4 ms·

GDPR Enforcement Tracker

57 points by sturza 6y ago

sparsely 6y ago
Nice, although I did find this one for 560EUR: ``` Fine imposed on Forbes Hungary for publishing a list of the 50 wealthiest Hungarians and a list of the largest family businesses without a sufficient balance of interests (Art. 6 (1) f) GDPR). ```
- londons_explore 6y ago
  What do they mean by 'sufficient balance of interests'?
  - Gaelan 6y ago
    I'm guessing that means the court found the public's interest in knowing did not outweigh the listed people's interest in privacy
    - rendall 6y ago
      Outweighed to €560 extent
  - privacylawthrow 6y ago
    Under GDPR, companies must have a legal basis to process personal data. Processing personal data without a basis specified in law is illegal. One of those legal bases is that processing personal data is "necessary for the purposes of the legitimate interests pursued by the [company]". For companies that chose this as their legal basis, they must conduct a balancing test between the benefits provided by the processing and potential impact to individuals whose data is processed. If you don't do that balancing according to the whims of the data protection authority, your data processing will be a violation of GDPR. If you don't have documentation of that balancing, the authority will presume you did not do any balancing, and therefore your data processing violates GDPR.
Nextgrid 6y ago
This should read “GDPR lack of enforcement tracker”. I see no major fines for neither Google nor Facebook (the latter was only fined once on a technicality that has nothing to do with their tracking efforts).
- digitalengineer 6y ago
  Smaller fined for regular companies will have much more of an impact. Companies will realize the too can be targeted.
  - deleted 6y ago
    [deleted]
- tobltobs 6y ago
  Don't know why you are downvoted. This outcome was obvious from the beginning. Europe’s GDPR enforcers do not have the capacity to investigate Big Tech, just small fishes. Google and Facebook love the GDPR, they have the resources and lawyer to circumvent the spirit of the GDPR. Their smaller concurrents do not.
  - sturza 6y ago
    Big claims, any specific sources on the “love”, lack of capacity to investigate bog tech and “circumvention”? Also, maybe you missed all the google and facebook fines in the link.
- unkoman 6y ago
  Are you not seeing the 50 000 000 EUR+ fines to Google [1][2][3] then just sort by size of fine [1] https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc https://www.cnil.fr/en/cnils-restricted-committee-imposes-fi... [2] https://www.datainspektionen.se/globalassets/dokument/beslut/2020-03-11-beslut-google.pdf https://www.datainspektionen.se/globalassets/dokument/beslut... [3] https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-37-2020.pdf https://www.autoriteprotectiondonnees.be/publications/decisi...
Kikawala 6y ago
200EUR The private person used a dashcam to make recordings of public road traffic and then published them on YouTube as a compilation.
- tomschlick 6y ago
  Yeah thats some bullshit. You should have no expectation of privacy in public, especially regarding publicly visible vehicle tags. I could see if someone was specifically collecting vehicle tags ALPR and posting videos of them all, but a normal dashcam needing censored?!
  - dgellow 6y ago
    > You should have no expectation of privacy in public, especially regarding publicly visible vehicle tags That's not how European privacy framework work at all... You cannot just randomly share personally identifiable information. In Germany Google is forced to blur any PII data such as vehicle tags, or even full houses. It's the same for other platform. See here for the Google Street view case: https://bits.blogs.nytimes.com/2013/04/23/germanys-complicated-relationship-with-google-street-view/ https://bits.blogs.nytimes.com/2013/04/23/germanys-complicat.... Or this one, more recent: https://www.inverse.com/article/32886-google-map-privacy-variation https://www.inverse.com/article/32886-google-map-privacy-var....
    - tomschlick 6y ago
      I know, I'm disagreeing with that framework. There is no easy way to correlate vehicle tags to a real person's name for an average person. Banning video of anything that might include a vehicle tag is just burdensome and dumb. Also, that's way different than say banning the use of ALPR by companies. I wouldn't be as opposed to that as its happening in mass.
- YetAnotherNick 6y ago
  Who has free time to identify the driver and do a court case against him/her? And where did the 200EUR come from? Court cases are more expensive than that and it has the effect of mattering only to unwealthy person.
ShorsHammer 6y ago
Honestly just block all EU traffic with iptables and the geoip module. Life doesn't need to be like this if you have no business there.
- YetAnotherNick 6y ago
  Or just don't care if you are not on EU. I don't think there is clause for something like denial of entry or arrest on arrival.
- dTal 6y ago
  As someone in Europe, I second this. If your website is so invasive that it's too burdensome to comply with extremely reasonable privacy rules, I don't want to accidentally visit it.
  - ShorsHammer 6y ago
    My issue is mainly with the unintended consequences, the notifications and such rather than actually respecting reasonable privacy I run a bunch of websites with none of this nonsense and as such don't need to bother inserting an annoying interstitial for millions of hits telling people about laws in a world far removed from my own or theirs.

