7 ms·

3 years of GDPR: The biggest fines so far

Dah00n 5y ago
Some will say "I told you so, they still do not get fined harshly enough to make any difference" while others will say "this is just unfair money grabbing governments" and while everyone argues back and forth with the same arguments as the last ten discussions I sit here on the sidelines, a normal internet user, who by the simple mentioning of GDPR have gotten big companies, like Epic, and powerful people, like a CEO of a pretty big company, to actually do something where they before would totally have ignored me. GDPR is not perfect at all but it does do a heck of a difference already. Edit: Downvotes, really? :/
- jchw 5y ago
  It still basically does not differentiate between Epic Games and me. And I can’t handle the fines. The chilling effect this will have on people is being downplayed pretty harshly by people who are basically suggesting you should just pray that you don’t get put into massive debt because you made a mistake on a side project. For that reason, GDPR will always draw some ire from me.
  - sealeck 5y ago
    Don't let people enter their data onto your side projects unless you're willing to treat it responsibly?
    - jchw 5y ago
      Intent doesn’t matter; the fear is the same: life-destroying fines. If that’s the choice, I’d just opt out of taking EU customers.
      - Hamuko 5y ago
        How many examples of life-destroying fines do you have?
        jchw 5y ago
        So basically, you’re in the “No, it’s fine — this will only ever get used against bad guys!” camp. We had 9/11 here in America and the BS that followed and I don’t humor this line of thinking. (Nor humour.)
        Hamuko 5y ago
        No, I'm in the "prove that the thing you are claiming to happen actually happens" camp.
        jchw 5y ago
        I’m not claiming something happened — do you understand how chilling effects work? The threat of potentially massive fines with very little legal bounds for not following regulations that individuals basically can’t follow means that people who want to follow the rules but aren’t big enough don’t play anymore.
        Hamuko 5y ago
        So no one's life has ever been ruined by the GDPR? But you're still sure that this will happen? What is this based on?
        jchw 5y ago
        I can get fined between 0 and €20 million at any moment because I am an individual and have no means to fully understand GDPR nor hire a DPO for my stupid personal websites. I make no money in ads or otherwise, but I am still treated like Epic Games if I collect sign up emails or logs. I only still run this stuff now because I’ve been running it for over a decade. I can tell you right now I am hesitant to run websites anymore. If you don’t understand how “ambiguous threat of a fine” isn’t calmed by “it hasn’t happened yet,” I can’t help you. What if my site was politically controversial? Should I trust all EU governments to act responsibly and not take advantage of their power ever?
      - tgsovlerkhgsel 5y ago
        Can you show me one example where there was a "life-destroying" fine? Not "a big company was fined an amount of money that would be life destroying if I had to pay it for a personal project", because revenue/economic means are a key factor in GDPR fine calculation.
      - anoncake 5y ago
        Maybe it doesn't in America. Here it does.
  - Hamuko 5y ago
    My name, my address, my phone number and my credit card details are the same regardless whether you or Epic Games is storing them in a database.
    - jchw 5y ago
      A data breach alone is not a GDPR violation as far as I know. Your data is just as at risk of being exposed no matter what. As far as I can tell the intent of GDPR is to prevent companies from selling or using your data in ways that you did not consent to. However, the bookkeeping requirements quite literally break the internet that existed where one person could run a website. As it turns out, I do not have a Data Protection Officer for my wiki I started in 2008. Does that mean I am not GDPR compliant?
      - amichal 5y ago
        And you dont need to have one: .... hiring an actual Data Protection Officer is only required by the GDPR if you meet one of three criteria: * Public authority — The processing of personal data is done by a public body or public authorities, with exemptions granted to courts and other independent judicial authorities. * Large scale, regular monitoring — The processing of personal data is the core activity of an organization who regularly and systematically observes its “data subjects” (which, under the GDPR, means citizens or residents of the EU) on a large scale. * Large-scale special data categories — The processing of specific “special” data categories (as defined by the GDPR) is part of an organization’s core activity and is done on a large scale. https://gdpr.eu/data-protection-officer/ https://gdpr.eu/data-protection-officer/
