Hacker News Reader

Comment by downandout | Hacker News Reader

No smaller normal company or Google or Facebook will be able to “fully comply” at any point in time.

Which makes it ripe for abuse. By making a regulation that is impossible to fully comply with, they have created a situation where any (or all) of the 28 countries in the EU can fine any company at will, because they're never fully in compliance. Further, individual users can seek compensation under GDPR - companies will be deluged with such claims.

Just having to depend on the goodwill of regulators who you think will just be attempting to enforce the spirit of the law is a terrible position to put companies in. When these countries and individual citizens are starved for cash, all of a sudden the letter of the law will be the only thing that matters, as is always the case with regulations that put all market participants in violation by default.

View on HN

The level of fines looks like it will be harmonized by EDPB (a board of all Data Protection Authorities) so individual DPAs will probably not be able to set arbitrary levels. There are also the one-stop-shop rules so a company will normally only have to deal with one DPA.

When it comes to compensation, you have to show what material or non-material damages you’ve suffered. Class actions are generally not a big thing in the EU. Sure, there is an exposure here but in practice I think it will be very limited, especially for smaller companies.

When it comes to compensation, you have to show what material or non-material damages you’ve suffered

You realize that "material or non-material damages" can mean just about anything right? If it were limited to "material" damages, that would at least impose some form of sanity. The way this is written, it's a free-for-all. Saying "I have had alot of trouble sleeping since I found out that only 45 of 46 tracking companies were listed on the disclosure" is all it would take for an individual to obtain money from a company under this absurd regulation.

Yes. Exactly what non-material damages means will be up to CJEU to decide eventually. I do not think many ppl expects it to mean “free-for-all” and I do not think your “sleeping example” would suffice. Admittedly, no one can know for sure at this point in time though.

They'd have to prove in court (to the balance of probabilities) that they have insomnia and that the insomnia was caused by the non-disclosure. They would also have to show that this is an expected result of non-disclosure.

Assuming they do this - how much do you think a compensation payput for insomnia is worth? How many thousands of pounds do you think people would get?

I don’t know, but if you multiply the cost of defending one of them by the millions of such nuisance claims that will be filed by people, and it will quickly add up.

You're saying millions of people will be willing to commit several criminal offences in order to attempt to get a payout of about £1000, in a system that routinely doesn't pay for psychological harm?

I mean, those people can already do this, and they don't appear to do it, so I'm not persuaded GDPR will trigger a bunch of claims.

Is it a criminal offense though? How can it be disproven that you haven't been sleeping as well as you normally do, or that you've been having anxiety because an externally loaded PNG served a cookie that wasn't disclosed (because the website operator didn't know about it)? They'd have to disprove that to jail you for making a false claim.

I just want to add for the record that I am not a fan of very complicated principles based legislation (which GDPR is) by myself. It is not easy to comply with and it has clear drawbacks.

But now we have GDPR I wanted to state facts (as I understand them) so people can get a more nuanced view of what to expect and hopefully help them with how to deal with compliance in a reasonable manner.

Reply on news.ycombinator.com