4 ms·

Very little money. If companies can screw up their customers that cheap, they would rather not do data protection at all.

foepys 6y ago
That's only a warning shot. If they are found to violate it again it will be much higher. Last year HN was complaining that GDPR made high fines possible that would sink any company. Now it's not enough.
- zaarn 6y ago
  The fine will certainly hurt, it's not exactly a small fine you can just book as part of your coffee budget. But it's not going to sink the company. If they do it again the fine will certainly be higher and sting a lot more. Possibly sink them. It's certainly a shot before the bow, close enough to do some damage to the ship but not sink it quite yet.
  - jacquesm 6y ago
    They don't want to sink the company. They want them to stop doing this, and send a message to other companies who are also doing things like this.
    - zaarn 6y ago
      Well, no, if the company doesn't stop and doesn't seem to stop the fines can be high enough to sink a company and I don't doubt that if it comes to it, the agencies involved are ready to sink a company over data protection.
      - jacquesm 6y ago
        Trust me on this: no company is going to take a 3% hit to their net profits after taxes as a happy event. The agencies are quite ready but it would take a pretty stupid management to step in front of that train willingly. Note that H&M was adamant that they would cease to collect this data (as they should be). The only case I know of where there was a multiple-repeat-offender the eventual fine was 250K for a violation involving a single individual (hospital employees in NL thought it was 'fun' to peek on the records of a minor celebrity).
        zaarn 6y ago
        A hit of 3% of their revenue on their profits. If your profit margin is 10% then that turns into a 30% profit hit and the board will be unhappy.
- 4ggr0 6y ago
  HN != HN Last year you read comments from people who said one thing, now you read a comment saying the opposite. That does not mean that HN has shifted. There are a lot of individuals on this platform with individual opinions.
- jaikoo 6y ago
  Just wish the UK's ICO were as strict at enforcing GDPR breaches. Most of the time the ICO will do nothing or issue laughably small fines.
majewsky 6y ago
It's not about customer data. They collected data about the health of their employees to an unlawful extent.
SpicyLemonZest 6y ago
This was their employees' data, not their customers.
rsynnott 6y ago
It's about 2% of their annual profit. That seems not-unreasonable for a first offense. Most companies don't want to incur a 35 million euro cost if they can help it, so it should hopefully improve compliance. Now, if you want a truly pointless fine, look no further than: https://www.wsj.com/articles/u-s-regulators-fine-pork-giant-smithfield-over-covid-19-outbreak-11599776324 https://www.wsj.com/articles/u-s-regulators-fine-pork-giant-... . A whole $13,494! As a general rule, once the penalties are seen as both likely and as more expensive than doing things properly, compliance will improve.

foepys 6y ago

That's only a warning shot. If they are found to violate it again it will be much higher. Last year HN was complaining that GDPR made high fines possible that would sink any company. Now it's not enough.

zaarn 6y ago
The fine will certainly hurt, it's not exactly a small fine you can just book as part of your coffee budget. But it's not going to sink the company. If they do it again the fine will certainly be higher and sting a lot more. Possibly sink them. It's certainly a shot before the bow, close enough to do some damage to the ship but not sink it quite yet.
- jacquesm 6y ago
  They don't want to sink the company. They want them to stop doing this, and send a message to other companies who are also doing things like this.
  - zaarn 6y ago
    Well, no, if the company doesn't stop and doesn't seem to stop the fines can be high enough to sink a company and I don't doubt that if it comes to it, the agencies involved are ready to sink a company over data protection.
    - jacquesm 6y ago
      Trust me on this: no company is going to take a 3% hit to their net profits after taxes as a happy event. The agencies are quite ready but it would take a pretty stupid management to step in front of that train willingly. Note that H&M was adamant that they would cease to collect this data (as they should be). The only case I know of where there was a multiple-repeat-offender the eventual fine was 250K for a violation involving a single individual (hospital employees in NL thought it was 'fun' to peek on the records of a minor celebrity).
      - zaarn 6y ago
        A hit of 3% of their revenue on their profits. If your profit margin is 10% then that turns into a 30% profit hit and the board will be unhappy.
4ggr0 6y ago
HN != HN Last year you read comments from people who said one thing, now you read a comment saying the opposite. That does not mean that HN has shifted. There are a lot of individuals on this platform with individual opinions.
jaikoo 6y ago
Just wish the UK's ICO were as strict at enforcing GDPR breaches. Most of the time the ICO will do nothing or issue laughably small fines.

majewsky 6y ago

It's not about customer data. They collected data about the health of their employees to an unlawful extent.

SpicyLemonZest 6y ago

This was their employees' data, not their customers.

rsynnott 6y ago

It's about 2% of their annual profit. That seems not-unreasonable for a first offense. Most companies don't want to incur a 35 million euro cost if they can help it, so it should hopefully improve compliance. Now, if you want a truly pointless fine, look no further than: https://www.wsj.com/articles/u-s-regulators-fine-pork-giant-smithfield-over-covid-19-outbreak-11599776324 https://www.wsj.com/articles/u-s-regulators-fine-pork-giant-... . A whole $13,494! As a general rule, once the penalties are seen as both likely and as more expensive than doing things properly, compliance will improve.