        jchw 5y ago
        This is good to know. But while I will admit my mistake, the problem points to a bigger issue, which is, as a layperson and not an expert on European law, I simply do not have the expertise necessary to understand the law and its implications. This is of course true of any website under any jurisdiction, but most laws don’t come with such absurdly vicious teeth, and therefore the risk profile is a lot different. So perhaps my example was misinformed. But that’s kind of the problem: you need to have a lawyer to really be sure of these things. I don’t have a lawyer.
  - hkh28 5y ago
    GDPR fines are set among other things according to the resources of the entity that broke the rules. As a private person making a side project, you won't be liable for millions. The most recent examples of individuals being fined have been fines around €200 [0] [0] https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_a_natural_person&mtc=today https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_...
    - jchw 5y ago
      The maximums however, are absolutely insane. Am I supposed to just hope that in the range of 0 to €20 million, it’s something I can afford?
      - tephra 5y ago
        Getting a maximum fine not only means that your handling of personal data was especially egregious but that you probably didn't cooperate in any ways with the relevant DPA and refused to rectify the problem. I.e the maximum fine is highly unlikely for anyone to get, and if you get it you have done some very bad things.
        jchw 5y ago
        Yes, and what the GDPR crowd is telling me is that I should just trust the EU to always act fairly and never engage in any kind of politically motivated subterfuge. And not only that, my concerns and dissent regarding GDPR piss people off so much, that at this point, every comment I post just gets downvoted immediately. Now I realize it’s against HN guidelines to discuss this, but when I post a comment and the delay it takes for me to return from the post page is enough for my comment to already have a downvote, I feel discouraged. It’s very clear the person who did that had no good faith intent on a discussion nor intent to even minimally read my comment. And I’m supposed to try to argue my points in good faith despite this. The pro-GDPR crowd may be winning the mindshare but they are inheriting the cancer of something not allowed to be criticized. And if we ever do see an egregious fee driven by political motivations, am I supposed to feel smug for having predicted the possibility or sad that my mere expression that the default maximum fines are so ridiculous that they basically terrorize anyone who is not a multinational corporation turned out to be well-founded? All I ever asked for was for people to recognize the chilling effects that this regulation can have. The internet used to have so many small websites, forums and wikis, and many of these fall under the umbrella of GDPR. And this is basically the treatment I get for trying to represent this dying breed of website: as some corporate shill worth being buried and not considered. It’s not like I care that much about being with the mob, but it pains me that as the open internet gradually dies, people flat out just don’t care. GDPR as it is today is just represents a huge amount of risk for anyone that is not a multinational corporation, and it only gets scarier the further down you are. I’m sorry but just telling people to not worry about how the law is written will not work. Some people will ignore it, some people will try to follow it, and some people will just stop trying altogether deciding the risk simply isn’t worth it. And that latter part is most likely to occur for websites that are more objectionable, since they will likely face harsher treatment just due to cognitive biases alone, since we’re talking about considerations that humans make rather than the word of law.
  - t0mas88 5y ago
    The fines are based on your revenue and the impact. So they do differentiate between Epic Games and you. And for me as a user, it sucks if your side project leaks my credit card and SSN, because I'll be dealing with the identity theft and fraud. If you're not competent enough to keep them safe, then use a vendor that is or don't process then at all.
    - jchw 5y ago
