Hacker News Reader

Comment by thrower123 | Hacker News Reader

Has anyone actually been fined in a significant way as a result of GDPR?

An hospital in Portugal was fined €400k for allowing its staff to access patient records without proper safeguards. I think that's the highest so far, but many cases are still being analyzed.

Wasn't that kind of thing prohibited long before the GDPR based on medical privacy laws?

Most things in the GDPR were already prohibited by the Data Protection Directive, but not the amounts of the fines and such.

In other words, the GDPR is the Data Protection Directive but with significant teeth.

Interesting, thanks for the explanation.

Which is the reason most Europeans were talking of GDPR as though it was a non-event in the many HN discussions. Every European business had been doing it for decades under data protection. GDPR cleaned up a few definitions, expanded a few new uses and abuses of personal data, and the headline maximum possible fine. The fine that was almost the only thing people wanted to fixate on.

In the run-up, the best guide to GDPR was UK ICO's guide to 1998 data protection with a few GDPR annotations.

>Which is the reason most Europeans were talking of GDPR as though it was a non-event in the many HN discussions. Every European business had been doing it for decades under data protection.

You must live in a different Europe than I do, because I'm pretty sure that most companies that don't deal with the internet, don't even know what privacy they're required to provide. People still regularly use gmail for some business tasks, they openly list data that shouldn't be shared etc. I don't think what you said is true at all. I think most companies simply don't know that they're in violation in some way or another.

Not every company I've dealt with, or worked for has been net based. All have had some sort of awareness of Data Protection. Obviously, there were also exemptions for the smallest businesses. Sometimes awareness was simply a weekend going through DPA and deciding they were small enough to be exempt.

The biggest problem with Data Protection was the maximum penalty, and that it had no teeth for data that moved out of area. It simply wasn't enough for the larger corporations to care that much - unless they were purely national. Hence some companies being fined multiple times for the same failings. I don't believe there's a Shell, Philips, Siemens or Glaxo that didn't have awareness, data protection officer and so on.

https://www.google.co.uk/amp/s/www.computerworlduk.com/galle...

Probably the most known and significant fine was Google's 50 million euro [0].

[0] https://www.theverge.com/2019/1/21/18191591/google-gdpr-fine...

Google was fined $57M. https://www.nytimes.com/2019/01/21/technology/google-europe-...

Reply on news.ycombinator.com