10 ms·

Wow. Here's an crazy one: Someone was fined 2000 euros for using CC instead of BCC in his little mailing list newsletter of 150 people in Germany. "The fine w

Wow. Here's an crazy one: Someone was fined 2000 euros for using CC instead of BCC in his little mailing list newsletter of 150 people in Germany. "The fine was impossed against a private person who sent several e-mails between July and September 2018, in which he used personal e-mail addresses visible to all recipients, from which each recipient could read countless other recipients. The man was accused of ten offences between mid-July and the end of July 2018. According to the authority's letter, between 131 and 153 personal mail addresses were identifiable in his mailing list." Poor guy. This seems to be proof that the GDPR is being weaponized against people and organizations one doesn't like.

tempestn 7y ago
I expect there would have been a warning given in that case before assessing a fine. Many of the less serious ones I read explicitly mentioned warnings that were ignored.
deleted 7y ago
[deleted]
idlewords 7y ago
Whether this is guy is a victim of overzealous enforcement, or an example of the GDPR protecting people, is completely dependent on the context of the case and the nature of the mailing list. The linked article suggests that the guy was sending out angry political rants and criminal accusations to thousands of people a day, which adds a further twist.
- ignasl 7y ago
  If that’s true then the gdpr was not used according to it’s spirit at all. They punished annoying guy who was trying to get some attention. Of course google or fb is fine...
inetknght 7y ago
Frankly I'm glad that GDPR has the teeth to get people to stop abusing reply-all chains and mailing lists.
rococode 7y ago
Different take: This is exactly what GDPR was designed for. It just hasn't been "weaponized" enough yet to have the bandwidth to deal with every situation, so situations like these seem like targeted attacks when in reality they're precisely what GDPR is supposed to deal with. I personally think ~$15 per leaked email is a reasonable fine. I bet this guy and everyone else who reads this article won't accidentally leak emails again, and that's great.
- hartator 7y ago
  The thing is if this was a civil case you have to prove some damages had be done by the leak. A random person leaking my email in CC - that happens a lot - is not even necessarily annoying but for sure don't cause any damages.
  - pm215 7y ago
    Whether there are damages depends on the context. In 2015 an HIV clinic in London used the to: field instead of bcc: on a patient newsletter, thus exposing the names of 700 patients, many of whom knew each other due to the small geographic area being served (https://www.theguardian.com/technology/2016/may/09/london-hiv-clinic-fined-180000-for-revealing-service-users-names https://www.theguardian.com/technology/2016/may/09/london-hi...). They were fined GBP180K (under the pre-gdpr regime, incidentally, so this isn't a new risk for businesses).
    - pkaye 7y ago
      I think that is why my hospital network uses an online patient account for any messages instead of email. Easy to screw up this stuff if using email.
  - rococode 7y ago
    But how is that different from any of the other privacy violations that are regulated? I doubt many of us could prove any damages from Amazon listening in on conversations made by our kids, or Google not properly disclosing that its tracking our search clicks and GPS location for better ad targeting. In fact, I'd argue that leaking an email that exposes a private association with a mailing list to other unknown people has much clearer potential for damage than any of the privacy issues that big companies get fined for. And yes, CC leaks do happen (not a lot, in my experience), but I'm personally upset about it every time - much more so than when I find out Google didn't get my consent before recording half of my internet activity. Just because the violation is something that "happens a lot" because it can be done by accident by a careless individual doesn't mean it's less serious.
jdietrich 7y ago
In the UK, the data regulator fined a small organisation £180,000 ($230,000) for exactly the same mistake on a list with 781 recipients. The organisation was a specialist sexual health clinic and the newsletter was for patients with HIV. Without knowing the details, I can't say whether a €2000 fine was disproportionately onerous or a slap on the wrist. https://www.businessinsider.com/nhs-trust-fined-for-leaking-700-hiv-clinic-patients-data-in-email-error-56-dean-street-to-bcc-2016-5 https://www.businessinsider.com/nhs-trust-fined-for-leaking-...
- nothrabannosir 7y ago
  HN tangent: This is a great example of where the oft touted wildcards on a personal domain fall short: if you’re on that list, you’re outed. Even without your name on it; only you use that domain. This is where Outlook with their *@outlook.com and apple’s new system really do shine. Commiserations to those affected :(
  - Normal_gaussian 7y ago
    Wildcards are a measure to track what others are (automatically) doing with your email address, provide a way to remove yourself from shared lists of bad actors, and sign up to something a dozen times. What they don't do is provide privacy against human eyes.
    - Silhouette 7y ago
      I've been wondering how this sort of email management strategy is going to handle the rules certain countries are bringing in now where if you want to go there then you have to provide a list of all of your email addresses and social media accounts. Has anyone run into that problem yet?