      If it were only SSN or credit card data, this would be understandable. But I assume you’re aware GDPR is far broader than this. And as well, GDPR, again, doesn’t guarantee the safety of your data. It just adds fines to some circumstances where your data is misused. But an honest breach doesn’t lead to fines as far as I can tell, so you just have to live with that possibility either way. As best as I can tell, there is no legally binding texts anywhere that limits the fines. The maximums start at €20 million and go higher if you’re huge. In the mindset of “hope is not a strategy,” this maximum fine being the only legally binding limit is enough to make you go home. Maybe small companies can hope for preferential treatment, but as an individual even small fees could do serious harm.
      - jokethrowaway 5y ago
        Work behind a limited company and let it fail. Escape to Mexico in the worst scenario. South America is anyway becoming more and more appealing the more the West progress. That said, not that it changes much but I stopped taking EU customers (I take businesses and not customers) because of vatmoss and gdpr.
        Aerroon 5y ago
        Vatmoss was so blatantly dumb in its implementation that it makes me wonder whether the MEPs even spent 5 minutes thinking about the implications of it. How can you look at all the VAT systems and not realize that almost all of them have a minimum threshold?! It is a bit ironic that it's probably a good idea for an EU service to not serve EU customers.
    - deleted 5y ago
- Hamuko 5y ago
  I actually made a GDPR request to my insurance company. Turns out that not only did they have documents about me before I had ever signed a contract with them, they had documents about me before I was even born.
  - donatj 5y ago
    > They had documents about me before I was even born Can you elaborate?
    - Hamuko 5y ago
      Turns out that my parents took on some kind of a life insurance policy in an insurance company that no longer exists in the strict sense but the documents have carried on through fusions and when a couple of decades later I got car insurance, a bunch of old medical records and contracts were linked with my account.
  - 77pt77 5y ago
    > they had documents about me before I was even born. This needs some explanation. Also, what's stopping them from just lying?
    - Hamuko 5y ago
      >Also, what's stopping them from just lying? Well, hopefully the prospect of fines if they're caught. I'm hoping that the local data authorities won't be lenient if a company is caught outright lying.
zibzab 5y ago
Well, who do you folks think should be fined next? Also, can't we just agree that "Legitimate interest" is noncompliance and fine BBC too while at it?
- t0mas88 5y ago
  Facebook, they're refusing the right to access your data: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/ And Google for the whole Doubleclick Ad Exchange, they're sharing lots of user details with hundreds of bidders on every pageview that has ads. As well as storing all of that information in Google Cloud as part of their Ads Data Hub product. All without permission.
- tgsovlerkhgsel 5y ago
  1. Every single web site that uses dark patterns that make not saying yes impractical. Start with the ones that required more than 3 clicks, then clarify that "the request must be clear, concise and not unnecessarily disruptive" means "equally sized, equally highlighted buttons for 'accept all' and 'reject all'". 2. Every single company that knowingly processed data based on such invalid consent. 3. Every single website and company that processed data for advertising based on "legitimate interest"
  - sofixa 5y ago
    > 1. Every single web site that uses dark patterns that make not saying yes impractical. Start with the ones that required more than 3 clicks, then clarify that "the request must be clear, concise and not unnecessarily disruptive" means "equally sized, equally highlighted buttons for 'accept all' and 'reject all'". The French ICO, CNIL, just announced that refusing should be as easy as accepting, so they agree
- alkonaut 5y ago
  The largest site (by revenue) that currently uses a a two button consent dialog with “accept and continue” vs “manage options”. That’s not making opt-out the default choice. If multimillion fines were given to just a few hundred of these sites things would change pretty quickly.
tomcooks 5y ago
Now if only they forced websites to have a single, standardized, accessible, unobtrusive popup~
- paxys 5y ago
  I'm surprised there is no standard for this yet. Just build it into the browser like all other privacy-related requests (location, webcam etc.) are handled. If sites don't implement it, don't accept their cookies. That way I can also manage a blanket yes/no list without getting an obtrusive popup every time.
  - Hamuko 5y ago
    Expecting another smash success like the Do Not Track header.
    - atoav 5y ago
      If you could sue people for real money when they violate said header it might be taken more seriously pretty quickly.
      - Hamuko 5y ago
