4 ms·

My only problem with GDPR is that you can be fined up to 4% of org revenue for breaches, even if the violation isn’t that bad. This is pretty unfair for very ho

My only problem with GDPR is that you can be fined up to 4% of org revenue for breaches, even if the violation isn’t that bad. This is pretty unfair for very horizontally-large organizations and causes a lot of CYA training/education/compliance. Yes it highly disincentivizes noncompliance but I’ve seen first hand how much work it can create relative to the actual practical effects of a violation. If potential penalties were adjusted better towards the severity of a violation, there would be a lot less wasted man hours

zaarn 8y ago
Well, the official guidance for most agencies involved is to not issue 4% worldwide revenue fines unless repeat offenders show little to no signs of changing behavior to prevent further violations. If there was in letter adjustment for the amount depending on violations, orgs would just worm themselves out of the high penalties by exploiting the wording, having it up to the agency's judgement means they can issue high fines if necessary. You also always have recourse against unjust or excessive fines, as per established EU law.
toomanybeersies 8y ago
Everyone has latched onto this 4% number, like every breach of GDPR rules will incur a massive fine. It's not "you will be fined 4% for every breach". It's "you can be fined up to 4%", the GDPR actually states that the punishment should be proportional to the damage caused. Here's the specific language form the English language version of the GDPR [1] (I suggest you read the whole page): > Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. If you accidentally send customer data to Google Analytics without their permission, and rectify the issue when it's discovered, you're not going to get slapped with a multi-million dollar fine. [1] https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/
- beaconstudios 8y ago
  > If you accidentally send customer data to Google Analytics without their permission, and rectify the issue when it's discovered, you're not going to get slapped with a multi-million dollar fine. Hopefully. It seems like the law is completely open to the judge's discretion, so for risk assessment purposes it should be assumed that the full fine will be granted, because you can't bank on a lenient judge - especially if you're one of the earliest cases and they decide to make an example of you.

zaarn 8y ago

Well, the official guidance for most agencies involved is to not issue 4% worldwide revenue fines unless repeat offenders show little to no signs of changing behavior to prevent further violations. If there was in letter adjustment for the amount depending on violations, orgs would just worm themselves out of the high penalties by exploiting the wording, having it up to the agency's judgement means they can issue high fines if necessary. You also always have recourse against unjust or excessive fines, as per established EU law.

toomanybeersies 8y ago

Everyone has latched onto this 4% number, like every breach of GDPR rules will incur a massive fine. It's not "you will be fined 4% for every breach". It's "you can be fined up to 4%", the GDPR actually states that the punishment should be proportional to the damage caused. Here's the specific language form the English language version of the GDPR [1] (I suggest you read the whole page): > Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. If you accidentally send customer data to Google Analytics without their permission, and rectify the issue when it's discovered, you're not going to get slapped with a multi-million dollar fine. [1] https://gdpr-info.eu/art-83-gdpr/ https://gdpr-info.eu/art-83-gdpr/

beaconstudios 8y ago
> If you accidentally send customer data to Google Analytics without their permission, and rectify the issue when it's discovered, you're not going to get slapped with a multi-million dollar fine. Hopefully. It seems like the law is completely open to the judge's discretion, so for risk assessment purposes it should be assumed that the full fine will be granted, because you can't bank on a lenient judge - especially if you're one of the earliest cases and they decide to make an example of you.