13 ms·

Amazon Gets Record $888M EU Fine over Data Violations

352 points by Reventlov 5y ago

pjc50 5y ago
Well, that's not chicken feed, even for Amazon. Still a bit light on detail? The original complaint is linked from https://www.laquadrature.net/en/personnal-data/ https://www.laquadrature.net/en/personnal-data/ - it's in French https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf https://gafam.laquadrature.net/wp-content/uploads/sites/9/20... The lack of publicity or even publicly available copy of the ruling is odd. I guess the choice of Amazon to reside in one of the secretive tax haven jurisdictions of Europe has the side effect that it also has a really secretive information commissioner.
- za3baec 5y ago
  TL;DR: LQDN claims Amazon used their users' data for targeted advertising without their consent The interesting bit is section 2.3 page 17 and is very short.
  - whoknowswhat11 5y ago
    Which is an absolute joke because everyone using amazon to actually purchase anything signs their terms and data collection is clearly part of those terms (as one would expect for an online retailer). In addition, they run Amazon Marketplace and a well known recommendation engine and clearly allow sellers to advertise. This always seems to be more about posturing than anything else. Or rely on weird logic loops.
    - bosie 5y ago
      Is it reasonable to assume I can agree (as a non-lawyer) to terms and conditions that are 50 pages (wild guess) long? Especially since they are written in legalese?
      - whoknowswhat11 5y ago
        They are very long because of things like the GPDR. That said, amazons are pretty darn clear. "We receive and store any information you provide in relation to Amazon Services. " "We use your personal information to display interest-based ads for features, products, and services that might be of interest to you"
        bosie 5y ago
        TC have always been long and legalese and it wasn't because of GPDR. I can't find your examples in the T&C, it seems to be about 'privacy notice'. Am i supposed to read that too and keep up to date? I signed up in 2003, do you mind showing me what i agreed to? And out of genuine curiosity, 'any information' seems to be a superset of 'personal information', isn't it? what is "any information"? and are you saying amazon is only using personal information (which is what, exactly?) to display ads?
        whoknowswhat11 5y ago
        Amazon is much better than most. You can read historic t&c's. That said, you have a big misunderstanding. If you have continued to use the site, all T&C's updated based on continued use.
    - freeone3000 5y ago
      The ruling states their EULA doesn't actually say that they are using the data they're collecting in order to advertise. Collecting data doesn't mean you're allowed to use that data for advertising without explicit, revocable consent.
    - isbvhodnvemrwvn 5y ago
      Consent is only valid if it's informed and specific. More than that the data minimization applies - you can't require using personal data if it's not necessary. https://gdpr.eu/article-4-definitions/ https://gdpr.eu/article-4-definitions/ https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/data-minimisation/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
      - whoknowswhat11 5y ago
        They run a marketplace and make $20 billion in ad revenue (or more) per year. Obviously - targeting ads helps them make this money - how is this not a legit business purpose?
        isbvhodnvemrwvn 5y ago
        Legitimate business purpose is another basis for processing personal data, but it can't override interests of the data subject: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ It's like asking why a doctor can't sedate you and transplant your kidney, you have another one so you don't need it and they'll make a ton of money.
        HelloMcFly 5y ago
        If the statement "collecting this data without consent so we can more effectively sell ads helps us make money, so it's a legitimate business interest" was considered a valid argument, would that make much of GDPR toothless?
        krageon 5y ago
        If "Wow this makes me a lot of money" made your business legitimate, the heroin industry would be enormous.
    - einpoklum 5y ago
      In many jurisdictions, even if consent is informed and specific, a contract which is not the result of actual negotiations but is standard - e.g. between a client and a large company - can often have clauses nullified by the courts, either for being unfair/detrimental to the client, or for their presence being detrimental to public interest.
- fmajid 5y ago
  At least the Luxembourg DPA is doing its job, unlike the Irish DPA that seems to think it is a division of the Irish Industrial Development Agency charged with shielding multinationals from accountability.
  - ElKrist 5y ago
    That's also the reaction [1] of "La Quadruature du Net", the association that brought the complaint "(...) this historical fine shows even more blatantly the complete resignation of the Irish authority for data protection, which in 3 years hasn't been able to process any of the 4 other claims we made against Facebook, Apple, Microsoft and Google." it also goes after the French authority for data protection (CNIL) to say basically: you used to be one of the best in Europe, now you're a mere shadow of your former self [1] https://www.laquadrature.net/2021/07/30/amende-de-746-millions-deuros-contre-amazon-suite-a-nos-plaintes-collectives/ https://www.laquadrature.net/2021/07/30/amende-de-746-millio...
  - deleted 5y ago
    [deleted]
- thepangolino 5y ago
  In most European countries court rulings are quite hard to get a hold off.
  - doikor 5y ago
    Not they are not. They are public records in most. Luxembourg is one of the few exceptions. They might not be available online but can be ordered from the court clerk (which is the case here in Finland for example) but the 2 largest EU countries (Germany and France) has them online for free. Though as most European countries are not using a case law system the actual value of getting these is not that important for lawyers etc.
    - corty 5y ago
      In Germany you do not get all the cases, just the ones the courts deem important enough. E.g. if the ruling is different from earlier ones in some aspect, if it is a higher court or if the case was of particular public interest.
      - xxpor 5y ago
        Is this a them being lazy thing or a German privacy thing?
        isbvhodnvemrwvn 5y ago
        It's not just a German privacy thing. There is little reason for the vast majority of lawsuits to be public.
        xxpor 5y ago
        Oh that's just extremely not true. Open, non-secret courts are incredibly important for avoiding impropriety. Especially in a common law system, there's just no way that would work. The only exception are family law cases.
    - 5y ago
- ElKrist 5y ago
  Summarized conclusions of the original complaint [1]: 2.2.3.1 claims that Amazon does not disclose anything proving they intend to get consent from their users to process their behavoural data for ad targeting purposes 2.2.3.2 is a rebuttal against one potential line of defense from Amazon. This defense is "We have to collect/use data because this is precised in our contract with our users and so we need to respect this contract". The rebuttal is that the main goal of the contract is a marketplace to buy/sell goods. Ad targeting is not essential to fulfill this goal and it is not something that can be considered as reasonable user expectations 2.2.3.3 It says that Amazon does not explicitly states that it's in its legitimate interest to process data and do ad targeting. It then refers to section 2.1.3 which shows that Amazon could not claim legitimate interest anyway. Section 2.1.3 is too complicated for me as it quotes a lot of precedent rulings in European law to prove it can't be legitimate interest Please keep in mind that it is the complaint, I don't have details on the ruling of today [1] https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf https://gafam.laquadrature.net/wp-content/uploads/sites/9/20...
  - deleted 5y ago
    [deleted]
- Anthony-G 5y ago
  Thanks for providing relevent details. I first came across this story on local media (syndicated from Reuters) and they were similarly light on detail. I then checked the News page for the Luxembourg National Data Protection Commission¹ but there was no mention of this case. 1. https://cnpd.public.lu/en/actualites.html https://cnpd.public.lu/en/actualites.html
- throwawinsider 5y ago
  The EU is doing politics, trying to capture population resentment at big tech, with a disproportionate fine for breaking rule 29.6.4.23.iv, while european companies have gotten away for decades with national monopolies. EU has many problems of acceptance among the population, so they will play dirty as a marketing campaign (see case against AstraZeneca and anything british)