        I don't believe that you can sue under the GDPR. I've always understood it to be something that you can lodge a complaint against someone with your local authorities. No idea about the CCPA but I wouldn't be surprised if you could considering how lawsuit-happy Americans are.
        atoav 5y ago
        > I don't believe that you can sue under the GDPR. I don't believe that either, I just think that flags like these can only be taken seriously if all actors have maximum incentive to take these seriously.
    - cm2187 5y ago
      Do not track is a gentleman's agreement in a world of thugs. But you could block cookies at the browser level if the user clicks No.
temporalparts 5y ago
I'd be curious of a detailed analysis of the cost of GDPR to EU consumers. There are websites that shut down or no longer servicing European customers because of the concerns around GDPR.
- moooo99 5y ago
  I know that's only anecdotal and no evidence at all, but the only time I encountered a website that is not serving European users anymore was a link here on HN. I think most users didn't even notice and for the people who do and are really bothered, there are workarounds such as VPNs
  - Hamuko 5y ago
    I've only anecdotally ran across half a dozen local US news sites that claim how their EU visitors are very important (clearly they're not) and also a Japanese lyrics site.
    - anoncake 5y ago
      A local US news site that doesn't care about its few EU visitors obviously doesn't fall under GDPR. I wonder if one that targets them by putting up a non-compliant popup does?
ydnaclementine 5y ago
I use this addon to hide the opt-ins: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/ >In most cases, it just blocks or hides cookie related pop-ups. When it's needed for the website to work properly, it will automatically accept the cookie policy for you (sometimes it will accept all and sometimes only necessary cookie categories, depending on what's easier to do). It doesn't delete cookies.
- brocket 5y ago
  Nice that you can add the list (https://www.i-dont-care-about-cookies.eu/abp/ https://www.i-dont-care-about-cookies.eu/abp/) to uBlock Origin instead of installing another addon.
vmception 5y ago
1) Subscribe via email! 2) Accept our cookies and let us track you! (with a delay for choosing anything that's not accept all) 3) Surprise! There might be a paywall whether subscribed via email or not! Schrodinger's paywall 4) Oh hey! I saw you paused scrolling or moved your mouse in the general direction of the back button, check out this other thing! 5) Okay lol, here's the article. Maybe. Depending on the deal we cut with the creators of your specific browser and geographic location and how many other articles you've read this month. and thats with adblock Europe and California, we are counting on you to fix the internet!
midasuni 5y ago
1) don’t track visitors Then there you go, no popups, no consent to ask for, job done.
- Aerroon 5y ago
  Maybe the EU could start with making their own websites not have popups? https://europa.eu/ https://europa.eu/ If it's so easy to do then surely an organization with a bottomless pit of money and no accountability on it should be the first to manage it?
  - midasuni 5y ago
    It is easy to do - this site being the prime example.
makomk 5y ago
It remains somewhat, ah, interesting that the biggest GDPR fine is for not being able to withstand a targeted attack by a motivated attacker. The British Airways compromise seems to have involved someone getting access to their systems (which basically just requires one employee screwing up, once) and hiding malicious code in their website so custom-tailored to them that an uninvolved outside expert in the malware family involved had trouble ientifying where it was after he knew it was there due to the news coverage. That's the kind of "gross negligence" that leads to a record fine and I don't think IT security as it currently stands is even remotely capable of preventing it.
- number6 5y ago
  The watchdog argued that there where security measures that could had been in place that would have prevented the breach. I guess BA saw this the same way or they had gone to court and appealed the fine
TazeTSchnitzel 5y ago
If you're surprised there haven't been many big fines against large tech companies yet, that may be because there's a large backlog of cases that are bottlenecked by the budget of Ireland's DPA: https://www.euractiv.com/section/data-protection/news/european-parliament-calls-for-infringement-procedure-against-ireland/ https://www.euractiv.com/section/data-protection/news/europe...
nickpp 5y ago
The biggest fine was on us users, forced to hunt cookie options in obnoxious pop ups interrupting us from whatever we were doing. It’s a fine paid in time and focus by billions of people and its cost is probably staggering.

