4 ms·

That's basically what GDPR does. It broadens the scope of what is considered sensitive info and slaps a fine on people PRIOR to a breach. If a breach is found,

That's basically what GDPR does. It broadens the scope of what is considered sensitive info and slaps a fine on people PRIOR to a breach. If a breach is found, then any breach of GDPR means EU can come after that company and hurt them seriously.

brobdingnagians 8y ago
A fine and a lawsuit are very different things, especially with 340M people involved [even a $340M fine would only be $1/person]; fines don't usually go to the people injured by it, which would make sense with personal data being leaked. A fine also misses companies who are "doing what the law says" but still have some horrible flaw anyways. If you are _genuinely_ responsible for the data, meaning if something happens to it you are liable for it, then you often take more care of it above and beyond, than for simply complying with rules.
- kuschku 8y ago
  Many european countries (including Germany) have no class action lawsuits, so unless you want 340 million separate lawsuits, you’ll have to either use fines, or accept that this will go unpunished.
  - roel_v 8y ago
    Just because there are no class action lawsuits doesn't mean you can't take collective legal action. It's been a long time since I lived in Germany, so I can't cite any recent examples, but 20 years ago there were lawsuits in Germany of broad groups.
- geocar 8y ago
  > fines don't usually go to the people injured by it, Well they do. Our government takes money through fines and taxes and uses it to build infrastructure and provide services. > which would make sense with personal data being leaked. My preference would be that personal data not be leaked at all. Ideally the warnings and fines kick in long before that happens. > A fine also misses companies who are "doing what the law says" but still have some horrible flaw anyways. What example are you thinking of? The GDPR is quite broad and open to interpretation by both sides. > If you are _genuinely_ responsible for the data, meaning if something happens to it you are liable for it, then you often take more care of it above and beyond, than for simply complying with rules. That's what the GDPR does. Requiring people to lawyer up to make the company responsible is far weaker.
  - JumpCrisscross 8y ago
    > My preference would be that personal data not be leaked at all Me too! But not at any cost. This discussion involves thinking about scope (both in who and what is regulated), penalties (both in frequency and magnitude) and pre-emptive enforcement, if any. The trade-offs are far-reaching. A conservative approach is prudent. (It's also politically resilient.) > GDPR is quite broad and open to interpretation by both sides That's a sin and a virtue. > Requiring people to lawyer up to make the company responsible is far weaker This, too, is a sin and a virtue. The sin is it may allow bad deeds to go unpunished. But presently, everything is going unpunished. The virtue is in its prudence. It's unlikely to cause systemic harm, and we can observe its case law to more-precisely draft the next wave of rules.
    - geocar 8y ago
      It's only been law for almost thirty years in some places, but pray Europe be prudent! And what is this "any cost" rubbish?
  - fauigerzigerk 8y ago
    >Our government takes money through fines and taxes and uses it to build infrastructure and provide services. Using fines to fund public services creates perverse incentives though, especially where the fines go directly to the agency that brings the case.
    - geocar 8y ago
      Well, this certainly happens at small scales: Police who issue speeding tickets in the US to fund the police force; but it's not clear it happens at large scales.
  - jstanley 8y ago
    > > fines don't usually go to the people injured by it, > Well they do. Our government takes money through fines and taxes and uses it to build infrastructure and provide services. That's only true if you consider the public at large to be equivalent to any individual member of the public, or if you believe only the government is "injured" by a data breach. If I stole all your money and repaid it in fines to the government instead of directly to you, would you consider the matter settled?
raverbashing 8y ago
> any breach of GDPR means EU Replace EU by "the data/privacy regulator of the country in question"

brobdingnagians 8y ago

A fine and a lawsuit are very different things, especially with 340M people involved [even a $340M fine would only be $1/person]; fines don't usually go to the people injured by it, which would make sense with personal data being leaked. A fine also misses companies who are "doing what the law says" but still have some horrible flaw anyways. If you are _genuinely_ responsible for the data, meaning if something happens to it you are liable for it, then you often take more care of it above and beyond, than for simply complying with rules.

kuschku 8y ago
Many european countries (including Germany) have no class action lawsuits, so unless you want 340 million separate lawsuits, you’ll have to either use fines, or accept that this will go unpunished.
- roel_v 8y ago
  Just because there are no class action lawsuits doesn't mean you can't take collective legal action. It's been a long time since I lived in Germany, so I can't cite any recent examples, but 20 years ago there were lawsuits in Germany of broad groups.
geocar 8y ago
> fines don't usually go to the people injured by it, Well they do. Our government takes money through fines and taxes and uses it to build infrastructure and provide services. > which would make sense with personal data being leaked. My preference would be that personal data not be leaked at all. Ideally the warnings and fines kick in long before that happens. > A fine also misses companies who are "doing what the law says" but still have some horrible flaw anyways. What example are you thinking of? The GDPR is quite broad and open to interpretation by both sides. > If you are _genuinely_ responsible for the data, meaning if something happens to it you are liable for it, then you often take more care of it above and beyond, than for simply complying with rules. That's what the GDPR does. Requiring people to lawyer up to make the company responsible is far weaker.
- JumpCrisscross 8y ago
  > My preference would be that personal data not be leaked at all Me too! But not at any cost. This discussion involves thinking about scope (both in who and what is regulated), penalties (both in frequency and magnitude) and pre-emptive enforcement, if any. The trade-offs are far-reaching. A conservative approach is prudent. (It's also politically resilient.) > GDPR is quite broad and open to interpretation by both sides That's a sin and a virtue. > Requiring people to lawyer up to make the company responsible is far weaker This, too, is a sin and a virtue. The sin is it may allow bad deeds to go unpunished. But presently, everything is going unpunished. The virtue is in its prudence. It's unlikely to cause systemic harm, and we can observe its case law to more-precisely draft the next wave of rules.
  - geocar 8y ago
    It's only been law for almost thirty years in some places, but pray Europe be prudent! And what is this "any cost" rubbish?
- fauigerzigerk 8y ago
  >Our government takes money through fines and taxes and uses it to build infrastructure and provide services. Using fines to fund public services creates perverse incentives though, especially where the fines go directly to the agency that brings the case.
  - geocar 8y ago
    Well, this certainly happens at small scales: Police who issue speeding tickets in the US to fund the police force; but it's not clear it happens at large scales.
- jstanley 8y ago
  > > fines don't usually go to the people injured by it, > Well they do. Our government takes money through fines and taxes and uses it to build infrastructure and provide services. That's only true if you consider the public at large to be equivalent to any individual member of the public, or if you believe only the government is "injured" by a data breach. If I stole all your money and repaid it in fines to the government instead of directly to you, would you consider the matter settled?

raverbashing 8y ago

> any breach of GDPR means EU Replace EU by "the data/privacy regulator of the country in question"