5 ms·

That's the maximum possible. You'll have to act in bad faith and ignore warnings to ever get handed the maximum fine.

downandout 8y ago
Please point to the specific part of the GDPR where this is codified. (Just FYI, it is not there. Indeed they can impose the maximum fines for a first offense, and are fully incentivized to do so).
- cyphar 8y ago
  Courts have discretion when deciding on penalties. This is the case for the vast majority of laws you can think of. You might argue that not having a "first-offender" concept is unfair, but that stops courts from being able to punish really egregious first offenses. It might also incentivise companies to try to work around the repeat-offender rules so they can continue to violate GDPR without any serious penalty. > Indeed they can impose the maximum fines for a first offense, and are fully incentivized to do so And yet they didn't when they first fined Google[1], where the fine was 50 million euros -- which was only 1% of the maximum fine they could've imposed. It's almost as if the maximum penalty is the upper ceiling and not the default. [1]: https://www.itnews.com.au/news/google-cops-50m-gdpr-fine-518298 https://www.itnews.com.au/news/google-cops-50m-gdpr-fine-518...
- smu 8y ago
  On phone, so can’t type much. Please have a look at article 83: list of conditions to consider when determining the corrective measures (fines or other measures). Also: there’s a guidance document for authorities here: https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 EU law does not work with exact codified procedures, which I understand is more common in US. So indeed, you will find guidance but not exact procedure (though it seems to be clear enough to me) EDIT: article 83 instead of 82
  - vsl 8y ago
    > EU law does not work with exact codified procedures That's a blatant untruth.
  - downandout 8y ago
    Nothing in the “guidance” you provided disincentivizes large/maximum fines, or actually limits the fines from being the maximum in any way. Downvote this all you like, that won’t change what they have (or more accurately, have not) written into the law.
- ionised 8y ago
  > Indeed they can impose the maximum fines for a first offense, and are fully incentivized to do so). The EU has had the capacity to levy fines far greater than they typically have for a whole spectrum of violations of its laws and regulations. It never goes full-fine right away. It does show restraint on first offences.
opportune 8y ago
A lot of people in industry especially at larger companies are preparing for the 4% global revenue fine the first time a very large company fucks up GDPR in some way because they are anticipating being made examples of
- FridgeSeal 8y ago
  That really says a lot about the industry doesn't it.
  - opportune 8y ago
    It really says more that most people don't assume the EU to enforce GDPR in good faith and to just opportunistically use it as a way to take money out of the tech-company piggy bank. Everyone I know takes GDPR seriously. Of course at a big organization it potentially only takes one dumbass out of tens of thousands to screw up catastrophically
    - Semaphor 8y ago
      > It really says more that most people don't assume the EU to enforce GDPR in good faith and to just opportunistically use it as a way to take money out of the tech-company piggy bank. Funny, considering that there already are cases going on and not a single one is close to those maximums. > Everyone I know takes GDPR seriously Wow, what people do you know? Considering that the vast majority of sites doesn't even have opt-in into tracking but opt-out after they started tracking, I think the people you know are some weird exception.
      - opportune 8y ago
        Everyone I know at large tech companies, not podunk shitty websites 2 people have ever heard of. I work at a large multinational company you've definitely heard of. Like I said, we take GDPR extremely seriously because of the magnitude of potential fines
    - mschuetz 8y ago

Please point to the specific part of the GDPR where this is codified. (Just FYI, it is not there. Indeed they can impose the maximum fines for a first offense, and are fully incentivized to do so).

cyphar 8y ago
Courts have discretion when deciding on penalties. This is the case for the vast majority of laws you can think of. You might argue that not having a "first-offender" concept is unfair, but that stops courts from being able to punish really egregious first offenses. It might also incentivise companies to try to work around the repeat-offender rules so they can continue to violate GDPR without any serious penalty. > Indeed they can impose the maximum fines for a first offense, and are fully incentivized to do so And yet they didn't when they first fined Google[1], where the fine was 50 million euros -- which was only 1% of the maximum fine they could've imposed. It's almost as if the maximum penalty is the upper ceiling and not the default. [1]: https://www.itnews.com.au/news/google-cops-50m-gdpr-fine-518298 https://www.itnews.com.au/news/google-cops-50m-gdpr-fine-518...
smu 8y ago
On phone, so can’t type much. Please have a look at article 83: list of conditions to consider when determining the corrective measures (fines or other measures). Also: there’s a guidance document for authorities here: https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 EU law does not work with exact codified procedures, which I understand is more common in US. So indeed, you will find guidance but not exact procedure (though it seems to be clear enough to me) EDIT: article 83 instead of 82
- vsl 8y ago
  > EU law does not work with exact codified procedures That's a blatant untruth.
- downandout 8y ago
  Nothing in the “guidance” you provided disincentivizes large/maximum fines, or actually limits the fines from being the maximum in any way. Downvote this all you like, that won’t change what they have (or more accurately, have not) written into the law.
ionised 8y ago
> Indeed they can impose the maximum fines for a first offense, and are fully incentivized to do so). The EU has had the capacity to levy fines far greater than they typically have for a whole spectrum of violations of its laws and regulations. It never goes full-fine right away. It does show restraint on first offences.

opportune 8y ago

A lot of people in industry especially at larger companies are preparing for the 4% global revenue fine the first time a very large company fucks up GDPR in some way because they are anticipating being made examples of

FridgeSeal 8y ago
That really says a lot about the industry doesn't it.
- opportune 8y ago
  It really says more that most people don't assume the EU to enforce GDPR in good faith and to just opportunistically use it as a way to take money out of the tech-company piggy bank. Everyone I know takes GDPR seriously. Of course at a big organization it potentially only takes one dumbass out of tens of thousands to screw up catastrophically
  - Semaphor 8y ago
    > It really says more that most people don't assume the EU to enforce GDPR in good faith and to just opportunistically use it as a way to take money out of the tech-company piggy bank. Funny, considering that there already are cases going on and not a single one is close to those maximums. > Everyone I know takes GDPR seriously Wow, what people do you know? Considering that the vast majority of sites doesn't even have opt-in into tracking but opt-out after they started tracking, I think the people you know are some weird exception.
    - opportune 8y ago
      Everyone I know at large tech companies, not podunk shitty websites 2 people have ever heard of. I work at a large multinational company you've definitely heard of. Like I said, we take GDPR extremely seriously because of the magnitude of potential fines
  - mschuetz 8y ago