5 ms·

I have a very difficult time understanding any of this. I mean, yes, for most of the SME 50 mio dollars would be some money, but for Google? Peanuts. Who cares

by amenod 8y ago

I have a very difficult time understanding any of this. I mean, yes, for most of the SME 50 mio dollars would be some money, but for Google? Peanuts. Who cares if they messed up? If this is the penalty for it, bring it on... It was cheap school for them (not on how to do GDPR properly, but how to get better at avoiding penalties in the future). Seriously, I hope EU can do better than that. We could really use some real privacy protections, especially from the likes of Google, Facebook, Microsoft, Apple, Amazon,...

jiveturkey 8y ago
It's not the size of the fine. It's that there's a fine at all. It's a warning shot across the bow. Also, this isn't a fine as "cost of doing business". Google still has to address the issues. If they don't, you can be sure the next fine will be 10x.
Macha 8y ago
If you look at some of the GDPR fearmongering (Particularly stuff like "Oh no my designated DPO left and it took us a week to find a replacement." or "Oh no, my 1 person company with no automated process got a GDPR request while I was on holiday in the bahamas and I took too long" leading to 4% of revenue fines, one of the points made is that the EU tends to not apply the maximum penalty immediately based on the severity of the offence and whether it's a repeat offender. So this is (a) Google's first offence and (b) it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet), so it's understandable that they didn't pull out the 4% of global revenue fine. Even though ultimately the Google behavior is the target of the legislation, not giving Google the same "first time's a warning" type behavior of local SMEs sounds like a good way to start a trade war. The next GDPR violation Google is accused of, they will now be a repeat offender and more likely to get a higher fine, until they either become compliant or end up at the 4% of revenue fine.
- laurentl 8y ago
  > it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet) To clarify, the fine is due to the consent mechanism in Android. The fact that the action was led by the French regulator rather than the Irish one is due to this technicality and others (no DPO in Google Ireland for instance)
- Mirioron 8y ago
  >one of the points made is that the EU tends to not apply the maximum penalty immediately based on the severity of the offence and whether it's a repeat offender. But this is how it's done because it's standard practice, not because the law stops them from doing it.
  - SiempreViernes 8y ago
    So you seriously think that the only thing that prevents people killing each other is that there is a law against it? Morals work by adjusting to the expectations of your peers, laws simply codify the expectations and serve primarily to regulate which infractions can be punished.
    - Mirioron 8y ago
      We're not talking about a general case situation though. We're talking about dealing with rather specific companies where a lot of money moves around. While laws against murder might not affect whether the general public kills one another, it probably does affect a business environment that is cut-throat.
  - NeedMoreTea 8y ago
    You might want to look up the EU requirement for proportionality in penalties, and the ECJ cases where a regulation or penalty was found not to be proportionate, before claiming there is no law that stops them from doing that. It applies to everything EU wide. That's quite apart from it already being well established in national laws of many member states. https://www.europeanlawmonitor.org/eu-legal-principles/eu-law-what-is-the-principle-of-proportionality-a-subsidiarity.html https://www.europeanlawmonitor.org/eu-legal-principles/eu-la... https://en.wikipedia.org/wiki/General_principles_of_European_Union_law#Proportionality https://en.wikipedia.org/wiki/General_principles_of_European...
    - Mirioron 8y ago
      Interesting. Thank you. But what's the point of setting upper limits to fines at all then? GDPR says that the maximum penalty is 4% of global revenue or 20 million euros, whichever is greater. If proportionality is a concept that's followed so well, then why have upper limits at all? Why word it in a way that clearly hurts smaller businesses more?
anonymousab 8y ago
It's peanuts now. Less so on the tenth or hundredth time they get hit.
stordoff 8y ago
The goal of the DPAs is to ensure compliance. If a small fine is enough to do that, great; if not, they'll fine you more next time.

by amenod 8y ago

jiveturkey 8y ago

It's not the size of the fine. It's that there's a fine at all. It's a warning shot across the bow. Also, this isn't a fine as "cost of doing business". Google still has to address the issues. If they don't, you can be sure the next fine will be 10x.

Macha 8y ago

If you look at some of the GDPR fearmongering (Particularly stuff like "Oh no my designated DPO left and it took us a week to find a replacement." or "Oh no, my 1 person company with no automated process got a GDPR request while I was on holiday in the bahamas and I took too long" leading to 4% of revenue fines, one of the points made is that the EU tends to not apply the maximum penalty immediately based on the severity of the offence and whether it's a repeat offender. So this is (a) Google's first offence and (b) it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet), so it's understandable that they didn't pull out the 4% of global revenue fine. Even though ultimately the Google behavior is the target of the legislation, not giving Google the same "first time's a warning" type behavior of local SMEs sounds like a good way to start a trade war. The next GDPR violation Google is accused of, they will now be a repeat offender and more likely to get a higher fine, until they either become compliant or end up at the 4% of revenue fine.

laurentl 8y ago
> it seems the finding is about a technicality that could be a genuine mistake (1 day after GDPR Google's TOS didn't mention Google Ireland yet) To clarify, the fine is due to the consent mechanism in Android. The fact that the action was led by the French regulator rather than the Irish one is due to this technicality and others (no DPO in Google Ireland for instance)
Mirioron 8y ago
>one of the points made is that the EU tends to not apply the maximum penalty immediately based on the severity of the offence and whether it's a repeat offender. But this is how it's done because it's standard practice, not because the law stops them from doing it.
- SiempreViernes 8y ago
  So you seriously think that the only thing that prevents people killing each other is that there is a law against it? Morals work by adjusting to the expectations of your peers, laws simply codify the expectations and serve primarily to regulate which infractions can be punished.
  - Mirioron 8y ago
    We're not talking about a general case situation though. We're talking about dealing with rather specific companies where a lot of money moves around. While laws against murder might not affect whether the general public kills one another, it probably does affect a business environment that is cut-throat.
- NeedMoreTea 8y ago
  You might want to look up the EU requirement for proportionality in penalties, and the ECJ cases where a regulation or penalty was found not to be proportionate, before claiming there is no law that stops them from doing that. It applies to everything EU wide. That's quite apart from it already being well established in national laws of many member states. https://www.europeanlawmonitor.org/eu-legal-principles/eu-law-what-is-the-principle-of-proportionality-a-subsidiarity.html https://www.europeanlawmonitor.org/eu-legal-principles/eu-la... https://en.wikipedia.org/wiki/General_principles_of_European_Union_law#Proportionality https://en.wikipedia.org/wiki/General_principles_of_European...
  - Mirioron 8y ago
    Interesting. Thank you. But what's the point of setting upper limits to fines at all then? GDPR says that the maximum penalty is 4% of global revenue or 20 million euros, whichever is greater. If proportionality is a concept that's followed so well, then why have upper limits at all? Why word it in a way that clearly hurts smaller businesses more?

anonymousab 8y ago

It's peanuts now. Less so on the tenth or hundredth time they get hit.

stordoff 8y ago

The goal of the DPAs is to ensure compliance. If a small fine is enough to do that, great; if not, they'll fine you more next time.