Hacker News Reader

After reading a large number of GDPR-related articles and summaries, I've generally come to the belief that if you are doing the right thing with user data, it is unlikely GDPR is going to cause you to suddenly start suffering.

This is an extraordinarily dangerous view of GDPR and will likely subject you to fines of up to 20 million EUR. There are hundreds of technicalities that can easily expose you to company-killing fines. This is like saying “you see that massive, fire breathing dragon over there? He’s actually really nice. I mean sometimes he’s not, but grab the kids and let’s go cozy up to him...it will probably be OK”. Unfortunately, most of the time, things are exactly as dangerous as they appear.

Loading Google Analytics automatically on the page on which you ask permission, even if it was an oversight? You’re toast. Using a wordpress plugin that utilizes JavaScript from a third party site and didn’t ask permission for that first because you didn’t know about it? Oops...you may lose your house.

Now, the usual people will say “nobody is taking your house for that”. All I can tell you is that the plain language of this regulation says the only limits are 10 and 20 million EUR.

Edit: to those downvoting this, and there are many of you, please show me where in the GDPR it says that I am incorrect in my assertion that loading third party JavaScript without permission could result in a fine of at least the average value of a house in any given country. Otherwise there is nothing to downvote, because I am not wrong.

View on HN

the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; the intentional or negligent character of the infringement; any action taken by the controller or processor to mitigate the damage suffered by data subjects; the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32; any relevant previous infringements by the controller or processor; the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; the categories of personal data affected by the infringement; the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement; where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.