3 ms·

Has there ever been a legal precedent of a company violating GDPR like this and had to pay substantial enough penalty in accordance to GDPR?

scapecast 3y ago
yes --> GDPR enforcement tracker, see https://news.ycombinator.com/item?id=39813801 https://news.ycombinator.com/item?id=39813801
DougBTX 3y ago
Biggest fine from last year was apparently $1.2 billion.
- 0xEF 3y ago
  A fine is just a license fee to break the law. Shut down their business for X months/years, instead, require them to continue wages for their lower level employees and remove any management directly connected with the violation of privacy. Unless we make the penalty extremely harsh, change will not happen in this instance. The selling of PID is far too profitable to be deterred by mere fine
  - piva00 3y ago
    GDPR fines grow to up to 4% of global revenue if a company keeps infringing on it, and they are applied over and over again if the behaviour doesn't stop. Taking a 4% global revenue fine is not something a company can do many times, it doesn't become just a cost of business, it has material impact.
    - shiroiushi 3y ago
      4% is small. Why can't it be 100%? (i.e., the company is forfeit) Sure, it'll have a "material impact" at only 4%, but a determined company could just do it anyway. This doesn't actually force them to stop.
      - Sayrus 3y ago
        4% of the global revenue is not 4% of profits. In a lot of sectors, this can actually destroy a company. GM has 10B profits for 170B revenue so we are talking about 70% of their annual profit. Not enough to destroy the company but certainly not small for a single violation on a subset of their customers. For tech companies however, 4% is less threatening. As I understand it, we are talking about 4% per country of the EU, which in many cases can destroy profits made in a country for years and can certainly wipe any profit made from selling that data.
      - piva00 3y ago
        > Sure, it'll have a "material impact" at only 4%, but a determined company could just do it anyway. This doesn't actually force them to stop. Q1 the company is hit with a 4% fine of global revenue, let's say it's Meta with its US$134 billion of revenue, the fine is US$5.36 billion, they don't change course and Q2 gets hit with another 4%, then Q3, then Q4 ending the fiscal year with ~US$22 billion of fines, that's 56% of their net income, it's an absurd amount that no shareholder will be happy about. Let's say they continue even after that, major shareholders will be up in arms about how the fuck can management be allowing 56% of their global net income to go to the EU's budget through fines. If it gets egregious enough and some company does think they can continue the infringement and bad behaviour the EU will just roll out another regulation to kneecap those companies even harder. I agree with you that companies need to feel the heat to behave, if not then we just get the unethical/immoral branch of capitalism, at the same time the system right now is dominated by these elite capitalists which will fight tooth-and-nail to avoid any kind of punishment through legislation, get too harsh too quickly and we will see those we are trying to punish banding together to fight whole governments to push their agenda, they have the power to do it you just have to look at the USA to see how much mega corporations can bend a democratic government to their will.
        shiroiushi 3y ago
        I don't think Meta is a very good example here. The shareholders can be up in arms all they want, but they can't do anything about it, since Mark Z. can tell them to go pound sand. If he wants to drive his company straight into the ground, he has the legal ability to do that, since he owns a majority share.
  - fransje26 3y ago
    In which world detached from reality is $1.2 billion not a harsh penalty? That's 10% of the GDP of say, the Bahamas..
  - kortilla 3y ago
    Companies operate on money. To pretend a monetary fine can’t grow large enough to deter a behavior is silly.

scapecast 3y ago

yes --> GDPR enforcement tracker, see https://news.ycombinator.com/item?id=39813801 https://news.ycombinator.com/item?id=39813801

DougBTX 3y ago

Biggest fine from last year was apparently $1.2 billion.

0xEF 3y ago
A fine is just a license fee to break the law. Shut down their business for X months/years, instead, require them to continue wages for their lower level employees and remove any management directly connected with the violation of privacy. Unless we make the penalty extremely harsh, change will not happen in this instance. The selling of PID is far too profitable to be deterred by mere fine
- piva00 3y ago
  GDPR fines grow to up to 4% of global revenue if a company keeps infringing on it, and they are applied over and over again if the behaviour doesn't stop. Taking a 4% global revenue fine is not something a company can do many times, it doesn't become just a cost of business, it has material impact.
  - shiroiushi 3y ago
    4% is small. Why can't it be 100%? (i.e., the company is forfeit) Sure, it'll have a "material impact" at only 4%, but a determined company could just do it anyway. This doesn't actually force them to stop.
    - Sayrus 3y ago
      4% of the global revenue is not 4% of profits. In a lot of sectors, this can actually destroy a company. GM has 10B profits for 170B revenue so we are talking about 70% of their annual profit. Not enough to destroy the company but certainly not small for a single violation on a subset of their customers. For tech companies however, 4% is less threatening. As I understand it, we are talking about 4% per country of the EU, which in many cases can destroy profits made in a country for years and can certainly wipe any profit made from selling that data.
    - piva00 3y ago
      > Sure, it'll have a "material impact" at only 4%, but a determined company could just do it anyway. This doesn't actually force them to stop. Q1 the company is hit with a 4% fine of global revenue, let's say it's Meta with its US$134 billion of revenue, the fine is US$5.36 billion, they don't change course and Q2 gets hit with another 4%, then Q3, then Q4 ending the fiscal year with ~US$22 billion of fines, that's 56% of their net income, it's an absurd amount that no shareholder will be happy about. Let's say they continue even after that, major shareholders will be up in arms about how the fuck can management be allowing 56% of their global net income to go to the EU's budget through fines. If it gets egregious enough and some company does think they can continue the infringement and bad behaviour the EU will just roll out another regulation to kneecap those companies even harder. I agree with you that companies need to feel the heat to behave, if not then we just get the unethical/immoral branch of capitalism, at the same time the system right now is dominated by these elite capitalists which will fight tooth-and-nail to avoid any kind of punishment through legislation, get too harsh too quickly and we will see those we are trying to punish banding together to fight whole governments to push their agenda, they have the power to do it you just have to look at the USA to see how much mega corporations can bend a democratic government to their will.
      - shiroiushi 3y ago
        I don't think Meta is a very good example here. The shareholders can be up in arms all they want, but they can't do anything about it, since Mark Z. can tell them to go pound sand. If he wants to drive his company straight into the ground, he has the legal ability to do that, since he owns a majority share.
- fransje26 3y ago
  In which world detached from reality is $1.2 billion not a harsh penalty? That's 10% of the GDP of say, the Bahamas..
- kortilla 3y ago
  Companies operate on money. To pretend a monetary fine can’t grow large enough to deter a behavior is silly.