4 ms·

Fines for corporations should be a percentage of revenue, otherwise massive companies will keep doing heinous shit and write it off as a cost of doing business.

by jobu 6y ago

Fines for corporations should be a percentage of revenue, otherwise massive companies will keep doing heinous shit and write it off as a cost of doing business. The GDPR penalties in the EU are done this way (up to 4% of revenue).

hansvm 6y ago
That still just seems like a band-aid (sorry, I don't have a constructive alternative in mind). If Massively-Evil-Plan™ increases profits from 10% to 20% then even after a 4% fine on revenue, real profits are still 15%. A company only motivated by profits and fines (which seems like a reasonable assumption if we're using laws like GDPR to deter "heinous shit") would be crazy not to continue with MEP™. It's really the same kind of calculation as with fixed fines or fines based on damage done. When profitable, they're still written off as the cost of doing business. The only material difference would be that a fixed fine effectively allows large companies to do "heinous shit" while imposing fines so large that a small company can't compete, whereas with a revenue calculation you instead just need to make sure that your "heinous shit" is scalable. That doesn't apply in practice though, since GDPR has an alternative €20M fine which would go into effect, so in reality GDPR just says that to do "heinous shit" you need to be able to do a lot of it scalably and profitably. The natural direction one might take this is just to say that the fines must not be big enough, but until you approach 100% of revenue the potential always exists for a new form of profitable "heinous shit" to crop up. If fines of that scale are on the table then that brings us to the other side of the coin: A single violation of any anti-MEP™ law will nearly certainly end the business. If a violation of an anti-MEP™ law necessarily meant that a corporation was doing "heinous shit" then that could plausibly be acceptable (definitely up for debate), but merely not appointing a data protection officer in the EU violates GDPR and potentially subjects a business to a 2% of revenue fine. The law will not perfectly align with what a reasonable person would consider "heinous shit," and too severe of a penalty in such situations seems prone to abuse.

by jobu 6y ago

hansvm 6y ago

That still just seems like a band-aid (sorry, I don't have a constructive alternative in mind). If Massively-Evil-Plan™ increases profits from 10% to 20% then even after a 4% fine on revenue, real profits are still 15%. A company only motivated by profits and fines (which seems like a reasonable assumption if we're using laws like GDPR to deter "heinous shit") would be crazy not to continue with MEP™. It's really the same kind of calculation as with fixed fines or fines based on damage done. When profitable, they're still written off as the cost of doing business. The only material difference would be that a fixed fine effectively allows large companies to do "heinous shit" while imposing fines so large that a small company can't compete, whereas with a revenue calculation you instead just need to make sure that your "heinous shit" is scalable. That doesn't apply in practice though, since GDPR has an alternative €20M fine which would go into effect, so in reality GDPR just says that to do "heinous shit" you need to be able to do a lot of it scalably and profitably. The natural direction one might take this is just to say that the fines must not be big enough, but until you approach 100% of revenue the potential always exists for a new form of profitable "heinous shit" to crop up. If fines of that scale are on the table then that brings us to the other side of the coin: A single violation of any anti-MEP™ law will nearly certainly end the business. If a violation of an anti-MEP™ law necessarily meant that a corporation was doing "heinous shit" then that could plausibly be acceptable (definitely up for debate), but merely not appointing a data protection officer in the EU violates GDPR and potentially subjects a business to a 2% of revenue fine. The law will not perfectly align with what a reasonable person would consider "heinous shit," and too severe of a penalty in such situations seems prone to abuse.