Some will say "I told you so, they still do not get fined harshly enough to make any difference" while others will say "this is just unfair money grabbing governments" and while everyone argues back and forth with the same arguments as the last ten discussions I sit here on the sidelines, a normal internet user, who by the simple mentioning of GDPR have gotten big companies, like Epic, and powerful people, like a CEO of a pretty big company, to actually do something where they before would totally have ignored me. GDPR is not perfect at all but it does do a heck of a difference already. Edit: Downvotes, really? :/

jchw 5y ago
It still basically does not differentiate between Epic Games and me. And I can’t handle the fines. The chilling effect this will have on people is being downplayed pretty harshly by people who are basically suggesting you should just pray that you don’t get put into massive debt because you made a mistake on a side project. For that reason, GDPR will always draw some ire from me.
- sealeck 5y ago
  Don't let people enter their data onto your side projects unless you're willing to treat it responsibly?
  - jchw 5y ago
    Intent doesn’t matter; the fear is the same: life-destroying fines. If that’s the choice, I’d just opt out of taking EU customers.
    - Hamuko 5y ago
      How many examples of life-destroying fines do you have?
      - jchw 5y ago
        So basically, you’re in the “No, it’s fine — this will only ever get used against bad guys!” camp. We had 9/11 here in America and the BS that followed and I don’t humor this line of thinking. (Nor humour.)
        Hamuko 5y ago
        No, I'm in the "prove that the thing you are claiming to happen actually happens" camp.
        jchw 5y ago
        I’m not claiming something happened — do you understand how chilling effects work? The threat of potentially massive fines with very little legal bounds for not following regulations that individuals basically can’t follow means that people who want to follow the rules but aren’t big enough don’t play anymore.
        Hamuko 5y ago
        So no one's life has ever been ruined by the GDPR? But you're still sure that this will happen? What is this based on?
        jchw 5y ago
        I can get fined between 0 and €20 million at any moment because I am an individual and have no means to fully understand GDPR nor hire a DPO for my stupid personal websites. I make no money in ads or otherwise, but I am still treated like Epic Games if I collect sign up emails or logs. I only still run this stuff now because I’ve been running it for over a decade. I can tell you right now I am hesitant to run websites anymore. If you don’t understand how “ambiguous threat of a fine” isn’t calmed by “it hasn’t happened yet,” I can’t help you. What if my site was politically controversial? Should I trust all EU governments to act responsibly and not take advantage of their power ever?
    - tgsovlerkhgsel 5y ago
      Can you show me one example where there was a "life-destroying" fine? Not "a big company was fined an amount of money that would be life destroying if I had to pay it for a personal project", because revenue/economic means are a key factor in GDPR fine calculation.
    - anoncake 5y ago
      Maybe it doesn't in America. Here it does.
- Hamuko 5y ago
  My name, my address, my phone number and my credit card details are the same regardless whether you or Epic Games is storing them in a database.
  - jchw 5y ago
    A data breach alone is not a GDPR violation as far as I know. Your data is just as at risk of being exposed no matter what. As far as I can tell the intent of GDPR is to prevent companies from selling or using your data in ways that you did not consent to. However, the bookkeeping requirements quite literally break the internet that existed where one person could run a website. As it turns out, I do not have a Data Protection Officer for my wiki I started in 2008. Does that mean I am not GDPR compliant?
    - amichal 5y ago
      And you dont need to have one: .... hiring an actual Data Protection Officer is only required by the GDPR if you meet one of three criteria: * Public authority — The processing of personal data is done by a public body or public authorities, with exemptions granted to courts and other independent judicial authorities. * Large scale, regular monitoring — The processing of personal data is the core activity of an organization who regularly and systematically observes its “data subjects” (which, under the GDPR, means citizens or residents of the EU) on a large scale. * Large-scale special data categories — The processing of specific “special” data categories (as defined by the GDPR) is part of an organization’s core activity and is done on a large scale. https://gdpr.eu/data-protection-officer/ https://gdpr.eu/data-protection-officer/
      - jchw 5y ago
        This is good to know. But while I will admit my mistake, the problem points to a bigger issue, which is, as a layperson and not an expert on European law, I simply do not have the expertise necessary to understand the law and its implications. This is of course true of any website under any jurisdiction, but most laws don’t come with such absurdly vicious teeth, and therefore the risk profile is a lot different. So perhaps my example was misinformed. But that’s kind of the problem: you need to have a lawyer to really be sure of these things. I don’t have a lawyer.
- hkh28 5y ago
  GDPR fines are set among other things according to the resources of the entity that broke the rules. As a private person making a side project, you won't be liable for millions. The most recent examples of individuals being fined have been fines around €200 [0] [0] https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_a_natural_person&mtc=today https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_...
