint in enforcement of regulations affecting small businesses on the internet.
- TheCoelacanth 8y agoIf you base all of your business decisions on the worst possible scenario, then you simply aren't going to run a business at all. That is true both before and after GDPR. Some level of risk is inherent in all business activities.
- sanderjd 8y agoBut most risks can be evaluated. How does one evaluate this risk?
- DanBC 8y agoNo. The law lists the maxium possible fine under the worst situation. The absolute maximum available is 4% or €20m, whichever is higher, but the actual fine imposed is always going to be less than this. We know this because after 20 years of existing data protection law the maximum fines have never been imposed.
- Tomte 8y agoAs I cited in another GDPR thread: the data protection authority of Saxony, for example, handed out less than 50 fines in two years, with an average of less than 3000 Euros.
- TheCoelacanth 8y agoThe minimum value possible for the maximum fine is €20m. The minimum fine is €0.
- cm2012 8y agoI can't reply directly to lykr0n due to HN reply rules, but it's 4% or 20 mil, whichever is higher, not whichever is lower.
- tome 8y ago(FYI generally you can reply if you click the time of the post to go through to a page containing only the comment you want to reply to)
- criddell 8y agoThere may be a great deal of uncertainty now, but things will eventually be settled. If you are worried about being subject to a twenty million dollar fine, then you can probably afford to hire a lawyer to respond to the multiple warnings you will get before any fine is levied.