saddlerustle 5y ago
It's sad this article makes absolutely no attempt to describe what, exactly, Amazon did wrong.
- fmajid 5y ago
  Essentially using your Amazon purchase and browsing history to target you on its ad network.
  - londons_explore 5y ago
    I am reasonably certain that they earned more than $1B by using this targeting information... Their ad network is quite small as just $28 billion annually, but it seems unlikely that purchase history wouldnt uplift value more than 4%.
    - Bjartr 5y ago
      Isn't that the point though? That violating the restrictions has negative return taking the fine into account?
      - doytch 5y ago
        I believe they're saying that it _doesn't_ have negative returns. The fine is under 1 billion dollars, and the poster you replied to is saying they're "reasonably certain that [Amazon] earned more than $1B by using this targeting information." So the poster is saying that they believe it was worth it for Amazon to break the law and pay an $888 million fine.
        benjaminjosephw 5y ago
        But, of course, the fine isn't a price point for unlawful behaviour but a penalty levied in judgement of the fact that the company violated the social contract. Seeing fines simply as a business cost would be a serious distortion of the way society should function. Could people in boardrooms actually entertain that kind of reasoning in good conscience? I really hope not.
markus_zhang 5y ago
I wonder whether these mega fines ever get paid in full?
- pdimitar 5y ago
  Was always wondering the same. How much weight does "you have been fined $10M" have? Do they pay them in like 100 installments over the course of 5-10 years?
  - isbvhodnvemrwvn 5y ago
    I don't know about other countries, but in Poland the fine has interest - no less than 8%, it's tied to the economic indicators. It's at the minimum of 8% right now due to covid.
wongarsu 5y ago
> the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.” >“There has been no data breach, and no customer data has been exposed to any third party,” Amazon said in a statement, adding that it plans to appeal. “These facts are undisputed. We strongly disagree with the CNPD’s ruling.” That sounds like Amazon saying "as long as we don't expose data we can do whatever we want with it", which isn't how the GDPR works at all.
- Jyaif 5y ago
  When a company uses unrelated facts to try to steer the opinion, it means they have nothing else to defend themselves with. It still makes financial sense for them to fight this ruling even if they have 0 basis for it: simply delaying the paiement of a 800M euro fine cover the lawyers' fees. There should be interests on fines to account for this.
- whoknowswhat11 5y ago
  Dude, there has been no data breach. When you sign up with amazon you agree to their terms. These are pretty darn clear. The decision rests on a whole complicated series of make believe facts. That users were not told their data would be collected (false) or that they weren't told or aware that amazon used ads or targeting (despite amazon recommends stuff on literally every page or similar customers bought xxx). The idea that this is a data leak is crazy - amazon is doing stuff in-house there is no sale to third parties here.
  - shawabawa3 5y ago
    Nobody is saying it's a data leak The fine is for not getting explicit consent to use data in targeted ads. Maybe they ruled that something buried in a huge T&C document doesn't count as consent
    - whoknowswhat11 5y ago
Dylan16807 5y ago
> a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR Well that's sure vague, and the article didn't seem to have anything more specific. > Some lawmakers and regulators have raised concerns that the company has used what it knows to give itself an unfair advantage in the marketplace. That kind of thing has been a big concern but it doesn't require personal data, just a bunch of sales statistics.
- jstummbillig 5y ago
  > Well that's sure vague I am currently implementing GDPR for a health related startup. This half sentence sums up the entire regulation pretty well. It's infuriatingly unspecific about what you can do, and full of vague hinting on things that you maybe really should not do. "Can I do this?" "Yeaaaah, not exactly saying that you can't but maybe it would REALLY be better if you don't, maybe" Absolutely disgusting. Lawyers must be thrilled to have it. Edit: My gripe is not at all with privacy protection laws but with laws that are unclear. Apparently I have been unclear.
  - sterwill 5y ago
    Having worked in a US health tech start-up (and done some compliance work there), and now working with GDPR as a US company, I'm similarly frustrated with how imprecisely the regulations are worded. US health information privacy laws are much easier to interpret and follow. Large, important parts of GDPR compliance hinge on wording like "the processing is not occasional." "Occasional" is not defined in the regulations, and different countries' advisory bodies have completely opposite interpretations about what it means.
    - wil421 5y ago
      Feel your pain. At my last job I worked with mostly EMEA and mainly EU countries. Worked directly with our lawyers in the EU to makes sense of it all. This was right when the GDPR was looming and it was stressful to figure out how to comply.
  - 5y ago
neals 5y ago
That's one way of paying taxes ...
- AmericanChopper 5y ago
  In reality, it’s one way of implementing a tariff.
  - ithinkso 5y ago
    As long as fines are priced into the cost of doing shady business they'll be paid. Hopefully they will rise enough so that it's no longer profitable to risk them - we'll see then if the 'tariffs' as you call them will continue or will they stop
    - AmericanChopper 5y ago
      They will never stop, because the regulations are written so broadly that essentially any business could be found in breach of them. The EU’s service sector is massively uncompetitive, and most of its regulation of this sector has been designed as either a tariff or just a general barrier to trade. In every GDPR related thread people complain that the law is not achieving its objectives (which you’re almost doing here also, with your “maybe it will eventually work” comment), but the law is doing exactly what it’s designed to do. It’s implementing trade barriers (a generally unpopular type of policy), and generating popular support for them (by dressing them up as privacy regulations).
      - ithinkso 5y ago
        > In every GDPR related thread people complain that the law is not achieving its objectives (which you’re almost doing here also, with your “maybe it will eventually work” comment), but the law is doing exactly what it’s designed to do. I think you might be misinterpreting those comments. It's not that hard to follow GDPR, what's hard is to work around it. If you want to do exactly what you did before but you want to weasel your way around GDPR it's not impossible, unfortunately, but harder. And people are complaining about it not achieving its objectives precisely because you can weasel your way around and that's why we have those stupid 'Accept all cookies' huge buttons and 'Change settings' small ones, that later change to another big 'Accept all' and even smaller 'reject'. Stop selling user's data without their consent and GDPR is a breeze to be complaint with. Try still selling it, eliciting the consent via dark patters, and complain how hard and complicated it is.
high_byte 5y ago
as stock owner I can still safely lol at this.
- wutwutwutwut 5y ago
  At what? Amazon having to pay a large fine for illegal activities?
  - high_byte 5y ago
    large for once but insignificant at the same time.
    - qwertox 5y ago
      >large for once but insignificant at the same time. This is beside the point.
    - wutwutwutwut 5y ago
      Laughing because the company you invested in has committed illegal activities and has to pay $888M seems strange to me. Not a high standard to set for your investments.
      - high_byte 5y ago
        amazon is a good investment and remains so. it does not derogate from the two facts, 1. karma and 2. the world isn't fair, as in this is a few days profits. comparable to you getting few thousand dollars fine for breaking the law.
        dcow 5y ago
        That doesn’t matter. As a shareholder there is absolutely no way this helps your stock price. While you may not be crying it doesn’t make any sense to “lol” at it either.
    - bildung 5y ago
aminozuur 5y ago
Considering Amazon's revenue of $443 billion (last twelve months), this fine is less than one day's worth of revenue.
- ndr 5y ago
  The fines are obviously not intended to bankrupt them. Amazon had $7.8 billions in profit this quarter, 10% of that should hurt badly enough to course correct, shouldn't it?
  - saddlerustle 5y ago