  - jchw 5y ago
    The maximums however, are absolutely insane. Am I supposed to just hope that in the range of 0 to €20 million, it’s something I can afford?
    - tephra 5y ago
      Getting a maximum fine not only means that your handling of personal data was especially egregious but that you probably didn't cooperate in any ways with the relevant DPA and refused to rectify the problem. I.e the maximum fine is highly unlikely for anyone to get, and if you get it you have done some very bad things.
      - jchw 5y ago
        Yes, and what the GDPR crowd is telling me is that I should just trust the EU to always act fairly and never engage in any kind of politically motivated subterfuge. And not only that, my concerns and dissent regarding GDPR piss people off so much, that at this point, every comment I post just gets downvoted immediately. Now I realize it’s against HN guidelines to discuss this, but when I post a comment and the delay it takes for me to return from the post page is enough for my comment to already have a downvote, I feel discouraged. It’s very clear the person who did that had no good faith intent on a discussion nor intent to even minimally read my comment. And I’m supposed to try to argue my points in good faith despite this. The pro-GDPR crowd may be winning the mindshare but they are inheriting the cancer of something not allowed to be criticized. And if we ever do see an egregious fee driven by political motivations, am I supposed to feel smug for having predicted the possibility or sad that my mere expression that the default maximum fines are so ridiculous that they basically terrorize anyone who is not a multinational corporation turned out to be well-founded? All I ever asked for was for people to recognize the chilling effects that this regulation can have. The internet used to have so many small websites, forums and wikis, and many of these fall under the umbrella of GDPR. And this is basically the treatment I get for trying to represent this dying breed of website: as some corporate shill worth being buried and not considered. It’s not like I care that much about being with the mob, but it pains me that as the open internet gradually dies, people flat out just don’t care. GDPR as it is today is just represents a huge amount of risk for anyone that is not a multinational corporation, and it only gets scarier the further down you are. I’m sorry but just telling people to not worry about how the law is written will not work. Some people will ignore it, some people will try to follow it, and some people will just stop trying altogether deciding the risk simply isn’t worth it. And that latter part is most likely to occur for websites that are more objectionable, since they will likely face harsher treatment just due to cognitive biases alone, since we’re talking about considerations that humans make rather than the word of law.
- t0mas88 5y ago
  The fines are based on your revenue and the impact. So they do differentiate between Epic Games and you. And for me as a user, it sucks if your side project leaks my credit card and SSN, because I'll be dealing with the identity theft and fraud. If you're not competent enough to keep them safe, then use a vendor that is or don't process then at all.
  - jchw 5y ago
    If it were only SSN or credit card data, this would be understandable. But I assume you’re aware GDPR is far broader than this. And as well, GDPR, again, doesn’t guarantee the safety of your data. It just adds fines to some circumstances where your data is misused. But an honest breach doesn’t lead to fines as far as I can tell, so you just have to live with that possibility either way. As best as I can tell, there is no legally binding texts anywhere that limits the fines. The maximums start at €20 million and go higher if you’re huge. In the mindset of “hope is not a strategy,” this maximum fine being the only legally binding limit is enough to make you go home. Maybe small companies can hope for preferential treatment, but as an individual even small fees could do serious harm.
    - jokethrowaway 5y ago
      Work behind a limited company and let it fail. Escape to Mexico in the worst scenario. South America is anyway becoming more and more appealing the more the West progress. That said, not that it changes much but I stopped taking EU customers (I take businesses and not customers) because of vatmoss and gdpr.
      - Aerroon 5y ago
        Vatmoss was so blatantly dumb in its implementation that it makes me wonder whether the MEPs even spent 5 minutes thinking about the implications of it. How can you look at all the VAT systems and not realize that almost all of them have a minimum threshold?! It is a bit ironic that it's probably a good idea for an EU service to not serve EU customers.
  - deleted 5y ago
Hamuko 5y ago
I actually made a GDPR request to my insurance company. Turns out that not only did they have documents about me before I had ever signed a contract with them, they had documents about me before I was even born.
- donatj 5y ago
  > They had documents about me before I was even born Can you elaborate?
  - Hamuko 5y ago
    Turns out that my parents took on some kind of a life insurance policy in an insurance company that no longer exists in the strict sense but the documents have carried on through fusions and when a couple of decades later I got car insurance, a bunch of old medical records and contracts were linked with my account.
- 77pt77 5y ago
  > they had documents about me before I was even born. This needs some explanation. Also, what's stopping them from just lying?
  - Hamuko 5y ago
    >Also, what's stopping them from just lying? Well, hopefully the prospect of fines if they're caught. I'm hoping that the local data authorities won't be lenient if a company is caught outright lying.