      - londons_explore 7y ago
        Yes, my email address is "usa-border@mydomain.com"
- 7y ago
notafraudster 7y ago
I support this fine in principle. Maybe not the magnitude, maybe not without a warning, and of course a three liner isn't enough context to be sure. But using CC instead of BCC causes a massive leak of personal information, especially when either the subject being discussed or the people on the list are sensitive. In my life this has mostly been annoyance at large org stuff, but my wife has had this happen with a sensitive medical practice and we were not in the US so HIPAA did not apply. I don't think fines are the only solution, of course. But I think fines should be on the table and it's easy to me imagine a circumstance where 2k euro would be appropriate.
- TomVDB 7y ago
  Last year, when GDPR was heavily discussed, people were criticizing those who decided to just stop their small hobby websites because of the potential GDPR exposure. The argument back then was that they were overreacting, that we didn't understand how Europe works, that you'd only get fined after repeated warnings about violating procedures etc. I'm sure the private person was dumb for doing what he did, but that doesn't invalidate the general point: unless you're sure you that can afford making these kinds of mistakes, don't provide a service on the internet that might be used by EU citizens. The benefits, whatever they might be, just don't justify the risks.
  - cosmodisk 7y ago
    That's absurd. Talking purely about the UK right now: there were tens of thousands of cases logged with ICO since GDPR came into power. So far,there were only a handful of companies that had to pay fines and their actions were either borderline criminal,or deliberate refusal to cooperate with ICO.
  - NeedMoreTea 7y ago
    Except we see just the fine. We have no idea how many attempts and warnings to get them to comply were sent first. It wasn't one email, it was multiple emails, multiple times over months. This site makes no mention of warnings and escalations, and ICO at least doesn't normally announce that for individual cases. Though they do put out aggregate stats. When they have fines are clearly shown as arising in a small minority of cases.
dRaBoQ 7y ago
This is crazy. I've seen it done plenty of times by accident in the past, because people don't know how to use BCC (and its hidden by default in many clients).
- lokedhs 7y ago
  Not just hidden. When using BCC, the information is never transmitted outside the sending server.
  - kbenson 7y ago
    I think what they meant is the option to send as BCC instead of CC is hidden in most mail clients.
    - lokedhs 7y ago
      Thank you. That does indeed make more sense.
- laughinghan 7y ago
  Yeah, but ten times in a row? And that's just in half a month, it sounds it could've been dozens of times over 3 months? Nothing I've heard about this case sounds to me like an innocent mistake that a reasonable effort was made to correct. I've accidentally smacked people on the street before (gesturing, probably). That's technically a crime, but it'd be crazy to prosecute me for a little mistake like that. But it's not crazy that hitting people is a crime and that people do get prosecuted for it in egregious cases.
ysleepy 7y ago
The list has over 1600 recipients making it a bit larger than for "personal use". The quoted 187 recipients might just be one batch of recipients the examined mail was sent to. The sender is also non-repentant and is running some sort of hate campaign.
cosmodisk 7y ago
It should have been more.The idiots who do this deserve it. My fiancé's ex employeer used to send emails cc'ing contractors that haven't even seen each other.I've seen some small scale companies even try to send marketing emails to their small list of clients..
tgsovlerkhgsel 7y ago
If it's the case I've seen [1], it wasn't someone sending a little mailing list newsletter to people who have opted in, it was someone sending complaints and CC'ing everyone they could get an e-mail address of. The article I saw also makes it sound very much like he was told to stop repeatedly. Seems like an appropriate fine. Or do you think I should be allowed to collect 150 e-mail addresses, then e-mail them out to all 150 other people, after some of them told me not to do that? [1] https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail-verteiler.html https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail...
Abishek_Muthian 7y ago
In India, I often get government mails (e.g. reminder for some compliance) of local city with all the business owners in CC. I even went to authority in question to tell them about the privacy issue in vain. So if a EU citizen's email id was part of the list, will it be liable for action according to GDPR?
- waisbrot 7y ago
  Yes, but if an entity has no interest in interacting with the EU then they don't have to respond. You only need to care about a country's laws if (1) you want to do business or visit there or (2) you're going to piss them off to such a degree that they convince your home country to come after you.
rorykoehler 7y ago
Airbnb Germany did this once in a mail out to all hosts. We started a business (since closed) off the back of it.
laughinghan 7y ago
This seems to be proof that the GDPR is being weaponized against people and organizations one doesn't like. What didn't they like about this person, and what proved that to you? And what proved that was the impetus for this fine?
