>Like with almost every other Directive, the EU has made a huge mistake by not including de minimis exemptions in the regulation. Proportionality in the GDPR i

>Like with almost every other Directive, the EU has made a huge mistake by not including de minimis exemptions in the regulation. Proportionality in the GDPR is based on the scale and sensitivity of your data activities. The size of your organisation or your technical capability is irrelevant; if you're not competent to safeguard the data you handle in accordance with the law, the EU doesn't want you to handle it. It's exactly the same principle we'd apply to toxic waste - you're not allowed to dump it in the woods just because you're a small business or a hobbyist. Some examples of why there is no de minimis exemption: A small charity accidentally sent a newsletter using "to" rather than "bcc". In doing so, it accidentally revealed the identities of 56 people who are HIV positive. It was fined £250 by the Information Commissioner's Office, because of the small size of the organisation and because the ICO was satisfied with steps taken to prevent further breaches. https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2015/12/ico-fines-hiv-patient-support-service-for-data-breach/ https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... A non-profit trade organisation with a single employee worked to facilitate information sharing between construction companies. That information consisted of files on trade unionists, political activists and advocates for health and safety, constituting an effective blacklist of "known troublemakers". The organisation's files were seized by the Information Commissioner's Office, leading to enforcement notices against 14 construction businesses; settlements under the Data Protection Act totalled over £50m. https://en.wikipedia.org/wiki/Consulting_Association https://en.wikipedia.org/wiki/Consulting_Association