57 points by sturza 6y ago

Nice, although I did find this one for 560EUR: ``` Fine imposed on Forbes Hungary for publishing a list of the 50 wealthiest Hungarians and a list of the largest family businesses without a sufficient balance of interests (Art. 6 (1) f) GDPR). ```

londons_explore 6y ago
What do they mean by 'sufficient balance of interests'?
- Gaelan 6y ago
  I'm guessing that means the court found the public's interest in knowing did not outweigh the listed people's interest in privacy
  - rendall 6y ago
    Outweighed to €560 extent
- privacylawthrow 6y ago
  Under GDPR, companies must have a legal basis to process personal data. Processing personal data without a basis specified in law is illegal. One of those legal bases is that processing personal data is "necessary for the purposes of the legitimate interests pursued by the [company]". For companies that chose this as their legal basis, they must conduct a balancing test between the benefits provided by the processing and potential impact to individuals whose data is processed. If you don't do that balancing according to the whims of the data protection authority, your data processing will be a violation of GDPR. If you don't have documentation of that balancing, the authority will presume you did not do any balancing, and therefore your data processing violates GDPR.

Nextgrid 6y ago

This should read “GDPR lack of enforcement tracker”. I see no major fines for neither Google nor Facebook (the latter was only fined once on a technicality that has nothing to do with their tracking efforts).

digitalengineer 6y ago
Smaller fined for regular companies will have much more of an impact. Companies will realize the too can be targeted.
- deleted 6y ago
  [deleted]
tobltobs 6y ago
Don't know why you are downvoted. This outcome was obvious from the beginning. Europe’s GDPR enforcers do not have the capacity to investigate Big Tech, just small fishes. Google and Facebook love the GDPR, they have the resources and lawyer to circumvent the spirit of the GDPR. Their smaller concurrents do not.
- sturza 6y ago
  Big claims, any specific sources on the “love”, lack of capacity to investigate bog tech and “circumvention”? Also, maybe you missed all the google and facebook fines in the link.
unkoman 6y ago
Are you not seeing the 50 000 000 EUR+ fines to Google [1][2][3] then just sort by size of fine [1] https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc https://www.cnil.fr/en/cnils-restricted-committee-imposes-fi... [2] https://www.datainspektionen.se/globalassets/dokument/beslut/2020-03-11-beslut-google.pdf https://www.datainspektionen.se/globalassets/dokument/beslut... [3] https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-37-2020.pdf https://www.autoriteprotectiondonnees.be/publications/decisi...

Kikawala 6y ago

200EUR The private person used a dashcam to make recordings of public road traffic and then published them on YouTube as a compilation.

tomschlick 6y ago
Yeah thats some bullshit. You should have no expectation of privacy in public, especially regarding publicly visible vehicle tags. I could see if someone was specifically collecting vehicle tags ALPR and posting videos of them all, but a normal dashcam needing censored?!
- dgellow 6y ago
  > You should have no expectation of privacy in public, especially regarding publicly visible vehicle tags That's not how European privacy framework work at all... You cannot just randomly share personally identifiable information. In Germany Google is forced to blur any PII data such as vehicle tags, or even full houses. It's the same for other platform. See here for the Google Street view case: https://bits.blogs.nytimes.com/2013/04/23/germanys-complicated-relationship-with-google-street-view/ https://bits.blogs.nytimes.com/2013/04/23/germanys-complicat.... Or this one, more recent: https://www.inverse.com/article/32886-google-map-privacy-variation https://www.inverse.com/article/32886-google-map-privacy-var....
  - tomschlick 6y ago
    I know, I'm disagreeing with that framework. There is no easy way to correlate vehicle tags to a real person's name for an average person. Banning video of anything that might include a vehicle tag is just burdensome and dumb. Also, that's way different than say banning the use of ALPR by companies. I wouldn't be as opposed to that as its happening in mass.
YetAnotherNick 6y ago
Who has free time to identify the driver and do a court case against him/her? And where did the 200EUR come from? Court cases are more expensive than that and it has the effect of mattering only to unwealthy person.

ShorsHammer 6y ago

Honestly just block all EU traffic with iptables and the geoip module. Life doesn't need to be like this if you have no business there.

YetAnotherNick 6y ago
Or just don't care if you are not on EU. I don't think there is clause for something like denial of entry or arrest on arrival.
dTal 6y ago
As someone in Europe, I second this. If your website is so invasive that it's too burdensome to comply with extremely reasonable privacy rules, I don't want to accidentally visit it.
- ShorsHammer 6y ago
  My issue is mainly with the unintended consequences, the notifications and such rather than actually respecting reasonable privacy I run a bunch of websites with none of this nonsense and as such don't need to bother inserting an annoying interstitial for millions of hits telling people about laws in a world far removed from my own or theirs.