8 ms·

The European Union has decided that growth based on clandestine tracking of users, selling their PII without consent is not a legitimate growth tool. You know,

by mola 7y ago

The European Union has decided that growth based on clandestine tracking of users, selling their PII without consent is not a legitimate growth tool. You know, like the way we outlawed violence as a "growth tool" Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger. The more power you have to break the law, the bigger the stakes should be.

Sean1708 7y ago
Unless I'm misunderstanding what you mean by absolute and relative, I think the law is already relative: > The maximum fine under the GDPR is up to 4% of annual global turnover or €20 million – whichever is greater – for organisations that infringe its requirements. From here: https://www.itgovernance.co.uk/dpa-and-gdpr-penalties https://www.itgovernance.co.uk/dpa-and-gdpr-penalties
- sokoloff 7y ago
  In context, "relatively bigger" would mean something like a progressive tax bracket. $20MM up to $500MM rev, 4% up to $1BB rev, 5% up to $2BB rev, 6% up to $5BB rev, etc... A straight 4% would be absolutely bigger, but relatively the same (once beyond $500M).
  - mamon 7y ago
    I think it's not about "income brackets", it is about profit margins which can vary a lot between industries. 4% of revenue is enough to bankrupt traditional business, like Wallmart with profit margins of 2,48%. Google is a low-cost business, with profit margin of 25%, so even the maximum GDPR fine is something they can just write off.
    - inlined 7y ago
      So just make the fine a portion of profit? Maybe a three layer system that takes into account flat euro rate, a percent of revenue, or a bigger percent of profit; whichever is highest.
      - sokoloff 7y ago
        Though I think the GDPR is bad law in some ways (chiefly in terms of the chilling effect on small operators), I think that allowing the cap on the fine to be revenue based (and specifically global revenue based) is nearly essential. Otherwise, you get into accounting chicanery (or outright loss-making companies being able to operate with impunity while they grow). There's nothing stopping the enforcement action to take into account the underlying profitability if something like a grocery store were to run afoul of GDPR.
      - mamon 7y ago
        Making fine a percentage of profit would be even worse: Amazon, for example has no taxable profit at all, so the GDPR fine for them would be $0 (or $20M, which does not make much difference). And having different fines for different industries, based on gross profit margings could be viewed as discriminatory, and therefore ruled illegal.
  - mola 7y ago
    This
  - pezo1919 7y ago
    This is a good idea. However what about phantom businesses which commit the crime and would not have real revenue. My problem is with fines that they don't really force the PEOPLE in the businesses to play fair. What about required & [RESPONSIBLE] roles and jail? I am asking that in general because I am fed up with our business-entities made world where committing a crime is basically RECOMMENDED if the numbers and percentages say so.
- deleted 7y ago
  [deleted]
owenmarshall 7y ago
> Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger. The more power you have to break the law, the bigger the stakes should be. GDPR penalties are a flat fee or a percentage of revenue, whichever is higher. If Google is truly willfully violating the GDPR, the maximum penalty by law could be up to 4% of their global turnover. I would not call that pocket change. But more importantly, it is a relative increase in fine based on the law breaking company. (Will the EU actually fine Google ~6 billion dollars? Perhaps we will find out!)
- Polyisoprene 7y ago
  If their whole business model is selling personal data, then 4% is clearly just a cost of running their business.
  - owenmarshall 7y ago
    The GDPR does consider willful violations and a pattern of behavior. 4% the first time might be something you can shrug off, especially for a company the size of Google. But if you continue breaking the law and give the regulators an easy second or third bite at the apple... I’d expect Google makes no changes and fights the regulators the first few times. E: I used to have a comment here about Google continuing their current practices against non-EU people but it appears from my reading of the GDPR that may not be so simple
  - hobofan 7y ago
    Given that "European Commision fines" is its own bullet point under "Costs and Expenses" in Alphabet's latest quaterly report, that view sounds about right.
- icebraining 7y ago
  > Will the EU actually fine Google ~6 billion dollars? Perhaps we will find out!) The EU already fined Google a total of $9 billion over the last two years.
priansh 7y ago
The fine is already kinda big for GDPR (4% global rev for big companies) but Google has gotten away with way worse on way more regulated fronts i.e. their antitrust case which slapped them on the wrist. If GDPR wants to be effective they need a ridiculous company-breaking fine for big abusers like COPPA and the like. Something like a per-user fine for violations that means they either can't do business in the EU or they have to become compliant otherwise risk being basically destroyed (for reference, violating child protection laws in the US can break and have broken companies before). EDIT: also as for the tracking growth comment -- I agree on this, but the effects of GDPR on growth tools reach far beyond this. Even basic metrics are hard to get without a bunch of hoops. Even if you store no data you have to have a bunch of checkboxes and banners everywhere. Just for using Google Analytics that just relies on what they know about your computer (fingerprinting), and uses no PII at all, you need a banner and privacy policy. The laws are making it hard to use even basic analytics without fearing a misstep.
- archy_ 7y ago
  >Google has gotten away with way worse on way more regulated fronts i.e. their antitrust case which slapped them on the wrist. Although I feel that Google has won its position in search, etc by offering a legitimately better product, we need to punish companies that continue to break the law. Success does not put you above the law. If you use your massive profits to absorb fines for breaking the law repeatedly, you should lose your ability to operate as a corporation and be dissolved. We need to reform antitrust laws. It's not just being able to control an entire market anymore, it's about being able to ignore international law because you have so much money.
  - priansh 7y ago
    I agree! IMO, punishing data abusers can't be solved with data privacy laws. It's a regulation with very little ability to be enforced. In the first place to abuse data you need a lot of it, so really we're looking mostly at big companies with big pockets. The easiest way to attack here is to punish unfair markets and to have stronger antitrust laws. Let's look at the textbook case for privacy with Facebook. Facebook would be the prime candidate for antitrust no matter how you look at it: there are basically no competitors to it in the US social media market. They own everything except Snapchat, which is dying off and failing to turn a profit. Facebook accounts for so much presence in the US that they have login buttons you can integrate on different sites (Google does too because of how crazy cemented they are). Yet somehow besides being so obviously monopolistic and out of control they're hit with no antitrust. Bell was split up for doing much less. Antitrust is just a joke right now. We have to get better enforcement first before looking to create regulations to be enforced.