    It's worse than that. Almost all of Amazon's profit comes from AWS and its US business, but this fine is entirely a cost due to its retail business in the EU. The operating income of Amazon's international retail business in 2020 was just $700m, it makes their entire European business last year overall unprofitable.
    - adwn 5y ago
      > It's worse than that [...] it makes their entire European business last year overall unprofitable How's that a bad thing under the assumption that they behaved in an illegal way? Fines are supposed to hurt, and this fine won't bankrupt Amazon.
      - AnssiH 5y ago
        I believe they meant the fines were worse for Amazon than their parent made it sound, not that the fines itself were a bad thing.
    - denton-scratch 5y ago
      Ever heard of transfer pricing? [Edit] I think I was rightly downvoted for being snarky. I'll try to remember not to snark.
- whitepaint 5y ago
  Revenue != net profit; how on earth so many people are continuously mistaking it?
quonn 5y ago
It would be better to require a license for (any) data processing at scale which is easily granted (covering all possible use cases) but can be perpetually revoked. That would be taken much more serious than these fines.
- paublyrne 5y ago
  If it's already not allowed to use data in this way - thus the fine - what purpose would allowing and revoking the right to do so serve. It's already prohibited.
  - colechristensen 5y ago
    Not “in this way” but at all. in other words if you lose the right to process or possess the data at all. “corporate death penalty” kinds of regulation needs to happen more often
    - laurent92 5y ago
      What if law defined the processes more closely? “Billing data must be kept for 2 years numerically and 10 years on an offline device or paper. Marketing data can be kept for 6 months until renewal of consent by the user. The rest is permitted upon license.”
      - deleted 5y ago
        [deleted]
- dahfizz 5y ago
  And what is the punishment for operating without a license? Seems like a roundabout way to implement a fine.
  - chopin 5y ago
    The compelling thing with GP's proposal would be that it is easier to enforce. If the license is revoked there is no gray area for interpretation left.
whitepaint 5y ago
How are the size of these fines determined?
- mhitza 5y ago
  > How much can an organization be fined for a GDPR violation? The GDPR allows the EU's Data Protection Authorities to issue fines of up to €20 million ($24.1 million) or 4% of annual global turnover (whichever is higher).
  - eitland 5y ago
    Importantly however they'll often first contact the company to ask them to fix the problem first instead of going straight to fines.
  - theshrike79 5y ago
    And the best part is that the fine is calculated according to the parent company, so you can't create a subsidiary to handle all the iffy GDPR stuff and have it work with 0 turnover. So if any of Google's properties F's up, the fine is calculated from Alphabet's annual turnover.
- vdfs 5y ago
  Usually in way that doesn't hurt the company or make it change it's behavior
londons_explore 5y ago
Unpopular opinion:. It should be illegal to not use purchase history to make better ad placements. Forcing companies to not use all the information at their disposal to make business decisions leads to worse decisions. It would be like a superstore not being allowed to see the demographics of the area the store is located when deciding if they should stock more types of toys or false teeth. Clearly the families will likely be interested in toys, while the retirees want false teeth. Forcing families to hunt through aisles of false teeth is wasting their time, reducing the businesses revenue, and is bad all round. "We're just taking money from the megacorps" isn't true - you're also forcing every user of a website to get a worse experience, sometimes severely to their detriment.
- simion314 5y ago
  You are clearly uninformed, This companies need to ask permission. So a few Google, Ms, Amazon devs could put their brains to work, create a standard for people like you to get a beaut full experience, you could give them permissions to watch your browsing, access your health data, listen to your microphone, scan your files, data mine your images and social posts. You could even help this nice companies by filling a form where you tell them what kind of ads you want to see, what things you like, what you hate. The only problem is that either there are few people like you that want to give permissions, the giants don't want to share the profits and for sure don't care about your experience, or this giant devs are incompetent or are focusing on easy projects like throwing some npm modules to some source code/social posts/images and prentend they made an AI developer/writer/artist etc. TLDR GDPR asks for permissions, you can just click Accept ALL , after you clicked Accept All and the ads are still garbage then is not EU fault that Amazon devs that work on ads are incompetent or are optimizing for the thing you don't care.
- inetknght 5y ago
  > Unpopular opinion Very. > It should be illegal to not use purchase history to make better ad placements. I'm not sure about legality but I think your argument should be made to stock regulators. I don't agree with it but I can certainly see your argument, on the face of it, has merit. I also think it's distasteful and wrong and I don't care to elaborate on that. > Forcing companies to not use all the information at their disposal to make business decisions There are plenty of laws which force companies to not use all of the information at their disposal. Privacy laws, for example, are set to help people (not necessarily customers) have a better life. Corporations don't have a right to profit from people who don't wish to be profited from. > you're also forcing every user of a website to get a worse experience, sometimes severely to their detriment. I fully disagree. I don't believe that using customers' purchase history guarantees in any way that the customer's experience will be better. The only thing it's likely to guarantee is a more profitable company. The two metrics may be correlated but they're not causal.
BurningFrog 5y ago
To me, these fines feel really arbitrary, and like the EU taxing US tech giants "through other means". What's the clearest evidence I am wrong?
- igorkraw 5y ago
  Usually the burden of proof is with those making the accusations
- richwater 5y ago
  Why do you think EU tech companies are nonexistent?
  - laurent92 5y ago
    Because they have mild success only. DailyMotion is great as #2, but Youtube is about 1000x bigger. Other startups exist, but are far from Apple-style success. Who would let any company own a campus anyway.
    - bildung 5y ago
      If "tech giant" equals "web advertising platform", then sure. But there are quite a few big physical tech companies within the EU. Bosch and Facebook have about the same revenue, for example. ZF Friedrichshafen, a company noone has heard of, has double the revenue of Youtube.
      - frockington1 5y ago
        I wouldn't call making dishwashers tech. I'm not disparaging, I love how quiet my Bosch is, but I would classify it as an industrial company not a technology company
        borodi 5y ago
        You should probably read more about the other things Bosch does i.e the entire automotive part of it.
neonate 5y ago
https://archive.md/Uc2bg https://archive.md/Uc2bg
mpweiher 5y ago
Begun the GDPR wars have. Popcorn ready. But seriously, the industry has largely been in a Wil-E-Coyote moment ever since GDPR came into force, because most of the "standard practices", and for companies like Facebook and Google their business model, became illegal at that moment. The industry reaction has been to mostly ignore it and carry on as always, running on air and making sure not to look down. Oh, and trying to their best to annoy users by running nasty and also mostly illegal "consent popups", in an attempt to do a repeat of the very successful campaign against the cookie directive. I don't think it will work this time around, because the EU learned from their earlier mistake, and specifically came up with fines that will really, really sting. As far as I know, cases against Facebook are currently making their way through the system (not sure about Google, but they are also guilty as can be), but haven't resulted in a ruling and fine yet. Immovable business model, meet irresistible regulation. Popcorn ready.
- singlow 5y ago
  The EU is not going to get into a war because it doesn't have any countries capable of fighting a war. The GDPR is not powerful because as much as they think they can extract revenue from a multinational company, the pacifist EU countries don't have the power to enforce it at scale. China, Russia and the U.S. aren't going to help them enforce the GDPR. If the companies don't like it they will just ignore it and exclude the EU from the world economy. The EU will moderate its enforcement to a degree that is tolerable by the companies to avoid any major conflicts.
  - denton-scratch 5y ago