tinus_hn 7y ago
Seems to be proof it is being weaponized against behavior one doesn’t like, the behavior which is forbidden by the law. This isn’t a one time slip up, it’s a 10 times slip up and chances are there were a lot of warnings this guy didn’t want to listen to. So he was hit where it hurts. Poor guy, it’s like he was caught speeding ten times and then got fined.
ivanhoe 7y ago
> This seems to be proof that the GDPR is being weaponized against people and organizations one doesn't like. Well, against people who publicly share private info of 150 other people who trusted them those emails. 2K euros is not that huge money in Germany, it's not like they'll loose their house over it, and that certainly is a practice that needs to be stopped. Just being an amateur is not an excuse when you deal with other peoples' data.
ascorbic 7y ago
If the story linked elsewhere in this thread is the one in question, this wasn't an accident. It was a guy running some kind of harrassment campaign. His "little mailing list" was of people he was harrassing, not subscribers to a newsletter. https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail-verteiler.html https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail...
- rndgermandude 7y ago
  Not a harassment campaign as such, it seems. He was mad about something, and mailed a bunch of politicians and press his complaints. Complaints, sometimes bordering on being libelous, according to the agency which fined him, not death threats. He was fined solely based upon the email addresses being visible to all recipients, not because of the content of his mails, said a spokesperson. However, he was a repeat offender in terms of privacy, who in the past was warned, then fined for similar stuff. I'm a little bit torn on that one. The fine seems excessive for what he did (and the email addresses seem to be a list of already public journalist and press contacts) and it certainly looks like somebody in the govt got annoyed and threw the book at the guy in retaliation. Then again, he had ample warnings, and choose to ignore those warnings.
  - wjnc 7y ago
    Isn't one of the points of separation of power that the government (executive branche) should not have priority access to the judicial branche? Fining individuals, even loony ones, while not even attempting to fight the big battles (FAANG, personal data trading for 'profiling' or even government profiling within the EU) is imho just preposterous.
    - simonh 7y ago
      What sort of priority access was used in this case? Maybe they just filed a complaint like anyone else.
    - rndgermandude 7y ago
      Well, the judiciary branch was not involved in this fine. It was a government agency issuing the fine. Now the fined person could pay the fine, or file a suit asking a court to overturn it. It really is analogous to most govt fines e.g. speeding tickets: the government (the police) gives you a ticket, and if you pay it then OK, no court involved, but if you challenge it then the courts get involved. But more generally, the government should and does get priority access to the courts already. Criminal courts exist solely to serve the government; you cannot bring criminal suits as a citizen yourself, only civil suites. Also, e.g. in Germany the government and legislatures (federal and state) get priority access to e.g. the constitutional (supreme) court. A mere mortal cannot just file suit directly in the constitutional court, but has to go through the lower instances first (unless there is something similar to a class action petition, showing a sizable chunk of the population sees the same issue and wants it decided). Members of the parliaments and IIRC of the cabinet are allowed to file suit in the constitutional court directly. The reasoning here is that if it was allowed for citizens to petition the highest court directly, then the court would do nothing else than write rejection letters for bullshit petitions. While the govt and legislatures incl the parliamentary opposition of course represent the people (in theory) and aren't stupid morons wasting the courts time (in theory). PS: Google was already fined €50M for GDPR violations, and there is probably more of those in their future. Facebook got fined €10M so far, IIRC, also with more to come. And don't forget the billions of Euros worth of antitrust fines against Google and Microsoft, e.g.
orcdork 7y ago
"The national Football League (LaLiga) was fined for offering an app which once per minute accessed the microphone of users' mobile phones in order to detect pubs screening football matches without paying a fee" Yes, proof of weaponized gdpr use indeed (for very specific filtering cases of gdpr use).
TeMPOraL 7y ago
Woah. That's great! In Poland we actually have a sort-of tradition, AFAIK started by one of computer security portals, where if you find yourself on the receiving end of such CC-instead-of-BCC, you kindly tell the company responsible that this can and should be picked up with data protection regulators, and it would be nice if they e.g. paid ~500-2k EUR equivalent to a charity of their choice. I'm totally 100% in support of this against companies. Less so about private individuals, though a 150-people newsletter is kind of thought-out and organized thing, and then 2k EUR in Germany is probably less than a monthly paycheck. A hard hit, but survivable without loss of life quality.
deleted 7y ago
[deleted]

