3 ms·

They key part there is "if they decide to fine you...". The max(€10m, 2%) and max(€20m, 4%) are the most that supervisory authorities may issue as fines. But

by M2Ys4U 7y ago

They key part there is "if they decide to fine you...". The max(€10m, 2%) and max(€20m, 4%) are the most that supervisory authorities may issue as fines. But supervisory authorities have a legal duty to issue fines that are proportional which means than unless you breach the GDPR in a wilful and egregious manner you're unlikely to be fined that much (and if you are you can appeal the fine to a court who would reduce it to a proportional amount).

Mirioron 7y ago
But since we're talking about small sites and small businesses, how many of these will actually be able to afford to go to court to argue this? In every system mistakes are made and corruption exists. Why word it in a way that seems to increase the likelihood of both?
gindely 7y ago
When would it ever be proportional to charge a small business more than 2% if they can never charge a large business more than 2%? Are small businesses, as a general rule, somehow more capable of causing damage than larger businesses? Is the law as written somehow vulnerable to some legal hack where all my revenue goes through Company A but all my data goes through Company B, so that Company B has a small global revenue despite being extremely profitable to the controllers of the companies?
- M2Ys4U 7y ago
  >Is the law as written somehow vulnerable to some legal hack where all my revenue goes through Company A but all my data goes through Company B, so that Company B has a small global revenue despite being extremely profitable to the controllers of the companies? No. Who the data controllers are is a matter of fact, not assignment. To quote the Court of Justice of the European Union in the Fashion ID case (C‑40/17) at paragraph 68: "[A] natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller". Furthermore, as per that case, multiple data controllers may exist for some processing activities. So both Company A and Company B may be considered to be Data Controllers and thus both liable.

by M2Ys4U 7y ago

Mirioron 7y ago

But since we're talking about small sites and small businesses, how many of these will actually be able to afford to go to court to argue this? In every system mistakes are made and corruption exists. Why word it in a way that seems to increase the likelihood of both?

gindely 7y ago

When would it ever be proportional to charge a small business more than 2% if they can never charge a large business more than 2%? Are small businesses, as a general rule, somehow more capable of causing damage than larger businesses? Is the law as written somehow vulnerable to some legal hack where all my revenue goes through Company A but all my data goes through Company B, so that Company B has a small global revenue despite being extremely profitable to the controllers of the companies?

M2Ys4U 7y ago
>Is the law as written somehow vulnerable to some legal hack where all my revenue goes through Company A but all my data goes through Company B, so that Company B has a small global revenue despite being extremely profitable to the controllers of the companies? No. Who the data controllers are is a matter of fact, not assignment. To quote the Court of Justice of the European Union in the Fashion ID case (C‑40/17) at paragraph 68: "[A] natural or legal person who exerts influence over the processing of personal data, for his own purposes, and who participates, as a result, in the determination of the purposes and means of that processing, may be regarded as a controller". Furthermore, as per that case, multiple data controllers may exist for some processing activities. So both Company A and Company B may be considered to be Data Controllers and thus both liable.