    What's this about war? Who mentioned war? The EU is not fining a nation-state with an army; it's fining a corporation with EU subsidiaries and assets. If you want to trade in a place, you either obey the laws of that place, or you shut down operations there, or you get fined. Are you suggesting the USA might use armed force to prevent the EU fining Faceache? I don't think I've heard even nativist nuts suggesting anything remotely like that.
    - 5y ago
cpufry 5y ago
eh, tips scales towards balance and onwards we go.
grumblenum 5y ago
>$888M Google, is that you?
- hu3 5y ago
  Haha. Is that a reference to Google's DNS 8.8.8.8? https://developers.google.com/speed/public-dns https://developers.google.com/speed/public-dns
  - grumblenum 5y ago
    Exactly!
Jyaif 5y ago
Apparently this is due to this french association whose main goal is to sue the big tech companies. They've sued Google, Apple, Facebook, Amazon, and Microsoft: https://gafam.laquadrature.net/ https://gafam.laquadrature.net/
- ElKrist 5y ago
  This is a misrepresentation of the association. They existed way before this campaign and GDPR The first paragraph [1] of their About section mentions they started in 2008 to fight against HADOPI, which is the French authority created to enforce copyrights in reaction to (illegal) streaming/p2p sharing of music/movies etc. Recently, they're fighting against new French laws allowing the government to collect/process more data on all its citizens for supposedly anti-terrorism purposes [1] https://www.laquadrature.net/nous/ https://www.laquadrature.net/nous/
- isbvhodnvemrwvn 5y ago
  You can't sue companies under GDPR.
betaby 5y ago
Are those fines really collected? I know Russia has troubles collecting fines say from Twitter. Google always successfully "negotiate" them way down.
- doikor 5y ago
  With the amount of physical assets and business Amazon has in the EU it will be easy to enforce the collection. The other option is to confiscate the warehouses and data centers and sell those to pay the fine. Also I’m not sure how Luxembourg laws work but here in Finland the government would just declare that company bankrupt and take all of their stuff to pay the fine. (Company not paying their bills in time is grounds for bankruptcy). This is also the easiest way to get a company to pay what they owe you. Just send a notice of wanting to declare the company bankrupt to the courts for not paying usually leads to the bill getting paid in a day or two. This has actually happened to some really large companies (mainly insurance companies that did not want to pay after losing in court when disputing their insurance decisions) Twitter in Russia is very different as they do not have any physical assets there.
  - eitland 5y ago
    > (Company not paying their bills in time is grounds for bankruptcy). Same here in Norway from what I hear: Even if you can prove that you have the money tomorrow if your taxes are due today and you don't pay they make you bankrupt. Simple as that, they rather take the loss and know that no one "forgets".
- whoknowswhat11 5y ago
  These cases are often ridiculous political statements - so they get appealed and the fines knocked way down.
sproketboy 5y ago
Pocket change.
talentedcoin 5y ago
As long as GDPR exists, a European tech company than can challenge FANG dominance will never emerge.
- pyrale 5y ago
  There are many other reasons why large tech companies have a hard time emerging in Europe. One could argue that none of the really big tech companies that emerged in the US is recent either. So it makes sense, if companies can't be helped, for EU to at least try to protect the consumers.
  - adventured 5y ago
    > One could argue that none of the really big tech companies that emerged in the US is recent either. That can't be reasonably argued. The US has dozens of large tech companies that have emerged more recently than the classic big tech giants. The EU, or Europe more broadly, has exceptionally few. More recently, for large tech companies, is the past ~20 years. It typically takes a long time to become worth $20 billion or $50b or $100b. That time frame excludes Microsoft, Apple, Google, Amazon, Netflix, Adobe, Cisco, Intel, Oracle, Nvidia, AMD, Dell/Emc, Vmware, Salesforce, PayPal, Applied Materials, Texas Instruments, Qualcomm, Broadcom, Verisign, Intuit, IBM, HP, Autodesk, eBay, Booking, Expedia, Cadence, Marvell, Micron, Lam, KLA, Western Digital, Seagate, among many others. So what exists from the past 20 years for the US? Facebook, Zoom, Tesla, SpaceX, Workday, Twilio, DataDog, Cloudflare, Splunk, DocuSign, ServiceNow, Snowflake, Square, Coinbase, Stripe, Airbnb, Uber, Lyft, Roku, MongoDB, Pinterest, Twitter, Snapchat, CrowdStrike, Palo Alto Networks, Zscaler, Okta, The Trade Desk, Teladoc, Veeva Systems, Dropbox, DoorDash, Unity Software, Etsy, DraftKings, Palantir, Proofpoint, Zillow, Qualtrics, Roblox, Robinhood, HubSpot, Five9, Zendesk, Coupa Software, Sofi, AppLovin (and I've probably missed a few) Most of these companies have solid growth profiles and will be far larger in ten years than they are today. Beyond that are dozens of single digit billion dollar tech companies born in the past 20 years that will join that list. The EU should also be asking itself why Atlassian and Shopify didn't originate there instead of Australia and Canada. Why didn't UiPath move its HQ to Berlin or Paris instead of NY? Why didn't Elon Musk start SpaceX or Tesla in the EU? Why did the Collisons build Stripe in California? Why is the EU competition for AWS companies like Hetzner, OVH and Scaleway (which are actually DigitalOcean peers)? One may not like Bezos, however he's going to push tens of billions of dollars into attempting to build up Blue Origin, where's the EU comparable by one of their zillionaires? All the biggest US fortunes are first generation and in technology, except for Buffett. The biggest EU fortunes are in fashion, cosmetics, retail. That's representative of the EU being left behind, stagnant. The US badly beat Europe in the IBM-HP-Fairchild era. The US badly beat Europe in the Apple-Microsoft-Intel era. The US badly beat Europe in the early Internet & Web era (Google, Amazon, Netflix, Nvidia, Cisco). The US is badly beating Europe in the cloud era. And that's understating things. It's not a race. The EU isn't even participating, they're stretching on the sidelines, watching the US and China compete to see who can build the largest tech companies (China's tech companies are largely locked inside of China, and that's about to get worse, so the US will win that contest). There's no indication that the Europeans have figured out how to compete, how to scale quickly through their own markets and then rapidly push globally to win markets before the US companies do. So far all they've come up with is top down command schemes whereby countries like France think they can will an AWS competitor into existence magically, or alternatively they scheme to use regulatory capture to entirely avoid having to compete.
afrcnc 5y ago
Non-paywalled report: https://www.politico.eu/article/amazon-fined-e746m-for-violating-privacy-rules/ https://www.politico.eu/article/amazon-fined-e746m-for-viola...
908B64B197 5y ago
It seems to be popular for European bureaucrats to bash on "evil foreign tech giants". I suppose if you can't grow tech at home, the next best thing is to regulate and tax it as much as possible.
- nolok 5y ago
  There is a law. You respect it, otherwise there is a fine. Are you saying european companies that are leaders in their fields should not be fined by the US if they disregard its law when doing business there ? If yes, you should inform the US. If not, then you're being an hypocrite.
- boudin 5y ago
  So, according to you, european countries should not be able to have laws and apply those? Companies like Amazon, Apple, Facebook and Google should not be regulated? They should be able to do whatever they want to do? Still seeing people in support of such imperialism is quite sad to be honest..
stacker8888 5y ago
Just forwarded this news to my executive team who held up my attempts at getting us GDPR and CCPA compliant for 8 months last year. They said the laws were 'toothless'. Happy to be proven correct!
winrid 5y ago
I guess they are Stanley Parable fans. https://youtu.be/oV-nDRkhgvk https://youtu.be/oV-nDRkhgvk
EthOptimist 5y ago
Interesting to compare this to the $3B anti monopoly fine against Alibaba recently
sudcha 5y ago
The EU is constantly putting fines on the tech giants, but I don't hear so much from other countries. If all private data is equal as a human right, then the cases should be filed by every country, but I doubt that's happening. Perhaps this is because EU is in power and representative of the largest collective paying user group? Also what happens to the fine? Does EU keep it, or actually give it out to the users who were affected?
misfit-seven 5y ago
That's chump change. In fact it's less than the taxes they owe.