tempestn 7y ago

I expect there would have been a warning given in that case before assessing a fine. Many of the less serious ones I read explicitly mentioned warnings that were ignored.

deleted 7y ago

[deleted]

idlewords 7y ago

Whether this is guy is a victim of overzealous enforcement, or an example of the GDPR protecting people, is completely dependent on the context of the case and the nature of the mailing list. The linked article suggests that the guy was sending out angry political rants and criminal accusations to thousands of people a day, which adds a further twist.

ignasl 7y ago
If that’s true then the gdpr was not used according to it’s spirit at all. They punished annoying guy who was trying to get some attention. Of course google or fb is fine...

inetknght 7y ago

Frankly I'm glad that GDPR has the teeth to get people to stop abusing reply-all chains and mailing lists.

rococode 7y ago

Different take: This is exactly what GDPR was designed for. It just hasn't been "weaponized" enough yet to have the bandwidth to deal with every situation, so situations like these seem like targeted attacks when in reality they're precisely what GDPR is supposed to deal with. I personally think ~$15 per leaked email is a reasonable fine. I bet this guy and everyone else who reads this article won't accidentally leak emails again, and that's great.

hartator 7y ago
The thing is if this was a civil case you have to prove some damages had be done by the leak. A random person leaking my email in CC - that happens a lot - is not even necessarily annoying but for sure don't cause any damages.
- pm215 7y ago
  Whether there are damages depends on the context. In 2015 an HIV clinic in London used the to: field instead of bcc: on a patient newsletter, thus exposing the names of 700 patients, many of whom knew each other due to the small geographic area being served (https://www.theguardian.com/technology/2016/may/09/london-hiv-clinic-fined-180000-for-revealing-service-users-names https://www.theguardian.com/technology/2016/may/09/london-hi...). They were fined GBP180K (under the pre-gdpr regime, incidentally, so this isn't a new risk for businesses).
  - pkaye 7y ago
    I think that is why my hospital network uses an online patient account for any messages instead of email. Easy to screw up this stuff if using email.
- rococode 7y ago
  But how is that different from any of the other privacy violations that are regulated? I doubt many of us could prove any damages from Amazon listening in on conversations made by our kids, or Google not properly disclosing that its tracking our search clicks and GPS location for better ad targeting. In fact, I'd argue that leaking an email that exposes a private association with a mailing list to other unknown people has much clearer potential for damage than any of the privacy issues that big companies get fined for. And yes, CC leaks do happen (not a lot, in my experience), but I'm personally upset about it every time - much more so than when I find out Google didn't get my consent before recording half of my internet activity. Just because the violation is something that "happens a lot" because it can be done by accident by a careless individual doesn't mean it's less serious.

jdietrich 7y ago

In the UK, the data regulator fined a small organisation £180,000 ($230,000) for exactly the same mistake on a list with 781 recipients. The organisation was a specialist sexual health clinic and the newsletter was for patients with HIV. Without knowing the details, I can't say whether a €2000 fine was disproportionately onerous or a slap on the wrist. https://www.businessinsider.com/nhs-trust-fined-for-leaking-700-hiv-clinic-patients-data-in-email-error-56-dean-street-to-bcc-2016-5 https://www.businessinsider.com/nhs-trust-fined-for-leaking-...

nothrabannosir 7y ago
HN tangent: This is a great example of where the oft touted wildcards on a personal domain fall short: if you’re on that list, you’re outed. Even without your name on it; only you use that domain. This is where Outlook with their *@outlook.com and apple’s new system really do shine. Commiserations to those affected :(
- Normal_gaussian 7y ago
  Wildcards are a measure to track what others are (automatically) doing with your email address, provide a way to remove yourself from shared lists of bad actors, and sign up to something a dozen times. What they don't do is provide privacy against human eyes.
  - Silhouette 7y ago
    I've been wondering how this sort of email management strategy is going to handle the rules certain countries are bringing in now where if you want to go there then you have to provide a list of all of your email addresses and social media accounts. Has anyone run into that problem yet?
    - londons_explore 7y ago
      Yes, my email address is "usa-border@mydomain.com"
7y ago

notafraudster 7y ago

I support this fine in principle. Maybe not the magnitude, maybe not without a warning, and of course a three liner isn't enough context to be sure. But using CC instead of BCC causes a massive leak of personal information, especially when either the subject being discussed or the people on the list are sensitive. In my life this has mostly been annoyance at large org stuff, but my wife has had this happen with a sensitive medical practice and we were not in the US so HIPAA did not apply. I don't think fines are the only solution, of course. But I think fines should be on the table and it's easy to me imagine a circumstance where 2k euro would be appropriate.

