3 ms·

Interesting. Thank you. But what's the point of setting upper limits to fines at all then? GDPR says that the maximum penalty is 4% of global revenue or 20 mil

Interesting. Thank you. But what's the point of setting upper limits to fines at all then? GDPR says that the maximum penalty is 4% of global revenue or 20 million euros, whichever is greater. If proportionality is a concept that's followed so well, then why have upper limits at all? Why word it in a way that clearly hurts smaller businesses more?

NeedMoreTea 8y ago
It doesn't work like that. I think it was Germany first introduced proportionality into sentencing, in the later 19th century. They still have maximum penalties for offences. The maximum allows a regulator or judge to frame the seriousness of offence within those limits, with fewer surprises, and across the range of legislated offences, as intended by the legislature. A proportionate fine for a first offence, technical breach by a multinational like Nestle or Google, who should have plenty of people in legal, might be a gentle €50 million slap on the wrist. As we can see from this very discussion, there's been a couple of comments along the lines of "...but that's too small to hurt, why bother?". A proportionate penalty for a Google or Facebook on a fifth offence, showing a wilful attempt to dark pattern around the law, might well turn out to be €4% of global. It's no different to setting criminal offences with a maximum of ten years in jail and finding most get a fine, and just a few get jail, let alone a maximum term. A proportionate first offence penalty for a 5 person early startup, who made a minor breach, might receive a helpful, but sternly worded letter to help them comply. The same 5 person startup showing a wilful, habitual pattern of breach might get (plucks number out of the air) a €20k fine for their fifth offence. Probably levied after providing proof of their revenue and profit. The point is supposed to balance the need to a) enough to encourage them to not do it again, and b) not nuke them from orbit. It doesn't clearly hurt a smaller business more. It's meant to hurt each about the same: "enough to achieve compliance". Intent and extent will affect what is enough too. The aim is compliance, not revenue, or remaking some sort of financial equivalent of the Bloody Code. A bankrupt business cannot comply and generates no revenue. Mistakes, disappointingly large or small penalties and the subsequent appeals will happen, such is the nature of all law, everywhere. IANAL or I might have explained that better. :)

NeedMoreTea 8y ago

It doesn't work like that. I think it was Germany first introduced proportionality into sentencing, in the later 19th century. They still have maximum penalties for offences. The maximum allows a regulator or judge to frame the seriousness of offence within those limits, with fewer surprises, and across the range of legislated offences, as intended by the legislature. A proportionate fine for a first offence, technical breach by a multinational like Nestle or Google, who should have plenty of people in legal, might be a gentle €50 million slap on the wrist. As we can see from this very discussion, there's been a couple of comments along the lines of "...but that's too small to hurt, why bother?". A proportionate penalty for a Google or Facebook on a fifth offence, showing a wilful attempt to dark pattern around the law, might well turn out to be €4% of global. It's no different to setting criminal offences with a maximum of ten years in jail and finding most get a fine, and just a few get jail, let alone a maximum term. A proportionate first offence penalty for a 5 person early startup, who made a minor breach, might receive a helpful, but sternly worded letter to help them comply. The same 5 person startup showing a wilful, habitual pattern of breach might get (plucks number out of the air) a €20k fine for their fifth offence. Probably levied after providing proof of their revenue and profit. The point is supposed to balance the need to a) enough to encourage them to not do it again, and b) not nuke them from orbit. It doesn't clearly hurt a smaller business more. It's meant to hurt each about the same: "enough to achieve compliance". Intent and extent will affect what is enough too. The aim is compliance, not revenue, or remaking some sort of financial equivalent of the Bloody Code. A bankrupt business cannot comply and generates no revenue. Mistakes, disappointingly large or small penalties and the subsequent appeals will happen, such is the nature of all law, everywhere. IANAL or I might have explained that better. :)