352 points by Reventlov 5y ago

Well, that's not chicken feed, even for Amazon. Still a bit light on detail? The original complaint is linked from https://www.laquadrature.net/en/personnal-data/ https://www.laquadrature.net/en/personnal-data/ - it's in French https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf https://gafam.laquadrature.net/wp-content/uploads/sites/9/20... The lack of publicity or even publicly available copy of the ruling is odd. I guess the choice of Amazon to reside in one of the secretive tax haven jurisdictions of Europe has the side effect that it also has a really secretive information commissioner.

za3baec 5y ago
TL;DR: LQDN claims Amazon used their users' data for targeted advertising without their consent The interesting bit is section 2.3 page 17 and is very short.
- whoknowswhat11 5y ago
  Which is an absolute joke because everyone using amazon to actually purchase anything signs their terms and data collection is clearly part of those terms (as one would expect for an online retailer). In addition, they run Amazon Marketplace and a well known recommendation engine and clearly allow sellers to advertise. This always seems to be more about posturing than anything else. Or rely on weird logic loops.
  - bosie 5y ago
    Is it reasonable to assume I can agree (as a non-lawyer) to terms and conditions that are 50 pages (wild guess) long? Especially since they are written in legalese?
    - whoknowswhat11 5y ago
      They are very long because of things like the GPDR. That said, amazons are pretty darn clear. "We receive and store any information you provide in relation to Amazon Services. " "We use your personal information to display interest-based ads for features, products, and services that might be of interest to you"
      - bosie 5y ago
        TC have always been long and legalese and it wasn't because of GPDR. I can't find your examples in the T&C, it seems to be about 'privacy notice'. Am i supposed to read that too and keep up to date? I signed up in 2003, do you mind showing me what i agreed to? And out of genuine curiosity, 'any information' seems to be a superset of 'personal information', isn't it? what is "any information"? and are you saying amazon is only using personal information (which is what, exactly?) to display ads?
        whoknowswhat11 5y ago
        Amazon is much better than most. You can read historic t&c's. That said, you have a big misunderstanding. If you have continued to use the site, all T&C's updated based on continued use.
  - freeone3000 5y ago
    The ruling states their EULA doesn't actually say that they are using the data they're collecting in order to advertise. Collecting data doesn't mean you're allowed to use that data for advertising without explicit, revocable consent.
  - isbvhodnvemrwvn 5y ago
    Consent is only valid if it's informed and specific. More than that the data minimization applies - you can't require using personal data if it's not necessary. https://gdpr.eu/article-4-definitions/ https://gdpr.eu/article-4-definitions/ https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/data-minimisation/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
    - whoknowswhat11 5y ago
      They run a marketplace and make $20 billion in ad revenue (or more) per year. Obviously - targeting ads helps them make this money - how is this not a legit business purpose?
      - isbvhodnvemrwvn 5y ago
        Legitimate business purpose is another basis for processing personal data, but it can't override interests of the data subject: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ It's like asking why a doctor can't sedate you and transplant your kidney, you have another one so you don't need it and they'll make a ton of money.
      - HelloMcFly 5y ago
        If the statement "collecting this data without consent so we can more effectively sell ads helps us make money, so it's a legitimate business interest" was considered a valid argument, would that make much of GDPR toothless?
      - krageon 5y ago
        If "Wow this makes me a lot of money" made your business legitimate, the heroin industry would be enormous.
  - einpoklum 5y ago
    In many jurisdictions, even if consent is informed and specific, a contract which is not the result of actual negotiations but is standard - e.g. between a client and a large company - can often have clauses nullified by the courts, either for being unfair/detrimental to the client, or for their presence being detrimental to public interest.
fmajid 5y ago
At least the Luxembourg DPA is doing its job, unlike the Irish DPA that seems to think it is a division of the Irish Industrial Development Agency charged with shielding multinationals from accountability.
- ElKrist 5y ago
  That's also the reaction [1] of "La Quadruature du Net", the association that brought the complaint "(...) this historical fine shows even more blatantly the complete resignation of the Irish authority for data protection, which in 3 years hasn't been able to process any of the 4 other claims we made against Facebook, Apple, Microsoft and Google." it also goes after the French authority for data protection (CNIL) to say basically: you used to be one of the best in Europe, now you're a mere shadow of your former self [1] https://www.laquadrature.net/2021/07/30/amende-de-746-millions-deuros-contre-amazon-suite-a-nos-plaintes-collectives/ https://www.laquadrature.net/2021/07/30/amende-de-746-millio...
- deleted 5y ago
  [deleted]
thepangolino 5y ago
In most European countries court rulings are quite hard to get a hold off.
- doikor 5y ago
  Not they are not. They are public records in most. Luxembourg is one of the few exceptions. They might not be available online but can be ordered from the court clerk (which is the case here in Finland for example) but the 2 largest EU countries (Germany and France) has them online for free. Though as most European countries are not using a case law system the actual value of getting these is not that important for lawyers etc.
  - corty 5y ago
    In Germany you do not get all the cases, just the ones the courts deem important enough. E.g. if the ruling is different from earlier ones in some aspect, if it is a higher court or if the case was of particular public interest.
    - xxpor 5y ago
      Is this a them being lazy thing or a German privacy thing?
      - isbvhodnvemrwvn 5y ago
        It's not just a German privacy thing. There is little reason for the vast majority of lawsuits to be public.
        xxpor 5y ago
        Oh that's just extremely not true. Open, non-secret courts are incredibly important for avoiding impropriety. Especially in a common law system, there's just no way that would work. The only exception are family law cases.
  - 5y ago
ElKrist 5y ago
Summarized conclusions of the original complaint [1]: 2.2.3.1 claims that Amazon does not disclose anything proving they intend to get consent from their users to process their behavoural data for ad targeting purposes 2.2.3.2 is a rebuttal against one potential line of defense from Amazon. This defense is "We have to collect/use data because this is precised in our contract with our users and so we need to respect this contract". The rebuttal is that the main goal of the contract is a marketplace to buy/sell goods. Ad targeting is not essential to fulfill this goal and it is not something that can be considered as reasonable user expectations 2.2.3.3 It says that Amazon does not explicitly states that it's in its legitimate interest to process data and do ad targeting. It then refers to section 2.1.3 which shows that Amazon could not claim legitimate interest anyway. Section 2.1.3 is too complicated for me as it quotes a lot of precedent rulings in European law to prove it can't be legitimate interest Please keep in mind that it is the complaint, I don't have details on the ruling of today [1] https://gafam.laquadrature.net/wp-content/uploads/sites/9/2018/05/amazon.pdf https://gafam.laquadrature.net/wp-content/uploads/sites/9/20...
- deleted 5y ago
  [deleted]
Anthony-G 5y ago
Thanks for providing relevent details. I first came across this story on local media (syndicated from Reuters) and they were similarly light on detail. I then checked the News page for the Luxembourg National Data Protection Commission¹ but there was no mention of this case. 1. https://cnpd.public.lu/en/actualites.html https://cnpd.public.lu/en/actualites.html
throwawinsider 5y ago
The EU is doing politics, trying to capture population resentment at big tech, with a disproportionate fine for breaking rule 29.6.4.23.iv, while european companies have gotten away for decades with national monopolies. EU has many problems of acceptance among the population, so they will play dirty as a marketing campaign (see case against AstraZeneca and anything british)

saddlerustle 5y ago

It's sad this article makes absolutely no attempt to describe what, exactly, Amazon did wrong.

