4 ms·

This is typically the case with new regulations. The cases that make the news with 100 million dollar fines to trillion dollar companies are just the ones in w

This is typically the case with new regulations. The cases that make the news with 100 million dollar fines to trillion dollar companies are just the ones in which the prosecution can't even reach someone at the company cause 100 million dollars is a drop in the bucket not worth looking at. Most of the time, when somebody contacts you because of these issues, you have 30 days to comply, and if you discover that the problem is bigger than anticipated, these deadlines can be negotiated. The point of the laws in the EU isn't to collect fines, but rather to make sure that everyone complies. You don't win much by going to trial and letting the other party explain why complying in 30 days is physically impossible. So as long as the other party is willing to comply, the first attorney letter get things moving, and then the issue is resolved.

sabas123 5y ago
> The cases that make the news with 100 million dollar fines to trillion dollar companies are just the ones in which the prosecution can't even reach someone at the company cause 100 million dollars is a drop in the bucket not worth looking at. Is this true? I thought they were based on a % of global revenue and that definitely hurts.
- mschuster91 5y ago
  That's the upper limit, not a minimum requirement. Levying the full 4% of global income is something that's reserved for those who blatantly refuse to comply with orders of their respective DPO or repeat offenders.
- merijnv 5y ago
  The maximum fine allowed by GDPR is "10 million or 2% of global revenue, whichever is higher". The goal is to ensure the GDPR "has teeth" even against companies for who 10 million is a drop in the bucket. Keep in mind that large parts of the GDPR were already law in many EU countries, meaning there's years worth of enforcement activity that you can lookup to see how similar laws were enforced. And mostly that has not been "handing out the biggest fines possible" and more "fines scaled to how grossly you violate the regulation". Companies who try their best to follow the law, have good processes and respond promptly, get a slap on the wrist or even just a warning if they remedy the issue fast. Companies that blatantly violate the law and stonewalling regulators get the harsh fines.

sabas123 5y ago

> The cases that make the news with 100 million dollar fines to trillion dollar companies are just the ones in which the prosecution can't even reach someone at the company cause 100 million dollars is a drop in the bucket not worth looking at. Is this true? I thought they were based on a % of global revenue and that definitely hurts.

mschuster91 5y ago
That's the upper limit, not a minimum requirement. Levying the full 4% of global income is something that's reserved for those who blatantly refuse to comply with orders of their respective DPO or repeat offenders.
merijnv 5y ago
The maximum fine allowed by GDPR is "10 million or 2% of global revenue, whichever is higher". The goal is to ensure the GDPR "has teeth" even against companies for who 10 million is a drop in the bucket. Keep in mind that large parts of the GDPR were already law in many EU countries, meaning there's years worth of enforcement activity that you can lookup to see how similar laws were enforced. And mostly that has not been "handing out the biggest fines possible" and more "fines scaled to how grossly you violate the regulation". Companies who try their best to follow the law, have good processes and respond promptly, get a slap on the wrist or even just a warning if they remedy the issue fast. Companies that blatantly violate the law and stonewalling regulators get the harsh fines.