3 ms·

Yes, there have been some enforcements already: [0] https://www.bleepingcomputer.com/news/security/first-gdpr-sanction-in-germany-fines-flirty-chat-platform-eu

Yes, there have been some enforcements already: [0] https://www.bleepingcomputer.com/news/security/first-gdpr-sanction-in-germany-fines-flirty-chat-platform-eur-20-000/ https://www.bleepingcomputer.com/news/security/first-gdpr-sa... The Flirty chat app is fined for leaking 808,000 emails to the tune of 20,000 EUR. [1] https://news.ycombinator.com/item?id=18531588 https://news.ycombinator.com/item?id=18531588 The Cuddly chat app is fined for using plaintext password storage to the tune of 20,000 EUR. (No hack known as of yet?) [2] http://fortune.com/2018/11/27/uber-eu-data-hack-fines/ http://fortune.com/2018/11/27/uber-eu-data-hack-fines/ As foreword, this occurred under older privacy laws and not quite GDPR. Many sources agree that GDPR would increase fine sizes in a repeat event. Due to a data breach at Uber exposing 57 million people's records, they were fined 600,000 EUR by the Netherlands and 385,000 GBP by the UK. [3] See nkkollaw's comment below/above.

Phlarp 8y ago
That's hardly even a speeding ticket for Uber. As long as the fines are this low companies of sufficient size simply treat this as a cost of doing business.
- iagooar 8y ago
  They are this low because they have only started fining companies. If Uber breaks the law again, the fine will be a lot higher.
blacksmith_tb 8y ago
It appears that the maximum fine is 4% of a corporation's global earnings[1] which could be a lot of money, but still "just a cost of doing business" at the same time. 1: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Sanctions https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
- isostatic 8y ago
  Global turnover. "Earnings" tends to mean profit. Uber is somewhere around $10b gross revenue, so $400m fine for every breach. Sure it's "just a cost of doing business". It also means that it's better to spend $200m beefing up their security to reduce from 1 data breach every year to one every 5 years. Marriot revenue is $23b, so that's a potential $920m fine. IHG (say), who invest in security and don't have a breach, get to charge less for their hotels, or make more profit.
- nkkollaw 8y ago
  I thought the same thing, but I was corrected here on HN: if you read the same exact like you posted, it says "a fine up to €20 million or up to 4% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater", so the they ARE allowed to fine you EUR 20 million. Much more than "just a cost of doing business" for the majority of companies.

Phlarp 8y ago

That's hardly even a speeding ticket for Uber. As long as the fines are this low companies of sufficient size simply treat this as a cost of doing business.

iagooar 8y ago
They are this low because they have only started fining companies. If Uber breaks the law again, the fine will be a lot higher.

blacksmith_tb 8y ago

It appears that the maximum fine is 4% of a corporation's global earnings[1] which could be a lot of money, but still "just a cost of doing business" at the same time. 1: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Sanctions https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

isostatic 8y ago
Global turnover. "Earnings" tends to mean profit. Uber is somewhere around $10b gross revenue, so $400m fine for every breach. Sure it's "just a cost of doing business". It also means that it's better to spend $200m beefing up their security to reduce from 1 data breach every year to one every 5 years. Marriot revenue is $23b, so that's a potential $920m fine. IHG (say), who invest in security and don't have a breach, get to charge less for their hotels, or make more profit.
nkkollaw 8y ago
I thought the same thing, but I was corrected here on HN: if you read the same exact like you posted, it says "a fine up to €20 million or up to 4% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater", so the they ARE allowed to fine you EUR 20 million. Much more than "just a cost of doing business" for the majority of companies.