fmajid 5y ago
Essentially using your Amazon purchase and browsing history to target you on its ad network.
- londons_explore 5y ago
  I am reasonably certain that they earned more than $1B by using this targeting information... Their ad network is quite small as just $28 billion annually, but it seems unlikely that purchase history wouldnt uplift value more than 4%.
  - Bjartr 5y ago
    Isn't that the point though? That violating the restrictions has negative return taking the fine into account?
    - doytch 5y ago
      I believe they're saying that it _doesn't_ have negative returns. The fine is under 1 billion dollars, and the poster you replied to is saying they're "reasonably certain that [Amazon] earned more than $1B by using this targeting information." So the poster is saying that they believe it was worth it for Amazon to break the law and pay an $888 million fine.
      - benjaminjosephw 5y ago
        But, of course, the fine isn't a price point for unlawful behaviour but a penalty levied in judgement of the fact that the company violated the social contract. Seeing fines simply as a business cost would be a serious distortion of the way society should function. Could people in boardrooms actually entertain that kind of reasoning in good conscience? I really hope not.

markus_zhang 5y ago

I wonder whether these mega fines ever get paid in full?

pdimitar 5y ago
Was always wondering the same. How much weight does "you have been fined $10M" have? Do they pay them in like 100 installments over the course of 5-10 years?
- isbvhodnvemrwvn 5y ago
  I don't know about other countries, but in Poland the fine has interest - no less than 8%, it's tied to the economic indicators. It's at the minimum of 8% right now due to covid.

wongarsu 5y ago

> the Luxembourg data protection authority slapped Amazon with the record fine in a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR. Amazon disclosed the findings in a regulatory filing on Friday, saying the decision is “without merit.” >“There has been no data breach, and no customer data has been exposed to any third party,” Amazon said in a statement, adding that it plans to appeal. “These facts are undisputed. We strongly disagree with the CNPD’s ruling.” That sounds like Amazon saying "as long as we don't expose data we can do whatever we want with it", which isn't how the GDPR works at all.

Jyaif 5y ago
When a company uses unrelated facts to try to steer the opinion, it means they have nothing else to defend themselves with. It still makes financial sense for them to fight this ruling even if they have 0 basis for it: simply delaying the paiement of a 800M euro fine cover the lawyers' fees. There should be interests on fines to account for this.
whoknowswhat11 5y ago
Dude, there has been no data breach. When you sign up with amazon you agree to their terms. These are pretty darn clear. The decision rests on a whole complicated series of make believe facts. That users were not told their data would be collected (false) or that they weren't told or aware that amazon used ads or targeting (despite amazon recommends stuff on literally every page or similar customers bought xxx). The idea that this is a data leak is crazy - amazon is doing stuff in-house there is no sale to third parties here.
- shawabawa3 5y ago
  Nobody is saying it's a data leak The fine is for not getting explicit consent to use data in targeted ads. Maybe they ruled that something buried in a huge T&C document doesn't count as consent
  - whoknowswhat11 5y ago

Dylan16807 5y ago

> a July 16 decision that accused the online retailer of processing personal data in violation of the EU’s General Data Protection Regulation, or GDPR Well that's sure vague, and the article didn't seem to have anything more specific. > Some lawmakers and regulators have raised concerns that the company has used what it knows to give itself an unfair advantage in the marketplace. That kind of thing has been a big concern but it doesn't require personal data, just a bunch of sales statistics.

jstummbillig 5y ago
> Well that's sure vague I am currently implementing GDPR for a health related startup. This half sentence sums up the entire regulation pretty well. It's infuriatingly unspecific about what you can do, and full of vague hinting on things that you maybe really should not do. "Can I do this?" "Yeaaaah, not exactly saying that you can't but maybe it would REALLY be better if you don't, maybe" Absolutely disgusting. Lawyers must be thrilled to have it. Edit: My gripe is not at all with privacy protection laws but with laws that are unclear. Apparently I have been unclear.
- sterwill 5y ago
  Having worked in a US health tech start-up (and done some compliance work there), and now working with GDPR as a US company, I'm similarly frustrated with how imprecisely the regulations are worded. US health information privacy laws are much easier to interpret and follow. Large, important parts of GDPR compliance hinge on wording like "the processing is not occasional." "Occasional" is not defined in the regulations, and different countries' advisory bodies have completely opposite interpretations about what it means.
  - wil421 5y ago
    Feel your pain. At my last job I worked with mostly EMEA and mainly EU countries. Worked directly with our lawyers in the EU to makes sense of it all. This was right when the GDPR was looming and it was stressful to figure out how to comply.
- 5y ago

neals 5y ago

That's one way of paying taxes ...

AmericanChopper 5y ago
In reality, it’s one way of implementing a tariff.
- ithinkso 5y ago
  As long as fines are priced into the cost of doing shady business they'll be paid. Hopefully they will rise enough so that it's no longer profitable to risk them - we'll see then if the 'tariffs' as you call them will continue or will they stop
  - AmericanChopper 5y ago
    They will never stop, because the regulations are written so broadly that essentially any business could be found in breach of them. The EU’s service sector is massively uncompetitive, and most of its regulation of this sector has been designed as either a tariff or just a general barrier to trade. In every GDPR related thread people complain that the law is not achieving its objectives (which you’re almost doing here also, with your “maybe it will eventually work” comment), but the law is doing exactly what it’s designed to do. It’s implementing trade barriers (a generally unpopular type of policy), and generating popular support for them (by dressing them up as privacy regulations).
    - ithinkso 5y ago
      > In every GDPR related thread people complain that the law is not achieving its objectives (which you’re almost doing here also, with your “maybe it will eventually work” comment), but the law is doing exactly what it’s designed to do. I think you might be misinterpreting those comments. It's not that hard to follow GDPR, what's hard is to work around it. If you want to do exactly what you did before but you want to weasel your way around GDPR it's not impossible, unfortunately, but harder. And people are complaining about it not achieving its objectives precisely because you can weasel your way around and that's why we have those stupid 'Accept all cookies' huge buttons and 'Change settings' small ones, that later change to another big 'Accept all' and even smaller 'reject'. Stop selling user's data without their consent and GDPR is a breeze to be complaint with. Try still selling it, eliciting the consent via dark patters, and complain how hard and complicated it is.

high_byte 5y ago

as stock owner I can still safely lol at this.

wutwutwutwut 5y ago
At what? Amazon having to pay a large fine for illegal activities?
- high_byte 5y ago
  large for once but insignificant at the same time.
  - qwertox 5y ago
    >large for once but insignificant at the same time. This is beside the point.
  - wutwutwutwut 5y ago
    Laughing because the company you invested in has committed illegal activities and has to pay $888M seems strange to me. Not a high standard to set for your investments.
    - high_byte 5y ago
      amazon is a good investment and remains so. it does not derogate from the two facts, 1. karma and 2. the world isn't fair, as in this is a few days profits. comparable to you getting few thousand dollars fine for breaking the law.
      - dcow 5y ago
        That doesn’t matter. As a shareholder there is absolutely no way this helps your stock price. While you may not be crying it doesn’t make any sense to “lol” at it either.
  - bildung 5y ago

aminozuur 5y ago

Considering Amazon's revenue of $443 billion (last twelve months), this fine is less than one day's worth of revenue.

