8 ms·

Just act in good faith and GDPR will not bite. Do you have $20million to make that gamble?

foepys 8y ago
Nobody will fine an open-source project that amount of money. The goal of GDPR is not to bankrupt anybody but to nudge them into compliance. If you aren't maliciously handling user data, you are not a target of high fines.
- malcolmgreaves 8y ago
  Then why does the law not have this an an exemption?
  - tambre 8y ago
    Have what as an exemption? Not applying GDPR to small-time open source projects? Being open source doesn't suddenly make it fine to mishandle users' information.
  - bigbugbag 8y ago
    GDPR has exemptions built in but being open source project is not one.
beberlei 8y ago
20 million is the max penalty for repeat offenders. See article 83 about fines being proportinate to the offense: https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ This is a european thing, if any law says $x is the max fine or alike, then for a first time offense you usually get much less.
- tlrobinson 8y ago
  "usually" is the problem.
  - beberlei 8y ago
    how is interpretation of the law not a problem with any law that was in effect before GDPR. It didn't stop anybody from starting businesses before and will not after.
    - kodablah 8y ago
      It's punishment amounts. Laws should strive for minimal maximums and reasonable ranges to apply that interpretation in. We don't say every crime is punishable up to a life sentence for a reason. The more leeway the law provides, the more room for abuse (for either side). It would not have been hard to define multiple reasonable ranges, but sadly they think these values are what gives the law "teeth" (instead of actual enforcement which is what should provide it).
      - beberlei 8y ago
        The EU had competition law before that mentions 10% of global turnover as a maximum fee, along with very detailed notes of how to set them: https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2006:210:0002:0005:EN:PDF https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:... The Sherman Act also mentions a ceiling of 10 million, 3 years of prison for private persons. And from history we know antitrust authorities broke up companies like AT&T or Standard Oil, which seems to me a much bigger punishment. Both laws only mention the maximum fine. Yet you don't see small companies sweating over competition law.
        kodablah 8y ago
        > Yet you don't see small companies sweating over competition law. They would if it applied to them and they had to do work to comply. This is very simple. If a law applies to a company, companies will worry about it and the perceived risks. If a law doesn't apply to a company, they won't worry. Ideally, both the laws and their punishments are as narrowly scoped as possible to prevent abuse at the whims of enforcer subjectivity. It goes without saying that a business not affected by a law won't sweat it like they might if affected by a law. Couple that with ambiguities in the legislation and effort to comply and it's clear why small businesses sweat one and not the other. It's a very poor comparison.
- stickfigure 8y ago
  I would still be bankrupted by "much less" than $20 million.
  - bigbugbag 8y ago
    Good for you. now understand that fines are proportionate to the offense. Are you engaging in doing very bad thing to personal data on a very large scale and having a business based on this ? no ? then what are you afraid of ? that failing to answert to one guy asking for what data you have on him will cause you to be fined to bankruptcy level ? I pity the fool as said that one guy.
    - stickfigure 8y ago
      Your fundamental argument seems to be "this will only affect bad actors" but I don't think the history of law in any part of the world justifies such optimism. Or how about: I'm sure the advocates for civil asset forfeiture made similar arguments. If you want to argue that prosecutors on your side of the pond are impervious to corruption, well, consider that you're including Spain, Italy, and Greece in that body politic (at least for now).
matwood 8y ago
First, that is the maximum. Second, no one scare mongered about the old maximum fines of £500k (which BTW were never used). https://government.diginomica.com/2017/08/10/ico-maximum-fines-gdpr-will-last-resort/ https://government.diginomica.com/2017/08/10/ico-maximum-fin...
jimnotgym 8y ago
Let's not talk theory. I am making that gamble. Business is about risk judgement, and I have judged the risk to be miniscule.
bigbugbag 8y ago
Or 4% of your world revenue whichever is largest. Then again you can stop brandishing this FUD as this kind of fine is not gonna happen to small actors. If you act in good faith and are found doing something wrong you'll receive a notification asking you to fix the issue. Why do people think EU is dumb and will start distributing 20M fines right and left at the first offense ? Just look at how it's done up until now and what CNIL said about how GDPR will be applied.