zibzab 5y ago

Well, who do you folks think should be fined next? Also, can't we just agree that "Legitimate interest" is noncompliance and fine BBC too while at it?

t0mas88 5y ago
Facebook, they're refusing the right to access your data: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/ And Google for the whole Doubleclick Ad Exchange, they're sharing lots of user details with hundreds of bidders on every pageview that has ads. As well as storing all of that information in Google Cloud as part of their Ads Data Hub product. All without permission.
tgsovlerkhgsel 5y ago
1. Every single web site that uses dark patterns that make not saying yes impractical. Start with the ones that required more than 3 clicks, then clarify that "the request must be clear, concise and not unnecessarily disruptive" means "equally sized, equally highlighted buttons for 'accept all' and 'reject all'". 2. Every single company that knowingly processed data based on such invalid consent. 3. Every single website and company that processed data for advertising based on "legitimate interest"
- sofixa 5y ago
  > 1. Every single web site that uses dark patterns that make not saying yes impractical. Start with the ones that required more than 3 clicks, then clarify that "the request must be clear, concise and not unnecessarily disruptive" means "equally sized, equally highlighted buttons for 'accept all' and 'reject all'". The French ICO, CNIL, just announced that refusing should be as easy as accepting, so they agree
alkonaut 5y ago
The largest site (by revenue) that currently uses a a two button consent dialog with “accept and continue” vs “manage options”. That’s not making opt-out the default choice. If multimillion fines were given to just a few hundred of these sites things would change pretty quickly.

tomcooks 5y ago

Now if only they forced websites to have a single, standardized, accessible, unobtrusive popup~

paxys 5y ago
I'm surprised there is no standard for this yet. Just build it into the browser like all other privacy-related requests (location, webcam etc.) are handled. If sites don't implement it, don't accept their cookies. That way I can also manage a blanket yes/no list without getting an obtrusive popup every time.
- Hamuko 5y ago
  Expecting another smash success like the Do Not Track header.
  - atoav 5y ago
    If you could sue people for real money when they violate said header it might be taken more seriously pretty quickly.
    - Hamuko 5y ago
      I don't believe that you can sue under the GDPR. I've always understood it to be something that you can lodge a complaint against someone with your local authorities. No idea about the CCPA but I wouldn't be surprised if you could considering how lawsuit-happy Americans are.
      - atoav 5y ago
        > I don't believe that you can sue under the GDPR. I don't believe that either, I just think that flags like these can only be taken seriously if all actors have maximum incentive to take these seriously.
  - cm2187 5y ago
    Do not track is a gentleman's agreement in a world of thugs. But you could block cookies at the browser level if the user clicks No.