ndr 5y ago
The fines are obviously not intended to bankrupt them. Amazon had $7.8 billions in profit this quarter, 10% of that should hurt badly enough to course correct, shouldn't it?
- saddlerustle 5y ago
  It's worse than that. Almost all of Amazon's profit comes from AWS and its US business, but this fine is entirely a cost due to its retail business in the EU. The operating income of Amazon's international retail business in 2020 was just $700m, it makes their entire European business last year overall unprofitable.
  - adwn 5y ago
    > It's worse than that [...] it makes their entire European business last year overall unprofitable How's that a bad thing under the assumption that they behaved in an illegal way? Fines are supposed to hurt, and this fine won't bankrupt Amazon.
    - AnssiH 5y ago
      I believe they meant the fines were worse for Amazon than their parent made it sound, not that the fines itself were a bad thing.
  - denton-scratch 5y ago
    Ever heard of transfer pricing? [Edit] I think I was rightly downvoted for being snarky. I'll try to remember not to snark.
whitepaint 5y ago
Revenue != net profit; how on earth so many people are continuously mistaking it?

quonn 5y ago

It would be better to require a license for (any) data processing at scale which is easily granted (covering all possible use cases) but can be perpetually revoked. That would be taken much more serious than these fines.

paublyrne 5y ago
If it's already not allowed to use data in this way - thus the fine - what purpose would allowing and revoking the right to do so serve. It's already prohibited.
- colechristensen 5y ago
  Not “in this way” but at all. in other words if you lose the right to process or possess the data at all. “corporate death penalty” kinds of regulation needs to happen more often
  - laurent92 5y ago
    What if law defined the processes more closely? “Billing data must be kept for 2 years numerically and 10 years on an offline device or paper. Marketing data can be kept for 6 months until renewal of consent by the user. The rest is permitted upon license.”
    - deleted 5y ago
      [deleted]
dahfizz 5y ago
And what is the punishment for operating without a license? Seems like a roundabout way to implement a fine.
- chopin 5y ago
  The compelling thing with GP's proposal would be that it is easier to enforce. If the license is revoked there is no gray area for interpretation left.

whitepaint 5y ago

How are the size of these fines determined?

mhitza 5y ago
> How much can an organization be fined for a GDPR violation? The GDPR allows the EU's Data Protection Authorities to issue fines of up to €20 million ($24.1 million) or 4% of annual global turnover (whichever is higher).
- eitland 5y ago
  Importantly however they'll often first contact the company to ask them to fix the problem first instead of going straight to fines.
- theshrike79 5y ago
  And the best part is that the fine is calculated according to the parent company, so you can't create a subsidiary to handle all the iffy GDPR stuff and have it work with 0 turnover. So if any of Google's properties F's up, the fine is calculated from Alphabet's annual turnover.
vdfs 5y ago
Usually in way that doesn't hurt the company or make it change it's behavior

londons_explore 5y ago

Unpopular opinion:. It should be illegal to not use purchase history to make better ad placements. Forcing companies to not use all the information at their disposal to make business decisions leads to worse decisions. It would be like a superstore not being allowed to see the demographics of the area the store is located when deciding if they should stock more types of toys or false teeth. Clearly the families will likely be interested in toys, while the retirees want false teeth. Forcing families to hunt through aisles of false teeth is wasting their time, reducing the businesses revenue, and is bad all round. "We're just taking money from the megacorps" isn't true - you're also forcing every user of a website to get a worse experience, sometimes severely to their detriment.

simion314 5y ago
You are clearly uninformed, This companies need to ask permission. So a few Google, Ms, Amazon devs could put their brains to work, create a standard for people like you to get a beaut full experience, you could give them permissions to watch your browsing, access your health data, listen to your microphone, scan your files, data mine your images and social posts. You could even help this nice companies by filling a form where you tell them what kind of ads you want to see, what things you like, what you hate. The only problem is that either there are few people like you that want to give permissions, the giants don't want to share the profits and for sure don't care about your experience, or this giant devs are incompetent or are focusing on easy projects like throwing some npm modules to some source code/social posts/images and prentend they made an AI developer/writer/artist etc. TLDR GDPR asks for permissions, you can just click Accept ALL , after you clicked Accept All and the ads are still garbage then is not EU fault that Amazon devs that work on ads are incompetent or are optimizing for the thing you don't care.
inetknght 5y ago
> Unpopular opinion Very. > It should be illegal to not use purchase history to make better ad placements. I'm not sure about legality but I think your argument should be made to stock regulators. I don't agree with it but I can certainly see your argument, on the face of it, has merit. I also think it's distasteful and wrong and I don't care to elaborate on that. > Forcing companies to not use all the information at their disposal to make business decisions There are plenty of laws which force companies to not use all of the information at their disposal. Privacy laws, for example, are set to help people (not necessarily customers) have a better life. Corporations don't have a right to profit from people who don't wish to be profited from. > you're also forcing every user of a website to get a worse experience, sometimes severely to their detriment. I fully disagree. I don't believe that using customers' purchase history guarantees in any way that the customer's experience will be better. The only thing it's likely to guarantee is a more profitable company. The two metrics may be correlated but they're not causal.

BurningFrog 5y ago

To me, these fines feel really arbitrary, and like the EU taxing US tech giants "through other means". What's the clearest evidence I am wrong?

igorkraw 5y ago
Usually the burden of proof is with those making the accusations
richwater 5y ago
Why do you think EU tech companies are nonexistent?
- laurent92 5y ago
  Because they have mild success only. DailyMotion is great as #2, but Youtube is about 1000x bigger. Other startups exist, but are far from Apple-style success. Who would let any company own a campus anyway.
  - bildung 5y ago
    If "tech giant" equals "web advertising platform", then sure. But there are quite a few big physical tech companies within the EU. Bosch and Facebook have about the same revenue, for example. ZF Friedrichshafen, a company noone has heard of, has double the revenue of Youtube.
    - frockington1 5y ago
      I wouldn't call making dishwashers tech. I'm not disparaging, I love how quiet my Bosch is, but I would classify it as an industrial company not a technology company
      - borodi 5y ago
        You should probably read more about the other things Bosch does i.e the entire automotive part of it.

neonate 5y ago

https://archive.md/Uc2bg https://archive.md/Uc2bg

mpweiher 5y ago

Begun the GDPR wars have. Popcorn ready. But seriously, the industry has largely been in a Wil-E-Coyote moment ever since GDPR came into force, because most of the "standard practices", and for companies like Facebook and Google their business model, became illegal at that moment. The industry reaction has been to mostly ignore it and carry on as always, running on air and making sure not to look down. Oh, and trying to their best to annoy users by running nasty and also mostly illegal "consent popups", in an attempt to do a repeat of the very successful campaign against the cookie directive. I don't think it will work this time around, because the EU learned from their earlier mistake, and specifically came up with fines that will really, really sting. As far as I know, cases against Facebook are currently making their way through the system (not sure about Google, but they are also guilty as can be), but haven't resulted in a ruling and fine yet. Immovable business model, meet irresistible regulation. Popcorn ready.

singlow 5y ago
The EU is not going to get into a war because it doesn't have any countries capable of fighting a war. The GDPR is not powerful because as much as they think they can extract revenue from a multinational company, the pacifist EU countries don't have the power to enforce it at scale. China, Russia and the U.S. aren't going to help them enforce the GDPR. If the companies don't like it they will just ignore it and exclude the EU from the world economy. The EU will moderate its enforcement to a degree that is tolerable by the companies to avoid any major conflicts.
- denton-scratch 5y ago
  What's this about war? Who mentioned war? The EU is not fining a nation-state with an army; it's fining a corporation with EU subsidiaries and assets. If you want to trade in a place, you either obey the laws of that place, or you shut down operations there, or you get fined. Are you suggesting the USA might use armed force to prevent the EU fining Faceache? I don't think I've heard even nativist nuts suggesting anything remotely like that.
  - 5y ago

cpufry 5y ago

eh, tips scales towards balance and onwards we go.

grumblenum 5y ago

>$888M Google, is that you?

hu3 5y ago
Haha. Is that a reference to Google's DNS 8.8.8.8? https://developers.google.com/speed/public-dns https://developers.google.com/speed/public-dns
- grumblenum 5y ago
  Exactly!

