4 ms·

Even the threat of death penalty doesn't stop crimes. True, if there is no punishment and a threat is teethless nobody acts on it (that's why the big GDPR outc

Even the threat of death penalty doesn't stop crimes. True, if there is no punishment and a threat is teethless nobody acts on it (that's why the big GDPR outcry also came only this year after the two year introductory phase) However if you have too high fines what happens s that companies try everything to hide the fault and lie to avoid the fines. Here a company complied to all things, improved security (which according to the data privacy agency let to six digit costs (while a question is how you measure this) - see other comments) and therefore got a low punishment. The punishment also has another effect: It makes it clear that fines are being collected. If it were higher the Knuddels company would go to court and we'd have an example case only in two or more years. The goal is to improve data safety. That goal was achieved.

rocqua 8y ago
There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. Some examples of economic crime would be: not implementing security, tax fraud, overweight freight trucks; speeding to make a delivery on time (whilst on the clock). The first kind of crime is generally made by people who 'know they are wrong, but they feel like they don't have other options' or people who 'know they are wrong, but don't give a f*ck about that'. Especially that first type of person won't respond to more punishment. The second kind of crime is much more calculated. Here, the response to harsher punishment would be a lot better. This is generally why the fines on overweight trucks are so high. It is actually required in order to make the calculation unacceptable for driving overweight.
- johannes1234321 8y ago
  I used the introductory example in response to the request of "extremely punitive" fines. Extreme fines lead to companies trying to be clever in hiding their faults. Moderate fines more likely lead to companies coming out by themselves. On the comparison with overweight trucks: I doubt anybody builds an insecure system to gain an economical benefit, not using state-of-the-art technology is a mistake/stupidity/carelessness/.... "See how much money we earned from saving CPU time of bcrypt!" nobody said.
  - pbhjpbhj 8y ago
    >Moderate fines more likely lead to companies coming out by themselves. I can't recall ever hearing of a company coming forward to declare they broke the law and so should pay a fine. Could anyone give us a couple of high profile examples? Do you have any support for your assertion that punitive fines don't stimulate regulatory compliance but small fines do?
    - johannes1234321 8y ago
      Yes. The case we are talking about. "Das Unternehmen hatte sich am 08. September 2018 mit einer Datenpannenmeldung an den LfDI gewandt [...] Gegenüber dem LfDI legte das Unternehmen in vorbildlicher Weise sowohl Datenverarbeitungs- und Unternehmensstrukturen als auch eigene Versäumnisse offen." ("The company contacted the data protection agency on September 8th 2018[...] In exemplary manner they gave access to company and data management processes and highlighted their on omissions") https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2018/11/LfDI-Baden-W%C3%BCrttemberg-verh%C3%A4ngt-sein-erstes-Bu%C3%9Fgeld-in-Deutschland-nach-der-DS-GVO.pdf https://www.baden-wuerttemberg.datenschutz.de/wp-content/upl...
- AnthonyMouse 8y ago
  > There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. The relationship is the opposite of the one you're describing. The problem with personal crimes is that everyone has a different utility function. If you could steal a million dollars at risk of a month in jail, many people would take the risk. Fewer at six months in jail. Fewer still at a year. Fewer still at five years. So you need as high a penalty as you can get without violating proportionality (or reaching the point of diminishing returns, once nearly everyone who can be is deterred). There are some people who aren't even deterred by the death penalty, e.g. because they'd rather have the money needed to save their kid's life even if it costs them their own, but that's pretty rare. Most of the people who aren't deterred by even large penalties are simply the people who don't expect to be caught, or don't realize they were violating of the law to begin with. By contrast, for economic crimes, nearly everyone's utility function is the same. If you can save $2000 by taking a 50% risk of having to pay the $2000 anyway plus a $1500 fine, it's profitable. If you can save $2000 by taking a 50% risk of paying the $2000 anyway plus a $2500 fine, it isn't. A $3000 fine provides no additional deterrence, and anything more is just a money grab. Even the $1500 fine may be higher than strictly necessary, because getting fined at all results in a PR hit that independently provides a non-zero deterrence value. That isn't to say that a small fine won't leave a large number of violators, but they're no longer the people overtly doing the calculations. They're the people who assign negligible probability to getting caught, or who don't even realize they're violating the law. No amount of higher penalties will deter them, the only thing that works against that group is vigorous enforcement -- which works fine (better even) with modest penalties, because all you really need to do to get those groups into compliance is to tap them on the shoulder and explain how they're not.
  - pbhjpbhj 8y ago
    >everyone's utility function is the same // It really isn't. The cost of a $2000 for a poor person is huge, the cost for a richer person - whilst significant - is not debilitating. If you've 10% chance of getting caught then a rich person can afford it, getting caught really doesn't hurt so much. That's why progressive justice systems use means tested fines for things like speeding. I'm going to guess you're relatively wealthy, your analysis seems entirely wrong to me. What you get with small fines is people will pay, even if they didn't deserve the fine, because of the cost of time/effort to challenge it. If a company can save €100k for multiple years, the only downside being that if they're the 1:10000 that are caught they'll have a €20k fine, the financial analysis - morals aside - says don't pay, unless the €20k would sink you.