temporalparts 5y ago

I'd be curious of a detailed analysis of the cost of GDPR to EU consumers. There are websites that shut down or no longer servicing European customers because of the concerns around GDPR.

moooo99 5y ago
I know that's only anecdotal and no evidence at all, but the only time I encountered a website that is not serving European users anymore was a link here on HN. I think most users didn't even notice and for the people who do and are really bothered, there are workarounds such as VPNs
- Hamuko 5y ago
  I've only anecdotally ran across half a dozen local US news sites that claim how their EU visitors are very important (clearly they're not) and also a Japanese lyrics site.
  - anoncake 5y ago
    A local US news site that doesn't care about its few EU visitors obviously doesn't fall under GDPR. I wonder if one that targets them by putting up a non-compliant popup does?

ydnaclementine 5y ago

I use this addon to hide the opt-ins: https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/ >In most cases, it just blocks or hides cookie related pop-ups. When it's needed for the website to work properly, it will automatically accept the cookie policy for you (sometimes it will accept all and sometimes only necessary cookie categories, depending on what's easier to do). It doesn't delete cookies.

brocket 5y ago
Nice that you can add the list (https://www.i-dont-care-about-cookies.eu/abp/ https://www.i-dont-care-about-cookies.eu/abp/) to uBlock Origin instead of installing another addon.

vmception 5y ago

1) Subscribe via email! 2) Accept our cookies and let us track you! (with a delay for choosing anything that's not accept all) 3) Surprise! There might be a paywall whether subscribed via email or not! Schrodinger's paywall 4) Oh hey! I saw you paused scrolling or moved your mouse in the general direction of the back button, check out this other thing! 5) Okay lol, here's the article. Maybe. Depending on the deal we cut with the creators of your specific browser and geographic location and how many other articles you've read this month. and thats with adblock Europe and California, we are counting on you to fix the internet!

midasuni 5y ago

1) don’t track visitors Then there you go, no popups, no consent to ask for, job done.

Aerroon 5y ago
Maybe the EU could start with making their own websites not have popups? https://europa.eu/ https://europa.eu/ If it's so easy to do then surely an organization with a bottomless pit of money and no accountability on it should be the first to manage it?
- midasuni 5y ago
  It is easy to do - this site being the prime example.

makomk 5y ago

It remains somewhat, ah, interesting that the biggest GDPR fine is for not being able to withstand a targeted attack by a motivated attacker. The British Airways compromise seems to have involved someone getting access to their systems (which basically just requires one employee screwing up, once) and hiding malicious code in their website so custom-tailored to them that an uninvolved outside expert in the malware family involved had trouble ientifying where it was after he knew it was there due to the news coverage. That's the kind of "gross negligence" that leads to a record fine and I don't think IT security as it currently stands is even remotely capable of preventing it.

number6 5y ago
The watchdog argued that there where security measures that could had been in place that would have prevented the breach. I guess BA saw this the same way or they had gone to court and appealed the fine

TazeTSchnitzel 5y ago

If you're surprised there haven't been many big fines against large tech companies yet, that may be because there's a large backlog of cases that are bottlenecked by the budget of Ireland's DPA: https://www.euractiv.com/section/data-protection/news/european-parliament-calls-for-infringement-procedure-against-ireland/ https://www.euractiv.com/section/data-protection/news/europe...

nickpp 5y ago

The biggest fine was on us users, forced to hunt cookie options in obnoxious pop ups interrupting us from whatever we were doing. It’s a fine paid in time and focus by billions of people and its cost is probably staggering.