Hacker News Reader

Comment by LoSboccacc | Hacker News Reader

on what experience about gdpr case law is the linked article basing his statement?

all those claims about warning shots and leniency and goodwill of the regulator are completely unfounded. the linked article makes the claim, the linked article should substantiate the claims, and we maintain a healthy right to remain skeptical of those claims until some meat is added to them.

View on HN

The DPA (Datatilsynet) in Denmark operates in the exact way stated in the article. I've fairly sure it's the same in Sweden, Germany, UK, and most of the EU. It is in stark contrast to the US.

I'm not going to link cases, because they're in Danish. They are available from their webpage, and the most resent ones are linked on the frontpage. The last few cases large companies was not in compliance and the didn't get a fine, but they are expected to address the issues, and if they don't then they will get a fine.

That's supernice for you in supernice Denmark. Now what about all the other EU countries? What about in 5 years time if things become less supernice. 10 years time?

They, and other DPAs have multiple decades of history of doing it this way. I trust that more than random people on the internet deciding that GDPR is bad because the DPAs theoretically could do it.

We have plenty of cases serving as prior judgements, and if a DPA suddenly act with a disproportional reaction, there is multiple levels of courts that can and will reverse the decision - nationally and EU level as well.

I know it's kind of hard to imagine coming from a US perspective, but it's "supernice" as you say for pretty much everyone in pretty much every EU country. Based on decades of precedent behaviour.

Here are two recent decisions from the UK. The ICO has a maximum £500,000 fine available.

In one a company was handling sensitive personal data (medical data). They're required to register with the ICO. They did not do so. The sceptics would claim they got huge fines. They didn't. THey got a letter asking them to register, with no further action taken. ICO released a statement.

Last para here: https://www.bloomberg.com/news/articles/2018-04-26/u-k-healt...

In another the Crown Prosecution Service lost data in the same way they had previously lost data: they sent unencrypted DVDs through the mail and those DVDs got lost. The DVDs contained victim interviews from children who had been sexually abused. It's hard to think of worse: very sensitive data, transmitted in a stupid easily fixed manner, and a repeat offence. Even this didn't attract the biggest fine. They got a £350,000 fine.

https://ico.org.uk/action-weve-taken/enforcement/crown-prose...

We have over 20 years experience of regulation. We're not making this up.

The national regulators have been operating the previous regime for twenty years, so there IS plenty of experience and history to look at. The UK's ICO has made quite clear that the style will not change, as have bodies in other countries.

Reply on news.ycombinator.com