GDPR Enforcement Tracker: List of GDPR fines | Hacker News Reader

GDPR Enforcement Tracker: List of GDPR fines

enforcementtracker.com

368 pointsKanyeBest289 comments

Wow. Here's an crazy one:

Someone was fined 2000 euros for using CC instead of BCC in his little mailing list newsletter of 150 people in Germany.

"The fine was impossed against a private person who sent several e-mails between July and September 2018, in which he used personal e-mail addresses visible to all recipients, from which each recipient could read countless other recipients. The man was accused of ten offences between mid-July and the end of July 2018. According to the authority's letter, between 131 and 153 personal mail addresses were identifiable in his mailing list."

Poor guy.

This seems to be proof that the GDPR is being weaponized against people and organizations one doesn't like.

In the UK, the data regulator fined a small organisation £180,000 ($230,000) for exactly the same mistake on a list with 781 recipients. The organisation was a specialist sexual health clinic and the newsletter was for patients with HIV.

Without knowing the details, I can't say whether a €2000 fine was disproportionately onerous or a slap on the wrist.

https://www.businessinsider.com/nhs-trust-fined-for-leaking-...

It's worth noting that that fine was made under the Data Protection Act 1998 (implementing the Data Protection Directive), which is what was in force before the GDPR became law.

The ICO might well consider a similar breach worthy of a bigger fine now.

With such sensitive information they should really avoid CC/BCC and do it manually, or write a script for sending 1 email at a time. Not because CC/BCC is bad, but because you want to be 100% sure to dodge this kind of problems.

And the fine will make sure you remember to do that in future!

It's almost like laws can work.

That'll be part of why they got the fine. One component of gdpr is taking reasonable steps to avoid leaking personal data, and as you pointed out relying on someone remembering to bcc rather than cc is asking for trouble.

Not just that. Health data is considered especially sensitive by the GDPR, so sharing it is a more serious transgression than simply sharing personally identifiable information in general.

The details are that some of the most sensitive medical information you could imagine got leaked. Huge, huge violation. Even in the US HIV status is extremely confidential.

The details on the 2000 euro fine?

No the big one.

Details on the 2k€ fine; the guy used his mailing list for harassment, the 2k€ fine would likely have also been issued prior to the GDPR as german privacy law is fairly strict.

HN tangent: This is a great example of where the oft touted wildcards on a personal domain fall short: if you’re on that list, you’re outed. Even without your name on it; only you use that domain.

This is where Outlook with their *@outlook.com and apple’s new system really do shine.

Commiserations to those affected :(

Wildcards are a measure to track what others are (automatically) doing with your email address, provide a way to remove yourself from shared lists of bad actors, and sign up to something a dozen times. What they don't do is provide privacy against human eyes.

I've been wondering how this sort of email management strategy is going to handle the rules certain countries are bringing in now where if you want to go there then you have to provide a list of all of your email addresses and social media accounts. Has anyone run into that problem yet?

Yes, my email address is "usa-border@mydomain.com"

If the story linked elsewhere in this thread is the one in question, this wasn't an accident. It was a guy running some kind of harrassment campaign. His "little mailing list" was of people he was harrassing, not subscribers to a newsletter.

https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail...

Not a harassment campaign as such, it seems. He was mad about something, and mailed a bunch of politicians and press his complaints. Complaints, sometimes bordering on being libelous, according to the agency which fined him, not death threats.

He was fined solely based upon the email addresses being visible to all recipients, not because of the content of his mails, said a spokesperson. However, he was a repeat offender in terms of privacy, who in the past was warned, then fined for similar stuff.

I'm a little bit torn on that one. The fine seems excessive for what he did (and the email addresses seem to be a list of already public journalist and press contacts) and it certainly looks like somebody in the govt got annoyed and threw the book at the guy in retaliation. Then again, he had ample warnings, and choose to ignore those warnings.

Isn't one of the points of separation of power that the government (executive branche) should not have priority access to the judicial branche? Fining individuals, even loony ones, while not even attempting to fight the big battles (FAANG, personal data trading for 'profiling' or even government profiling within the EU) is imho just preposterous.

Well, the judiciary branch was not involved in this fine. It was a government agency issuing the fine. Now the fined person could pay the fine, or file a suit asking a court to overturn it.

It really is analogous to most govt fines e.g. speeding tickets: the government (the police) gives you a ticket, and if you pay it then OK, no court involved, but if you challenge it then the courts get involved.

But more generally, the government should and does get priority access to the courts already. Criminal courts exist solely to serve the government; you cannot bring criminal suits as a citizen yourself, only civil suites. Also, e.g. in Germany the government and legislatures (federal and state) get priority access to e.g. the constitutional (supreme) court. A mere mortal cannot just file suit directly in the constitutional court, but has to go through the lower instances first (unless there is something similar to a class action petition, showing a sizable chunk of the population sees the same issue and wants it decided). Members of the parliaments and IIRC of the cabinet are allowed to file suit in the constitutional court directly. The reasoning here is that if it was allowed for citizens to petition the highest court directly, then the court would do nothing else than write rejection letters for bullshit petitions. While the govt and legislatures incl the parliamentary opposition of course represent the people (in theory) and aren't stupid morons wasting the courts time (in theory).

