Comment by 3pt14159 | Hacker News Reader

Comment by 3pt14159 | Hacker News Reader

Parent Full thread

The problem is that there is a lower floor of a $20m fine. Big corps can risk a 4% hit, but for anyone struggling to get a small startup off the ground the fine is too onerous.

As far as I'm concerned the process should be like this:

1. EU issues warning and cuts off traffic to the domain after 30 days.

2. Startup fixes GDPR compliance.

3. EU unblocks startup.

Only after the company breaks GDPR after getting unblocked should they be hit with this massive fine. For those of us that don't give a shit about Europe it's so frustrating having to worry about how we have to comply.

And before someone says something about "it's only for companies targeting the EU" that isn't as clear as people make it out to be. An errant ad, or a single conference talk, or even engagement on social media can be construed into requiring GDPR compliance.

But of course the reason the EU didn't want to block corporations flouting the GDPR technically is because they saw the arms race happening in China and decided that they didn't want a second firewall. So instead they went the lazy route and they pushed the whole mess on small startups that aren't the problem in the first place. Large corporations are the problem. The fundamental design of the internet and web is the problem.

> The problem is that there is a lower floor of a $20m fine

I don‘t believe that you truly believe that, after it has been refuted a dozen times in every single GDPR discussion.

There is no lower floor. There is not even an obligation to hand out fines.

There is nothing stopping them from doing so though. Maybe they're having a bad day or simply don't like you very much. Some of the data protection authorities have like one to two dozen people working at it total.

There is a lot stopping them, namely the law itself and the courts.

But that is irrelevant in this thread.

There is no lower floor. That was a lie!

The authorities can easily fine someone a thousand Euros or a million Euros.

Oh the law. Good one.

The same law that fined me $1,800 because a posted notice fell off my door in a blizzard? The same law that allowed the judge to uphold the fine by saying "I don't believe you". Bureaucracy sucks, and the second it gets its tentacles on you, no amount of cheek clenching is gonna delay the inevitable.

You mention the law here. Where in the law does it indicate that the DPA can't assign the maximum fine on the first offense even if it is trivial?

Search for the word "proportionate".

Again, you're derailing. I was replying to the claim that no fine lower than 20 million Euros could possibly be imposed.

In the long list of factors to consider when determining the fine, which the DPA will be found to not have given the legally required consideration on appeal of the fine, if you assume a DPA is going to be stupid enough to try.

It's not a 20m / 4% floor, the fines will be discretionary and most importantly are likely to be incremental. EU regulatory authorities do not usually operate in a "shut your service off for non-compliance" mode: assuming they receive a tip-off about your business not being compliant with GDPR 1) they send you a notice and ask for proof of compliance. If you produce evidence, the case is likely closed. 2) assuming you can't produce that evidence, they will give you a warning and a deadline by which to become compliant. A small fine may be levied at this time 3) if the deadline passes without you having done anything, they will eventually get round to giving you a new date, issue a sterner warning and increase the fine for non compliance. To get a $20m fine you'd have to be a massive corporation and be caught repeatedly flaunting the regulation in an outrageous and damaging way (for the consumer); any idea of closing off your small service / website / whatever to EU users because of the perceived risk of a fine is a massive overreaction.

The max fine is 4% with a $20m floor.

People play games with language and try to pretend that just because judges have discretion that this isn't somehow ridiculous.

It is not mandatory that the EU issue a warning. What the EU should have done if they didn't want small startup owners to freak out is they should have made the process clearer and if the $20m level is only aimed at massive corporations then why make it $20m at all? Why not just make it 10% of revenue? I'm not from the EU, I have no idea how the EU court system works. They did not make this easy for small startups.

Let's read the actual document then shall we? It's written in plain enough language for anyone to understand: http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889 20m is one of the two ceilings (the other being 10m) for fines, and in several paragraphs in the document I linked the principles of discretionality, effectiveness and proportionality are stated. If a regulator tried to levy a $20m fine against a startup for a first offence, there would be a strong case to appeal the ruling at an EU court

Reply on news.ycombinator.com