Hacker News Reader

Comment by lwansbrough | Hacker News Reader

We don’t need GDPR. We need sane penalties for data breaches caused by incompetence. The last thing Canada needs is to put ourselves at any more disadvantage with the US market.

View on HN

GDPR has sane penalties, that’s why it’s such a big deal. GDPR seems to put the EU in a better position for the US Market since it has better data laws so is more attractive for US customers. The only downside is for companies not in the EU targeting the EU market, either follow the EU law or withdraw from that market. It basically puts the US in a worse position in my opinion.

$10MM minimum penalty is not sane.

The law states "up to 10,000,000 EUR" which is the opposite of minimum I'd say.

The law does not state that. It states €10 million or 2% of gross worldwide revenue -- whichever is higher.

Those are still the maximum, the 10 million is still not the minimum.

The EU could fine a corporation with 10 billion turnover 10$ but they also could fine up to 200 million $. It doesn't mean they have to fine atleast 10 million once you're over the 2% switchover.

You're missing my point -- what you said the law says and what the laws says are different. You're maximum/minimum argument relates to the guy above your post. That additional option of a 2% figure changes the dynamic of how the fines work completely.

The law says “up to” which is what they explained.

It's very sane -- For a mistake as large as Equifax, a $10MM penalty is basically a slap on the wrist.

It's not a minimum penalty. There is no minimum penalty.

It's part of the calculation for the _maximum_ penalty, which is max(€20m, 4% of global turnover)

As many people have pointed out, what you have said is untrue. I'd actually read about the regulation before commenting on its sanity.

If company does not leak your data but sells it then your law for security breaches are not enough.

You mean data breaches are fine as long as they’re intentional?

That's the exact opposite of what they meant and is what Hanlon preaches to us about.

If you divide causes into "accidental" and "intentional", and assume "caused by incompetence" belongs into the "accidential" catagory, then the comment "We don’t need [X]. We need sane penalties for [Y] caused by incompetence" can be read as arguing against penalties for intential actions.

If they meant the opposite of that, then that's a really weird way to express it.

So what did they mean? GDPR is basically what they said, plus that you have to show you have made a meaningful effort to stop data breaches from happening before they happen. Is that bad?

Intentional data breach is basically the business model where you sell private information without getting meaningful consent from your users. Do you think that is okay because you need that to stay competitive with US companies?

Reply on news.ycombinator.com