by mola 7y ago

Sean1708 7y ago

Unless I'm misunderstanding what you mean by absolute and relative, I think the law is already relative: > The maximum fine under the GDPR is up to 4% of annual global turnover or €20 million – whichever is greater – for organisations that infringe its requirements. From here: https://www.itgovernance.co.uk/dpa-and-gdpr-penalties https://www.itgovernance.co.uk/dpa-and-gdpr-penalties

sokoloff 7y ago
In context, "relatively bigger" would mean something like a progressive tax bracket. $20MM up to $500MM rev, 4% up to $1BB rev, 5% up to $2BB rev, 6% up to $5BB rev, etc... A straight 4% would be absolutely bigger, but relatively the same (once beyond $500M).
- mamon 7y ago
  I think it's not about "income brackets", it is about profit margins which can vary a lot between industries. 4% of revenue is enough to bankrupt traditional business, like Wallmart with profit margins of 2,48%. Google is a low-cost business, with profit margin of 25%, so even the maximum GDPR fine is something they can just write off.
  - inlined 7y ago
    So just make the fine a portion of profit? Maybe a three layer system that takes into account flat euro rate, a percent of revenue, or a bigger percent of profit; whichever is highest.
    - sokoloff 7y ago
      Though I think the GDPR is bad law in some ways (chiefly in terms of the chilling effect on small operators), I think that allowing the cap on the fine to be revenue based (and specifically global revenue based) is nearly essential. Otherwise, you get into accounting chicanery (or outright loss-making companies being able to operate with impunity while they grow). There's nothing stopping the enforcement action to take into account the underlying profitability if something like a grocery store were to run afoul of GDPR.
    - mamon 7y ago
      Making fine a percentage of profit would be even worse: Amazon, for example has no taxable profit at all, so the GDPR fine for them would be $0 (or $20M, which does not make much difference). And having different fines for different industries, based on gross profit margings could be viewed as discriminatory, and therefore ruled illegal.
- mola 7y ago
  This
- pezo1919 7y ago
  This is a good idea. However what about phantom businesses which commit the crime and would not have real revenue. My problem is with fines that they don't really force the PEOPLE in the businesses to play fair. What about required & [RESPONSIBLE] roles and jail? I am asking that in general because I am fed up with our business-entities made world where committing a crime is basically RECOMMENDED if the numbers and percentages say so.
deleted 7y ago
[deleted]