Nobody will fine an open-source project that amount of money. The goal of GDPR is not to bankrupt anybody but to nudge them into compliance. If you aren't maliciously handling user data, you are not a target of high fines.

malcolmgreaves 8y ago
Then why does the law not have this an an exemption?
- tambre 8y ago
  Have what as an exemption? Not applying GDPR to small-time open source projects? Being open source doesn't suddenly make it fine to mishandle users' information.
- bigbugbag 8y ago
  GDPR has exemptions built in but being open source project is not one.

beberlei 8y ago

20 million is the max penalty for repeat offenders. See article 83 about fines being proportinate to the offense: https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/ This is a european thing, if any law says $x is the max fine or alike, then for a first time offense you usually get much less.

tlrobinson 8y ago
"usually" is the problem.
- beberlei 8y ago
  how is interpretation of the law not a problem with any law that was in effect before GDPR. It didn't stop anybody from starting businesses before and will not after.
  - kodablah 8y ago
    It's punishment amounts. Laws should strive for minimal maximums and reasonable ranges to apply that interpretation in. We don't say every crime is punishable up to a life sentence for a reason. The more leeway the law provides, the more room for abuse (for either side). It would not have been hard to define multiple reasonable ranges, but sadly they think these values are what gives the law "teeth" (instead of actual enforcement which is what should provide it).
    - beberlei 8y ago
      The EU had competition law before that mentions 10% of global turnover as a maximum fee, along with very detailed notes of how to set them: https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2006:210:0002:0005:EN:PDF https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:... The Sherman Act also mentions a ceiling of 10 million, 3 years of prison for private persons. And from history we know antitrust authorities broke up companies like AT&T or Standard Oil, which seems to me a much bigger punishment. Both laws only mention the maximum fine. Yet you don't see small companies sweating over competition law.
      - kodablah 8y ago
        > Yet you don't see small companies sweating over competition law. They would if it applied to them and they had to do work to comply. This is very simple. If a law applies to a company, companies will worry about it and the perceived risks. If a law doesn't apply to a company, they won't worry. Ideally, both the laws and their punishments are as narrowly scoped as possible to prevent abuse at the whims of enforcer subjectivity. It goes without saying that a business not affected by a law won't sweat it like they might if affected by a law. Couple that with ambiguities in the legislation and effort to comply and it's clear why small businesses sweat one and not the other. It's a very poor comparison.
stickfigure 8y ago
I would still be bankrupted by "much less" than $20 million.
- bigbugbag 8y ago
  Good for you. now understand that fines are proportionate to the offense. Are you engaging in doing very bad thing to personal data on a very large scale and having a business based on this ? no ? then what are you afraid of ? that failing to answert to one guy asking for what data you have on him will cause you to be fined to bankruptcy level ? I pity the fool as said that one guy.
  - stickfigure 8y ago
    Your fundamental argument seems to be "this will only affect bad actors" but I don't think the history of law in any part of the world justifies such optimism. Or how about: I'm sure the advocates for civil asset forfeiture made similar arguments. If you want to argue that prosecutors on your side of the pond are impervious to corruption, well, consider that you're including Spain, Italy, and Greece in that body politic (at least for now).

matwood 8y ago

First, that is the maximum. Second, no one scare mongered about the old maximum fines of £500k (which BTW were never used). https://government.diginomica.com/2017/08/10/ico-maximum-fines-gdpr-will-last-resort/ https://government.diginomica.com/2017/08/10/ico-maximum-fin...

jimnotgym 8y ago

Let's not talk theory. I am making that gamble. Business is about risk judgement, and I have judged the risk to be miniscule.

bigbugbag 8y ago

Or 4% of your world revenue whichever is largest. Then again you can stop brandishing this FUD as this kind of fine is not gonna happen to small actors. If you act in good faith and are found doing something wrong you'll receive a notification asking you to fix the issue. Why do people think EU is dumb and will start distributing 20M fines right and left at the first offense ? Just look at how it's done up until now and what CNIL said about how GDPR will be applied.