Jyaif 5y ago

Apparently this is due to this french association whose main goal is to sue the big tech companies. They've sued Google, Apple, Facebook, Amazon, and Microsoft: https://gafam.laquadrature.net/ https://gafam.laquadrature.net/

ElKrist 5y ago
This is a misrepresentation of the association. They existed way before this campaign and GDPR The first paragraph [1] of their About section mentions they started in 2008 to fight against HADOPI, which is the French authority created to enforce copyrights in reaction to (illegal) streaming/p2p sharing of music/movies etc. Recently, they're fighting against new French laws allowing the government to collect/process more data on all its citizens for supposedly anti-terrorism purposes [1] https://www.laquadrature.net/nous/ https://www.laquadrature.net/nous/
isbvhodnvemrwvn 5y ago
You can't sue companies under GDPR.

betaby 5y ago

Are those fines really collected? I know Russia has troubles collecting fines say from Twitter. Google always successfully "negotiate" them way down.

doikor 5y ago
With the amount of physical assets and business Amazon has in the EU it will be easy to enforce the collection. The other option is to confiscate the warehouses and data centers and sell those to pay the fine. Also I’m not sure how Luxembourg laws work but here in Finland the government would just declare that company bankrupt and take all of their stuff to pay the fine. (Company not paying their bills in time is grounds for bankruptcy). This is also the easiest way to get a company to pay what they owe you. Just send a notice of wanting to declare the company bankrupt to the courts for not paying usually leads to the bill getting paid in a day or two. This has actually happened to some really large companies (mainly insurance companies that did not want to pay after losing in court when disputing their insurance decisions) Twitter in Russia is very different as they do not have any physical assets there.
- eitland 5y ago
  > (Company not paying their bills in time is grounds for bankruptcy). Same here in Norway from what I hear: Even if you can prove that you have the money tomorrow if your taxes are due today and you don't pay they make you bankrupt. Simple as that, they rather take the loss and know that no one "forgets".
whoknowswhat11 5y ago
These cases are often ridiculous political statements - so they get appealed and the fines knocked way down.

sproketboy 5y ago

Pocket change.

talentedcoin 5y ago

As long as GDPR exists, a European tech company than can challenge FANG dominance will never emerge.

pyrale 5y ago
There are many other reasons why large tech companies have a hard time emerging in Europe. One could argue that none of the really big tech companies that emerged in the US is recent either. So it makes sense, if companies can't be helped, for EU to at least try to protect the consumers.
- adventured 5y ago
  > One could argue that none of the really big tech companies that emerged in the US is recent either. That can't be reasonably argued. The US has dozens of large tech companies that have emerged more recently than the classic big tech giants. The EU, or Europe more broadly, has exceptionally few. More recently, for large tech companies, is the past ~20 years. It typically takes a long time to become worth $20 billion or $50b or $100b. That time frame excludes Microsoft, Apple, Google, Amazon, Netflix, Adobe, Cisco, Intel, Oracle, Nvidia, AMD, Dell/Emc, Vmware, Salesforce, PayPal, Applied Materials, Texas Instruments, Qualcomm, Broadcom, Verisign, Intuit, IBM, HP, Autodesk, eBay, Booking, Expedia, Cadence, Marvell, Micron, Lam, KLA, Western Digital, Seagate, among many others. So what exists from the past 20 years for the US? Facebook, Zoom, Tesla, SpaceX, Workday, Twilio, DataDog, Cloudflare, Splunk, DocuSign, ServiceNow, Snowflake, Square, Coinbase, Stripe, Airbnb, Uber, Lyft, Roku, MongoDB, Pinterest, Twitter, Snapchat, CrowdStrike, Palo Alto Networks, Zscaler, Okta, The Trade Desk, Teladoc, Veeva Systems, Dropbox, DoorDash, Unity Software, Etsy, DraftKings, Palantir, Proofpoint, Zillow, Qualtrics, Roblox, Robinhood, HubSpot, Five9, Zendesk, Coupa Software, Sofi, AppLovin (and I've probably missed a few) Most of these companies have solid growth profiles and will be far larger in ten years than they are today. Beyond that are dozens of single digit billion dollar tech companies born in the past 20 years that will join that list. The EU should also be asking itself why Atlassian and Shopify didn't originate there instead of Australia and Canada. Why didn't UiPath move its HQ to Berlin or Paris instead of NY? Why didn't Elon Musk start SpaceX or Tesla in the EU? Why did the Collisons build Stripe in California? Why is the EU competition for AWS companies like Hetzner, OVH and Scaleway (which are actually DigitalOcean peers)? One may not like Bezos, however he's going to push tens of billions of dollars into attempting to build up Blue Origin, where's the EU comparable by one of their zillionaires? All the biggest US fortunes are first generation and in technology, except for Buffett. The biggest EU fortunes are in fashion, cosmetics, retail. That's representative of the EU being left behind, stagnant. The US badly beat Europe in the IBM-HP-Fairchild era. The US badly beat Europe in the Apple-Microsoft-Intel era. The US badly beat Europe in the early Internet & Web era (Google, Amazon, Netflix, Nvidia, Cisco). The US is badly beating Europe in the cloud era. And that's understating things. It's not a race. The EU isn't even participating, they're stretching on the sidelines, watching the US and China compete to see who can build the largest tech companies (China's tech companies are largely locked inside of China, and that's about to get worse, so the US will win that contest). There's no indication that the Europeans have figured out how to compete, how to scale quickly through their own markets and then rapidly push globally to win markets before the US companies do. So far all they've come up with is top down command schemes whereby countries like France think they can will an AWS competitor into existence magically, or alternatively they scheme to use regulatory capture to entirely avoid having to compete.

afrcnc 5y ago

Non-paywalled report: https://www.politico.eu/article/amazon-fined-e746m-for-violating-privacy-rules/ https://www.politico.eu/article/amazon-fined-e746m-for-viola...

908B64B197 5y ago

It seems to be popular for European bureaucrats to bash on "evil foreign tech giants". I suppose if you can't grow tech at home, the next best thing is to regulate and tax it as much as possible.

nolok 5y ago
There is a law. You respect it, otherwise there is a fine. Are you saying european companies that are leaders in their fields should not be fined by the US if they disregard its law when doing business there ? If yes, you should inform the US. If not, then you're being an hypocrite.
boudin 5y ago
So, according to you, european countries should not be able to have laws and apply those? Companies like Amazon, Apple, Facebook and Google should not be regulated? They should be able to do whatever they want to do? Still seeing people in support of such imperialism is quite sad to be honest..

stacker8888 5y ago

Just forwarded this news to my executive team who held up my attempts at getting us GDPR and CCPA compliant for 8 months last year. They said the laws were 'toothless'. Happy to be proven correct!

winrid 5y ago

I guess they are Stanley Parable fans. https://youtu.be/oV-nDRkhgvk https://youtu.be/oV-nDRkhgvk

EthOptimist 5y ago

Interesting to compare this to the $3B anti monopoly fine against Alibaba recently

sudcha 5y ago

The EU is constantly putting fines on the tech giants, but I don't hear so much from other countries. If all private data is equal as a human right, then the cases should be filed by every country, but I doubt that's happening. Perhaps this is because EU is in power and representative of the largest collective paying user group? Also what happens to the fine? Does EU keep it, or actually give it out to the users who were affected?

misfit-seven 5y ago

That's chump change. In fact it's less than the taxes they owe.