owenmarshall 7y ago

> Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger. The more power you have to break the law, the bigger the stakes should be. GDPR penalties are a flat fee or a percentage of revenue, whichever is higher. If Google is truly willfully violating the GDPR, the maximum penalty by law could be up to 4% of their global turnover. I would not call that pocket change. But more importantly, it is a relative increase in fine based on the law breaking company. (Will the EU actually fine Google ~6 billion dollars? Perhaps we will find out!)

Polyisoprene 7y ago
If their whole business model is selling personal data, then 4% is clearly just a cost of running their business.
- owenmarshall 7y ago
  The GDPR does consider willful violations and a pattern of behavior. 4% the first time might be something you can shrug off, especially for a company the size of Google. But if you continue breaking the law and give the regulators an easy second or third bite at the apple... I’d expect Google makes no changes and fights the regulators the first few times. E: I used to have a comment here about Google continuing their current practices against non-EU people but it appears from my reading of the GDPR that may not be so simple
- hobofan 7y ago
  Given that "European Commision fines" is its own bullet point under "Costs and Expenses" in Alphabet's latest quaterly report, that view sounds about right.
icebraining 7y ago
> Will the EU actually fine Google ~6 billion dollars? Perhaps we will find out!) The EU already fined Google a total of $9 billion over the last two years.

priansh 7y ago

The fine is already kinda big for GDPR (4% global rev for big companies) but Google has gotten away with way worse on way more regulated fronts i.e. their antitrust case which slapped them on the wrist. If GDPR wants to be effective they need a ridiculous company-breaking fine for big abusers like COPPA and the like. Something like a per-user fine for violations that means they either can't do business in the EU or they have to become compliant otherwise risk being basically destroyed (for reference, violating child protection laws in the US can break and have broken companies before). EDIT: also as for the tracking growth comment -- I agree on this, but the effects of GDPR on growth tools reach far beyond this. Even basic metrics are hard to get without a bunch of hoops. Even if you store no data you have to have a bunch of checkboxes and banners everywhere. Just for using Google Analytics that just relies on what they know about your computer (fingerprinting), and uses no PII at all, you need a banner and privacy policy. The laws are making it hard to use even basic analytics without fearing a misstep.

archy_ 7y ago
>Google has gotten away with way worse on way more regulated fronts i.e. their antitrust case which slapped them on the wrist. Although I feel that Google has won its position in search, etc by offering a legitimately better product, we need to punish companies that continue to break the law. Success does not put you above the law. If you use your massive profits to absorb fines for breaking the law repeatedly, you should lose your ability to operate as a corporation and be dissolved. We need to reform antitrust laws. It's not just being able to control an entire market anymore, it's about being able to ignore international law because you have so much money.
- priansh 7y ago
  I agree! IMO, punishing data abusers can't be solved with data privacy laws. It's a regulation with very little ability to be enforced. In the first place to abuse data you need a lot of it, so really we're looking mostly at big companies with big pockets. The easiest way to attack here is to punish unfair markets and to have stronger antitrust laws. Let's look at the textbook case for privacy with Facebook. Facebook would be the prime candidate for antitrust no matter how you look at it: there are basically no competitors to it in the US social media market. They own everything except Snapchat, which is dying off and failing to turn a profit. Facebook accounts for so much presence in the US that they have login buttons you can integrate on different sites (Google does too because of how crazy cemented they are). Yet somehow besides being so obviously monopolistic and out of control they're hit with no antitrust. Bell was split up for doing much less. Antitrust is just a joke right now. We have to get better enforcement first before looking to create regulations to be enforced.