PS: Google was already fined €50M for GDPR violations, and there is probably more of those in their future. Facebook got fined €10M so far, IIRC, also with more to come. And don't forget the billions of Euros worth of antitrust fines against Google and Microsoft, e.g.

What sort of priority access was used in this case? Maybe they just filed a complaint like anyone else.

I support this fine in principle. Maybe not the magnitude, maybe not without a warning, and of course a three liner isn't enough context to be sure.

But using CC instead of BCC causes a massive leak of personal information, especially when either the subject being discussed or the people on the list are sensitive. In my life this has mostly been annoyance at large org stuff, but my wife has had this happen with a sensitive medical practice and we were not in the US so HIPAA did not apply.

I don't think fines are the only solution, of course. But I think fines should be on the table and it's easy to me imagine a circumstance where 2k euro would be appropriate.

There were multiple warnings and the guy was a repeated offender. He had already been fined earlier.

Last year, when GDPR was heavily discussed, people were criticizing those who decided to just stop their small hobby websites because of the potential GDPR exposure.

The argument back then was that they were overreacting, that we didn't understand how Europe works, that you'd only get fined after repeated warnings about violating procedures etc.

I'm sure the private person was dumb for doing what he did, but that doesn't invalidate the general point: unless you're sure you that can afford making these kinds of mistakes, don't provide a service on the internet that might be used by EU citizens.

The benefits, whatever they might be, just don't justify the risks.

Except we see just the fine. We have no idea how many attempts and warnings to get them to comply were sent first. It wasn't one email, it was multiple emails, multiple times over months.

This site makes no mention of warnings and escalations, and ICO at least doesn't normally announce that for individual cases. Though they do put out aggregate stats. When they have fines are clearly shown as arising in a small minority of cases.

There are other examples at least from Germany where no warning or time to rectify was given, just a fine.

https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-o...

800k email records and passwords in plain text when breached. I don't know how big Knuddels are, so I don't know if that fine sounds lenient, right or high. Yet as it's a large breach it seems fitting of no warning first, considering the scale of negligence, mitigated by their "exemplary cooperation" afterwards.

Which goes to show why the regulators get the discretion to decide appropriate action from warning only to maximum fine. Without context and aggravating and mitigating factors we can't know, which was my point. If a penalty is disproportionate there's well worn appeal tracks.

Other comments seem to point to the small case in OP comment being some guy running a list to harass people, which seems like a huge aggravating factor to me. Maybe he got one warning, maybe in context he didn't deserve even that.

> We have no idea how many attempts and warnings to get them to comply were sent first.

True. But I doubt that even the most ruthlessly efficient GDPR enforcement authority could multiple enforcement requests between mid July and end July.

Why are multiple requests needed? You do shit, you get a request to stop it, you don't do it, you get hit with a fine. How many requests do you expect the authorities to send? 5? 10? 100? If I get summoned to court and don't follow it I get a fine. How is this any different?

Sure, but offences between July and September 2018, and convicted Feb 2019 only against the small sub selection in July.

There's potential time for quite a few ignored warnings before prosecution, but I don't know and can't find out from here if or if not.

They almost certainly got complaints from the users on that list. You tend to get pretty swift response from that.

Very likely that they just ignored it.

> unless you're sure you that can afford making these kinds of mistakes, don't provide a service on the internet

DOT

sounds good

What does DOT mean?

Thanks, I thought it was some acronym.

What does . mean?

It is used for several purposes, the most frequent of which is to mark the end of a declaratory sentence. (why are we doing this?)

I thought English uses PERIOD to verbally mark the end of a declaratory sentence, not DOT. That's probably where the confusion comes from.

To be strictly accurate, English uses 'full stop', and American English uses 'period'.

I should have written "period".

Everybody makes mistakes. Which makes GDPR a recipe to hand over whatever remains of the Internet to only corporations that afford paying for them.

Sure, but there are different kind of mistakes. Surgeon can make a mistake, but it's a different kind of mistake if instead of a surgeon, a plumber cuts the patient with a kitchen knife.

I agree it's a difficult problem and it's hard to define boundaries, but some level of competence is welcome when handling data that belongs to other people.

If you start some internet service, I expect you not to lose my data (in some lame way, s.h.), just like I expect my car mechanic not to destroy my engine.

edit: to give it context, I closed my programming website with thousands of active users that I had for almost 20 years because of GDPR, I'm not a big fan of it, but what I like even less is when complete incompetence when handling personal data results in zero consequences

Yes, people make mistakes. And by deciding to create a business around other people's personal information some mistakes are bad enough to merit a fine.

All sorts of civil offences and crimes can be mistakes. While "it was an accident" might lower the penalty it doesn't negate the fact the mistake was made and people might have been hurt.

The idea that we should hold companies that profit off people's personal data blameless if they manage to "make a slip-up" with it is absurd. The only other industry where we accept those kinds of mistakes is Wall Street and we all know how well that policy has gone.