TomVDB 7y ago
Last year, when GDPR was heavily discussed, people were criticizing those who decided to just stop their small hobby websites because of the potential GDPR exposure. The argument back then was that they were overreacting, that we didn't understand how Europe works, that you'd only get fined after repeated warnings about violating procedures etc. I'm sure the private person was dumb for doing what he did, but that doesn't invalidate the general point: unless you're sure you that can afford making these kinds of mistakes, don't provide a service on the internet that might be used by EU citizens. The benefits, whatever they might be, just don't justify the risks.
- cosmodisk 7y ago
  That's absurd. Talking purely about the UK right now: there were tens of thousands of cases logged with ICO since GDPR came into power. So far,there were only a handful of companies that had to pay fines and their actions were either borderline criminal,or deliberate refusal to cooperate with ICO.
- NeedMoreTea 7y ago
  Except we see just the fine. We have no idea how many attempts and warnings to get them to comply were sent first. It wasn't one email, it was multiple emails, multiple times over months. This site makes no mention of warnings and escalations, and ICO at least doesn't normally announce that for individual cases. Though they do put out aggregate stats. When they have fines are clearly shown as arising in a small minority of cases.

dRaBoQ 7y ago

This is crazy. I've seen it done plenty of times by accident in the past, because people don't know how to use BCC (and its hidden by default in many clients).

lokedhs 7y ago
Not just hidden. When using BCC, the information is never transmitted outside the sending server.
- kbenson 7y ago
  I think what they meant is the option to send as BCC instead of CC is hidden in most mail clients.
  - lokedhs 7y ago
    Thank you. That does indeed make more sense.
laughinghan 7y ago
Yeah, but ten times in a row? And that's just in half a month, it sounds it could've been dozens of times over 3 months? Nothing I've heard about this case sounds to me like an innocent mistake that a reasonable effort was made to correct. I've accidentally smacked people on the street before (gesturing, probably). That's technically a crime, but it'd be crazy to prosecute me for a little mistake like that. But it's not crazy that hitting people is a crime and that people do get prosecuted for it in egregious cases.

ysleepy 7y ago

The list has over 1600 recipients making it a bit larger than for "personal use". The quoted 187 recipients might just be one batch of recipients the examined mail was sent to. The sender is also non-repentant and is running some sort of hate campaign.

cosmodisk 7y ago

It should have been more.The idiots who do this deserve it. My fiancé's ex employeer used to send emails cc'ing contractors that haven't even seen each other.I've seen some small scale companies even try to send marketing emails to their small list of clients..

tgsovlerkhgsel 7y ago

If it's the case I've seen [1], it wasn't someone sending a little mailing list newsletter to people who have opted in, it was someone sending complaints and CC'ing everyone they could get an e-mail address of. The article I saw also makes it sound very much like he was told to stop repeatedly. Seems like an appropriate fine. Or do you think I should be allowed to collect 150 e-mail addresses, then e-mail them out to all 150 other people, after some of them told me not to do that? [1] https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail-verteiler.html https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail...

Abishek_Muthian 7y ago

In India, I often get government mails (e.g. reminder for some compliance) of local city with all the business owners in CC. I even went to authority in question to tell them about the privacy issue in vain. So if a EU citizen's email id was part of the list, will it be liable for action according to GDPR?

waisbrot 7y ago
Yes, but if an entity has no interest in interacting with the EU then they don't have to respond. You only need to care about a country's laws if (1) you want to do business or visit there or (2) you're going to piss them off to such a degree that they convince your home country to come after you.

rorykoehler 7y ago

Airbnb Germany did this once in a mail out to all hosts. We started a business (since closed) off the back of it.

laughinghan 7y ago

This seems to be proof that the GDPR is being weaponized against people and organizations one doesn't like. What didn't they like about this person, and what proved that to you? And what proved that was the impetus for this fine?

