Hacker News Reader

Comment by havkom | Hacker News Reader

The level of fines looks like it will be harmonized by EDPB (a board of all Data Protection Authorities) so individual DPAs will probably not be able to set arbitrary levels. There are also the one-stop-shop rules so a company will normally only have to deal with one DPA.

When it comes to compensation, you have to show what material or non-material damages you’ve suffered. Class actions are generally not a big thing in the EU. Sure, there is an exposure here but in practice I think it will be very limited, especially for smaller companies.

View on HN

When it comes to compensation, you have to show what material or non-material damages you’ve suffered

You realize that "material or non-material damages" can mean just about anything right? If it were limited to "material" damages, that would at least impose some form of sanity. The way this is written, it's a free-for-all. Saying "I have had alot of trouble sleeping since I found out that only 45 of 46 tracking companies were listed on the disclosure" is all it would take for an individual to obtain money from a company under this absurd regulation.

Yes. Exactly what non-material damages means will be up to CJEU to decide eventually. I do not think many ppl expects it to mean “free-for-all” and I do not think your “sleeping example” would suffice. Admittedly, no one can know for sure at this point in time though.

They'd have to prove in court (to the balance of probabilities) that they have insomnia and that the insomnia was caused by the non-disclosure. They would also have to show that this is an expected result of non-disclosure.

Assuming they do this - how much do you think a compensation payput for insomnia is worth? How many thousands of pounds do you think people would get?

I don’t know, but if you multiply the cost of defending one of them by the millions of such nuisance claims that will be filed by people, and it will quickly add up.

You're saying millions of people will be willing to commit several criminal offences in order to attempt to get a payout of about £1000, in a system that routinely doesn't pay for psychological harm?

I mean, those people can already do this, and they don't appear to do it, so I'm not persuaded GDPR will trigger a bunch of claims.

Is it a criminal offense though? How can it be disproven that you haven't been sleeping as well as you normally do, or that you've been having anxiety because an externally loaded PNG served a cookie that wasn't disclosed (because the website operator didn't know about it)? They'd have to disprove that to jail you for making a false claim.

Reply on news.ycombinator.com