5 ms·

Last year, when GDPR was heavily discussed, people were criticizing those who decided to just stop their small hobby websites because of the potential GDPR expo

by TomVDB 7y ago

Last year, when GDPR was heavily discussed, people were criticizing those who decided to just stop their small hobby websites because of the potential GDPR exposure. The argument back then was that they were overreacting, that we didn't understand how Europe works, that you'd only get fined after repeated warnings about violating procedures etc. I'm sure the private person was dumb for doing what he did, but that doesn't invalidate the general point: unless you're sure you that can afford making these kinds of mistakes, don't provide a service on the internet that might be used by EU citizens. The benefits, whatever they might be, just don't justify the risks.

cosmodisk 7y ago
That's absurd. Talking purely about the UK right now: there were tens of thousands of cases logged with ICO since GDPR came into power. So far,there were only a handful of companies that had to pay fines and their actions were either borderline criminal,or deliberate refusal to cooperate with ICO.
NeedMoreTea 7y ago
Except we see just the fine. We have no idea how many attempts and warnings to get them to comply were sent first. It wasn't one email, it was multiple emails, multiple times over months. This site makes no mention of warnings and escalations, and ICO at least doesn't normally announce that for individual cases. Though they do put out aggregate stats. When they have fines are clearly shown as arising in a small minority of cases.
- TomVDB 7y ago
  > We have no idea how many attempts and warnings to get them to comply were sent first. True. But I doubt that even the most ruthlessly efficient GDPR enforcement authority could multiple enforcement requests between mid July and end July.
  - NeedMoreTea 7y ago
    Sure, but offences between July and September 2018, and convicted Feb 2019 only against the small sub selection in July. There's potential time for quite a few ignored warnings before prosecution, but I don't know and can't find out from here if or if not.
  - tjoff 7y ago
    They almost certainly got complaints from the users on that list. You tend to get pretty swift response from that. Very likely that they just ignored it.
  - sgift 7y ago
    Why are multiple requests needed? You do shit, you get a request to stop it, you don't do it, you get hit with a fine. How many requests do you expect the authorities to send? 5? 10? 100? If I get summoned to court and don't follow it I get a fine. How is this any different?
- easytiger 7y ago
  There are other examples at least from Germany where no warning or time to rectify was given, just a fine. https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-offers-enforcement-insights/ https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-o...
  - downandout 7y ago
    I lost 50 karma points trying to point out that warnings aren’t required. Tread lightly when disputing HN groupthink...
    - deleted 7y ago
      [deleted]
  - NeedMoreTea 7y ago
    800k email records and passwords in plain text when breached. I don't know how big Knuddels are, so I don't know if that fine sounds lenient, right or high. Yet as it's a large breach it seems fitting of no warning first, considering the scale of negligence, mitigated by their "exemplary cooperation" afterwards. Which goes to show why the regulators get the discretion to decide appropriate action from warning only to maximum fine. Without context and aggravating and mitigating factors we can't know, which was my point. If a penalty is disproportionate there's well worn appeal tracks. Other comments seem to point to the small case in OP comment being some guy running a list to harass people, which seems like a huge aggravating factor to me. Maybe he got one warning, maybe in context he didn't deserve even that.
comboy 7y ago
> unless you're sure you that can afford making these kinds of mistakes, don't provide a service on the internet DOT sounds good
- TomVDB 7y ago
  Everybody makes mistakes. Which makes GDPR a recipe to hand over whatever remains of the Internet to only corporations that afford paying for them.
  - comboy 7y ago
    Sure, but there are different kind of mistakes. Surgeon can make a mistake, but it's a different kind of mistake if instead of a surgeon, a plumber cuts the patient with a kitchen knife. I agree it's a difficult problem and it's hard to define boundaries, but some level of competence is welcome when handling data that belongs to other people. If you start some internet service, I expect you not to lose my data (in some lame way, s.h.), just like I expect my car mechanic not to destroy my engine. edit: to give it context, I closed my programming website with thousands of active users that I had for almost 20 years because of GDPR, I'm not a big fan of it, but what I like even less is when complete incompetence when handling personal data results in zero consequences
  - ubercow13 7y ago
    That's a pretty weak argument in and of itself. Many crimes are mistakes.
    - TomVDB 7y ago
      Similarly, many simple mistakes shouldn’t be treated as a crime.
  - cyphar 7y ago
    Yes, people make mistakes. And by deciding to create a business around other people's personal information some mistakes are bad enough to merit a fine. All sorts of civil offences and crimes can be mistakes. While "it was an accident" might lower the penalty it doesn't negate the fact the mistake was made and people might have been hurt. The idea that we should hold companies that profit off people's personal data blameless if they manage to "make a slip-up" with it is absurd. The only other industry where we accept those kinds of mistakes is Wall Street and we all know how well that policy has gone.

by TomVDB 7y ago

cosmodisk 7y ago

That's absurd. Talking purely about the UK right now: there were tens of thousands of cases logged with ICO since GDPR came into power. So far,there were only a handful of companies that had to pay fines and their actions were either borderline criminal,or deliberate refusal to cooperate with ICO.

