3 ms·

Does anyone know if there's a GDPR fine on its way?

Nextgrid 6y ago
Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. (before you post a link to enforcementtracker.com please first compare the fine amounts with Facebook's revenue)
- pixelpoet 6y ago
  Great, so we get the worst of both worlds: outrageously obnoxious opt-out games (which, if skipped, implies free rein) and non-compliance as a cost of doing business. Wonderful.
  - Nextgrid 6y ago
    The obnoxious opt-outs are actually in breach of the GDPR as well, but are allowed to proliferate due to the lack of enforcement.
  - deckard1 6y ago
    GDPR/CCPA were always a way to punish the many (i.e. us) for the sins of the few (Facebook and Google). And, I might add, it's to their benefit. What we're entering is a future where only Amazon, Google, Facebook, and Apple can handle data. You see this constantly on HN. "Don't handle your own auth, just let Firebase do it!" People are against anyone other than AWS touching their data. And, well, we're getting the dystopia we deserve. What else can I say.
- yokaze 6y ago
  > Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. Not having the data encrypted at rest seems to me a different infraction than the previous ones. The scale also matters, and that it isn't the first infraction. And as I read it, not encrypting at rest is a breach of Article 6 and fined under Article 83 (5) (https://www.privacy-regulation.eu/en/article-83-general-conditions-for-imposing-administrative-fines-GDPR.htm https://www.privacy-regulation.eu/en/article-83-general-cond...), which puts the fine limit at 4% of the annual turn-over. Yes, it doesn't mean they have to fine as much, but the point remains, that this is in the category of the most severe infractions.
  - Nextgrid 6y ago
    Facebook's tracking consent flow has been in breach since the regulation went into effect in 2018, and has affected millions of people, both users and non-users. Keep in mind that had Facebook been compliant with the GDPR, the recent Apple changes regarding tracking consent on iOS wouldn't have been an issue for them at all. I'd argue this is a much bigger issue than the lack of at-rest data encryption, and yet nothing has been done. They also appear to be ignoring Subject Access Requests with total impunity: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/
  - KaiserPro 6y ago
    > the existence of appropriate safeguards, which may include encryption or pseudonymisation. which is not the same as data much be encrypted at rest.
  - iso1210 6y ago
    Facebook annual revenue is 86 billion. I'd be happy to see an end-fine anywhere over $1b

Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. (before you post a link to enforcementtracker.com please first compare the fine amounts with Facebook's revenue)

pixelpoet 6y ago
Great, so we get the worst of both worlds: outrageously obnoxious opt-out games (which, if skipped, implies free rein) and non-compliance as a cost of doing business. Wonderful.
- Nextgrid 6y ago
  The obnoxious opt-outs are actually in breach of the GDPR as well, but are allowed to proliferate due to the lack of enforcement.
- deckard1 6y ago
  GDPR/CCPA were always a way to punish the many (i.e. us) for the sins of the few (Facebook and Google). And, I might add, it's to their benefit. What we're entering is a future where only Amazon, Google, Facebook, and Apple can handle data. You see this constantly on HN. "Don't handle your own auth, just let Firebase do it!" People are against anyone other than AWS touching their data. And, well, we're getting the dystopia we deserve. What else can I say.
yokaze 6y ago
> Facebook already breaches the GDPR in many ways and has yet to see significant consequences, so this is unlikely. Not having the data encrypted at rest seems to me a different infraction than the previous ones. The scale also matters, and that it isn't the first infraction. And as I read it, not encrypting at rest is a breach of Article 6 and fined under Article 83 (5) (https://www.privacy-regulation.eu/en/article-83-general-conditions-for-imposing-administrative-fines-GDPR.htm https://www.privacy-regulation.eu/en/article-83-general-cond...), which puts the fine limit at 4% of the annual turn-over. Yes, it doesn't mean they have to fine as much, but the point remains, that this is in the category of the most severe infractions.
- Nextgrid 6y ago
  Facebook's tracking consent flow has been in breach since the regulation went into effect in 2018, and has affected millions of people, both users and non-users. Keep in mind that had Facebook been compliant with the GDPR, the recent Apple changes regarding tracking consent on iOS wouldn't have been an issue for them at all. I'd argue this is a much bigger issue than the lack of at-rest data encryption, and yet nothing has been done. They also appear to be ignoring Subject Access Requests with total impunity: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/
- KaiserPro 6y ago
  > the existence of appropriate safeguards, which may include encryption or pseudonymisation. which is not the same as data much be encrypted at rest.
- iso1210 6y ago
  Facebook annual revenue is 86 billion. I'd be happy to see an end-fine anywhere over $1b