tinus_hn 7y ago

Seems to be proof it is being weaponized against behavior one doesn’t like, the behavior which is forbidden by the law. This isn’t a one time slip up, it’s a 10 times slip up and chances are there were a lot of warnings this guy didn’t want to listen to. So he was hit where it hurts. Poor guy, it’s like he was caught speeding ten times and then got fined.

ivanhoe 7y ago

> This seems to be proof that the GDPR is being weaponized against people and organizations one doesn't like. Well, against people who publicly share private info of 150 other people who trusted them those emails. 2K euros is not that huge money in Germany, it's not like they'll loose their house over it, and that certainly is a practice that needs to be stopped. Just being an amateur is not an excuse when you deal with other peoples' data.

ascorbic 7y ago

If the story linked elsewhere in this thread is the one in question, this wasn't an accident. It was a guy running some kind of harrassment campaign. His "little mailing list" was of people he was harrassing, not subscribers to a newsletter. https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail-verteiler.html https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail...

rndgermandude 7y ago
Not a harassment campaign as such, it seems. He was mad about something, and mailed a bunch of politicians and press his complaints. Complaints, sometimes bordering on being libelous, according to the agency which fined him, not death threats. He was fined solely based upon the email addresses being visible to all recipients, not because of the content of his mails, said a spokesperson. However, he was a repeat offender in terms of privacy, who in the past was warned, then fined for similar stuff. I'm a little bit torn on that one. The fine seems excessive for what he did (and the email addresses seem to be a list of already public journalist and press contacts) and it certainly looks like somebody in the govt got annoyed and threw the book at the guy in retaliation. Then again, he had ample warnings, and choose to ignore those warnings.
- wjnc 7y ago
  Isn't one of the points of separation of power that the government (executive branche) should not have priority access to the judicial branche? Fining individuals, even loony ones, while not even attempting to fight the big battles (FAANG, personal data trading for 'profiling' or even government profiling within the EU) is imho just preposterous.
  - simonh 7y ago
    What sort of priority access was used in this case? Maybe they just filed a complaint like anyone else.
  - rndgermandude 7y ago
    Well, the judiciary branch was not involved in this fine. It was a government agency issuing the fine. Now the fined person could pay the fine, or file a suit asking a court to overturn it. It really is analogous to most govt fines e.g. speeding tickets: the government (the police) gives you a ticket, and if you pay it then OK, no court involved, but if you challenge it then the courts get involved. But more generally, the government should and does get priority access to the courts already. Criminal courts exist solely to serve the government; you cannot bring criminal suits as a citizen yourself, only civil suites. Also, e.g. in Germany the government and legislatures (federal and state) get priority access to e.g. the constitutional (supreme) court. A mere mortal cannot just file suit directly in the constitutional court, but has to go through the lower instances first (unless there is something similar to a class action petition, showing a sizable chunk of the population sees the same issue and wants it decided). Members of the parliaments and IIRC of the cabinet are allowed to file suit in the constitutional court directly. The reasoning here is that if it was allowed for citizens to petition the highest court directly, then the court would do nothing else than write rejection letters for bullshit petitions. While the govt and legislatures incl the parliamentary opposition of course represent the people (in theory) and aren't stupid morons wasting the courts time (in theory). PS: Google was already fined €50M for GDPR violations, and there is probably more of those in their future. Facebook got fined €10M so far, IIRC, also with more to come. And don't forget the billions of Euros worth of antitrust fines against Google and Microsoft, e.g.

orcdork 7y ago

"The national Football League (LaLiga) was fined for offering an app which once per minute accessed the microphone of users' mobile phones in order to detect pubs screening football matches without paying a fee" Yes, proof of weaponized gdpr use indeed (for very specific filtering cases of gdpr use).

TeMPOraL 7y ago

Woah. That's great! In Poland we actually have a sort-of tradition, AFAIK started by one of computer security portals, where if you find yourself on the receiving end of such CC-instead-of-BCC, you kindly tell the company responsible that this can and should be picked up with data protection regulators, and it would be nice if they e.g. paid ~500-2k EUR equivalent to a charity of their choice. I'm totally 100% in support of this against companies. Less so about private individuals, though a 150-people newsletter is kind of thought-out and organized thing, and then 2k EUR in Germany is probably less than a monthly paycheck. A hard hit, but survivable without loss of life quality.

deleted 7y ago

[deleted]