NeedMoreTea 7y ago

Except we see just the fine. We have no idea how many attempts and warnings to get them to comply were sent first. It wasn't one email, it was multiple emails, multiple times over months. This site makes no mention of warnings and escalations, and ICO at least doesn't normally announce that for individual cases. Though they do put out aggregate stats. When they have fines are clearly shown as arising in a small minority of cases.

TomVDB 7y ago
> We have no idea how many attempts and warnings to get them to comply were sent first. True. But I doubt that even the most ruthlessly efficient GDPR enforcement authority could multiple enforcement requests between mid July and end July.
- NeedMoreTea 7y ago
  Sure, but offences between July and September 2018, and convicted Feb 2019 only against the small sub selection in July. There's potential time for quite a few ignored warnings before prosecution, but I don't know and can't find out from here if or if not.
- tjoff 7y ago
  They almost certainly got complaints from the users on that list. You tend to get pretty swift response from that. Very likely that they just ignored it.
- sgift 7y ago
  Why are multiple requests needed? You do shit, you get a request to stop it, you don't do it, you get hit with a fine. How many requests do you expect the authorities to send? 5? 10? 100? If I get summoned to court and don't follow it I get a fine. How is this any different?
easytiger 7y ago
There are other examples at least from Germany where no warning or time to rectify was given, just a fine. https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-offers-enforcement-insights/ https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-o...
- downandout 7y ago
  I lost 50 karma points trying to point out that warnings aren’t required. Tread lightly when disputing HN groupthink...
  - deleted 7y ago
    [deleted]
- NeedMoreTea 7y ago
  800k email records and passwords in plain text when breached. I don't know how big Knuddels are, so I don't know if that fine sounds lenient, right or high. Yet as it's a large breach it seems fitting of no warning first, considering the scale of negligence, mitigated by their "exemplary cooperation" afterwards. Which goes to show why the regulators get the discretion to decide appropriate action from warning only to maximum fine. Without context and aggravating and mitigating factors we can't know, which was my point. If a penalty is disproportionate there's well worn appeal tracks. Other comments seem to point to the small case in OP comment being some guy running a list to harass people, which seems like a huge aggravating factor to me. Maybe he got one warning, maybe in context he didn't deserve even that.

comboy 7y ago

> unless you're sure you that can afford making these kinds of mistakes, don't provide a service on the internet DOT sounds good

TomVDB 7y ago
Everybody makes mistakes. Which makes GDPR a recipe to hand over whatever remains of the Internet to only corporations that afford paying for them.
- comboy 7y ago
  Sure, but there are different kind of mistakes. Surgeon can make a mistake, but it's a different kind of mistake if instead of a surgeon, a plumber cuts the patient with a kitchen knife. I agree it's a difficult problem and it's hard to define boundaries, but some level of competence is welcome when handling data that belongs to other people. If you start some internet service, I expect you not to lose my data (in some lame way, s.h.), just like I expect my car mechanic not to destroy my engine. edit: to give it context, I closed my programming website with thousands of active users that I had for almost 20 years because of GDPR, I'm not a big fan of it, but what I like even less is when complete incompetence when handling personal data results in zero consequences
- ubercow13 7y ago
  That's a pretty weak argument in and of itself. Many crimes are mistakes.
  - TomVDB 7y ago
    Similarly, many simple mistakes shouldn’t be treated as a crime.
- cyphar 7y ago
  Yes, people make mistakes. And by deciding to create a business around other people's personal information some mistakes are bad enough to merit a fine. All sorts of civil offences and crimes can be mistakes. While "it was an accident" might lower the penalty it doesn't negate the fact the mistake was made and people might have been hurt. The idea that we should hold companies that profit off people's personal data blameless if they manage to "make a slip-up" with it is absurd. The only other industry where we accept those kinds of mistakes is Wall Street and we all know how well that policy has gone.