While there may be negative examples as you are asking for. There are also many positive examples, I think GDPR is an excellent one. I would also ask for people to share the positive ones, lest we go to sleep in misery.
You also always have recourse against unjust or excessive fines, as per established EU law.
It's not "you will be fined 4% for every breach". It's "you can be fined up to 4%", the GDPR actually states that the punishment should be proportional to the damage caused.
Here's the specific language form the English language version of the GDPR [1] (I suggest you read the whole page):
> Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
If you accidentally send customer data to Google Analytics without their permission, and rectify the issue when it's discovered, you're not going to get slapped with a multi-million dollar fine.
Hopefully. It seems like the law is completely open to the judge's discretion, so for risk assessment purposes it should be assumed that the full fine will be granted, because you can't bank on a lenient judge - especially if you're one of the earliest cases and they decide to make an example of you.
https://www.wsj.com/articles/eus-strict-new-privacy-law-is-s...
Not surprising, expensive regulations reduce competition and benefit the largest players.
As someone who runs dozens of side-projects with thousands of users, I didn't even have to change anything. All it took was to not be shitty to begin with.
Have you learned anything interesting from that?
> If I say no, they have to refrain from using it, they can't just say "well tough luck, we have it now".
Have you been doing that?
> If I give my email for a contest, they can't keep spamming me with crap.
That was already a thing in the US: https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003
> If I tell them to forget I exist, they have to do it.
That could be useful, I suppose. Although to be honest, it's likely to be used to erase bad behavior that we'd rather have public much more than any legitimate privacy concern, i'd guess.
No, the few I asked turned out to have as much data as I shared, which is almost nothing.
> Have you been doing that?
Yep.
> That was already a thing in the US:
Good to know.
> it's likely to be used to erase bad behavior that we'd rather have public much more than any legitimate privacy concern, i'd guess.
I'm not sure I agree with that, but I also don't agree that people's bad behaviour should remain public forever.
Not "hire", "designate". The data protection officer is just a role that someone in the company takes on, it does't have to be their only role.
Oh, and I understand that some don't realize it, but some of us out here running and working for companies affected by these rulings are people too. I wish everyone would stop pretending who they hoped would be affected and see who actually are so we can move from politics to reality.
And as an individual consumer, I'm comfortable in saying that it is a really not great law for me (ie, YMMV). It's impeded some of the content I access and for many sites it's like having cookie notices on steroids. It's a pain in the arse.
Can you list others besides GDPR? I'm ignorant, but interested.