rocqua 8y ago

There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. Some examples of economic crime would be: not implementing security, tax fraud, overweight freight trucks; speeding to make a delivery on time (whilst on the clock). The first kind of crime is generally made by people who 'know they are wrong, but they feel like they don't have other options' or people who 'know they are wrong, but don't give a f*ck about that'. Especially that first type of person won't respond to more punishment. The second kind of crime is much more calculated. Here, the response to harsher punishment would be a lot better. This is generally why the fines on overweight trucks are so high. It is actually required in order to make the calculation unacceptable for driving overweight.

johannes1234321 8y ago
I used the introductory example in response to the request of "extremely punitive" fines. Extreme fines lead to companies trying to be clever in hiding their faults. Moderate fines more likely lead to companies coming out by themselves. On the comparison with overweight trucks: I doubt anybody builds an insecure system to gain an economical benefit, not using state-of-the-art technology is a mistake/stupidity/carelessness/.... "See how much money we earned from saving CPU time of bcrypt!" nobody said.
- pbhjpbhj 8y ago
  >Moderate fines more likely lead to companies coming out by themselves. I can't recall ever hearing of a company coming forward to declare they broke the law and so should pay a fine. Could anyone give us a couple of high profile examples? Do you have any support for your assertion that punitive fines don't stimulate regulatory compliance but small fines do?
  - johannes1234321 8y ago
    Yes. The case we are talking about. "Das Unternehmen hatte sich am 08. September 2018 mit einer Datenpannenmeldung an den LfDI gewandt [...] Gegenüber dem LfDI legte das Unternehmen in vorbildlicher Weise sowohl Datenverarbeitungs- und Unternehmensstrukturen als auch eigene Versäumnisse offen." ("The company contacted the data protection agency on September 8th 2018[...] In exemplary manner they gave access to company and data management processes and highlighted their on omissions") https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2018/11/LfDI-Baden-W%C3%BCrttemberg-verh%C3%A4ngt-sein-erstes-Bu%C3%9Fgeld-in-Deutschland-nach-der-DS-GVO.pdf https://www.baden-wuerttemberg.datenschutz.de/wp-content/upl...
AnthonyMouse 8y ago
> There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. The relationship is the opposite of the one you're describing. The problem with personal crimes is that everyone has a different utility function. If you could steal a million dollars at risk of a month in jail, many people would take the risk. Fewer at six months in jail. Fewer still at a year. Fewer still at five years. So you need as high a penalty as you can get without violating proportionality (or reaching the point of diminishing returns, once nearly everyone who can be is deterred). There are some people who aren't even deterred by the death penalty, e.g. because they'd rather have the money needed to save their kid's life even if it costs them their own, but that's pretty rare. Most of the people who aren't deterred by even large penalties are simply the people who don't expect to be caught, or don't realize they were violating of the law to begin with. By contrast, for economic crimes, nearly everyone's utility function is the same. If you can save $2000 by taking a 50% risk of having to pay the $2000 anyway plus a $1500 fine, it's profitable. If you can save $2000 by taking a 50% risk of paying the $2000 anyway plus a $2500 fine, it isn't. A $3000 fine provides no additional deterrence, and anything more is just a money grab. Even the $1500 fine may be higher than strictly necessary, because getting fined at all results in a PR hit that independently provides a non-zero deterrence value. That isn't to say that a small fine won't leave a large number of violators, but they're no longer the people overtly doing the calculations. They're the people who assign negligible probability to getting caught, or who don't even realize they're violating the law. No amount of higher penalties will deter them, the only thing that works against that group is vigorous enforcement -- which works fine (better even) with modest penalties, because all you really need to do to get those groups into compliance is to tap them on the shoulder and explain how they're not.
- pbhjpbhj 8y ago
  >everyone's utility function is the same // It really isn't. The cost of a $2000 for a poor person is huge, the cost for a richer person - whilst significant - is not debilitating. If you've 10% chance of getting caught then a rich person can afford it, getting caught really doesn't hurt so much. That's why progressive justice systems use means tested fines for things like speeding. I'm going to guess you're relatively wealthy, your analysis seems entirely wrong to me. What you get with small fines is people will pay, even if they didn't deserve the fine, because of the cost of time/effort to challenge it. If a company can save €100k for multiple years, the only downside being that if they're the 1:10000 that are caught they'll have a €20k fine, the financial analysis - morals aside - says don't pay, unless the €20k would sink you.