>deciding to create a business around other people's personal information

>profit off people's personal data

Have you "decided to create a business around destroying the environment" and "profit off CO2 emissions" because your office is heated in the winter? GDPR is not specific to the adtech or data brokerage industries.

Yes, climate change effects would probably be a more accurate analogy -- but many people are very much against carbon tax schemes so it felt best to avoid that comparison.

I used to have a website that did stuff with GPS data that was uploaded by users.

It was purely a hobby affair that was a net loss, but Google ads ($10 per month) reduced the cost somewhat.

Those ads probably made it a for profit business.

I shut the thing down before GDPR, but if I hadn’t it surely would have been an excellent reason to do so.

Those are the kind of websites that you lose.

I consider that a loss.

GDPR doesn't prevent you from collecting personal data. It only requires you to have a clear reason for collecting everything and being transparent about what data is collected and how it is processed.

The examples here make clear that "a clear reason for collecting everything" means an ironclad justification for each field, each bit of precision, each minute of retention. That is not a casual thing. As in, one of the fines here is for retaining a phone number to fulfill a need to communicate, when postal mail could have worked instead.

It is doable, if you have the lawyers and the time. But that's not a degree of scrutiny you want to gamble your life savings on for a personal project.

If you don't need a phone number why collect a phone number?

I might need it later is not a clear reason!

"Don't need" as in "there are feasible alternatives."

HN doesn't need to know or share your username to post your comment, it is clearly possible to run a message board without usernames, and conversations could be maintained by generating a random pseudonym for each thread.

Also, the fine (if we are talking about the Danish one) was not for collecting a phone number. It was for retaining it after the retention limit (in this case 2 years, and they kept them for 5 years) without a good cause. The company argued they were and essential part of the database. People love to make GDPR look bad, but it's often not as bad as it looks from a one line summary.

Why could GDPR possibly make someone shutdown such a website?

Pure FUD.

EDIT: Downvotes don't change reality. The OP is spreading FUD.

Edit: unless the website was actually abusing users privacy in which case I'm glad it is gone.

Well, suppose he does some transformation involving position. GPS points also have altitude in them. He neglects to sanitize altitude at the point of collection, and is therefore collecting and retaining more data than necessary to perform the service. He plots positions on a relatively zoomed-out map. Only the first six significant figures make a perceptible difference in the map position, but he retains the same precision that was uploaded, usually higher. Again, failure to minimize. Worse, he enabled automated periodic VM snapshots with his VPS provider, so is not properly complying with deletion requests.

Now he has "decided to build a business around profiting from the abuse of personal data" and the consensus in this thread looks on his destruction with glee.

> Worse, he enabled automated periodic VM snapshots with his VPS provider, so is not properly complying with deletion requests.Worse, he enabled automated periodic VM snapshots with his VPS provider, so is not properly complying with deletion requests.

This is typical FUD. GDPR allows backups. Right to be deleted doesn't mean grovelling through backups. If those snapshots are rotated out after e.g. 3 months he is fine.

And regarding sanitizing altitude. Again pure FUD. There is no way that that would be a problem.

Of course if he stores the data in a personally identifying way and then is either incompetent or abusive then he could attract a fine...

In the real world GDPR enables such websites because users can trust that he has to follow some minimum standards.

The great thing about TFA is we can stop speculating and see what the regulators are actually doing.

>After the controller succeeded to identify the data subjects he refused to comply with the deletion request, arguing he is legally obliged to retain backup copies according to the Accountancy Act and internal policies. Since he did not properly inform about these policies, the NAIH held the controller breached the principle of transparency.

So maybe if his backup regime were precisely specified in his privacy policy. But even a conflicting legal requirement is no defense, here.

Regarding minimization, 4 other cases:

>During an inspection, the Lithuanian Data Protection Supervisory Authority found that the controller processed more data than necessary to achieve the purposes for which he was a controller.

>Data was not only processed if adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed

> The video surveillance subject of the proceedings is therefore not limited to areas which are under the exclusive power of control of the controller.

> The Commissioner considered that the aim could be achieved by referring only to the initials of their name and/or their faces being blurred and/or publishing photographs drawn from a distant distance

"Of course if he stores the data in a personally identifying way..." GDPR cares not for identifying but for identifiable. It's GPS data. If someone uploads data pertaining to their home, workplace, frequent travel routes, etc. then it is definitely identifiable.

Regarding FUD, it seems FUD is exactly what the DPAs intend, since they are punishing rather than helping when asked for advice!

>Kolibri Image had send a request to the Data Protection Authority of Hessen asking how to deal with a service provider who does not want to sign a processing agreement. After not answering Kolibri Image in more detail, the case was forwarded to the locally responsible Data Protection Authority of Hamburg. This Auhtority then fined Kolibri Image as controller for not having a processing agreement with the service provider.

Statement from Kolibri Image (German):

https://kolibri-image.com/causa-datenschutz/

Google translate:

https://translate.google.com/translate?hl=&sl=de&tl=en&u=htt...

tl;dr

The Data Protection Authority of Hessen suggested Kolibri Image to draft their own data processing agreement and get Packlink, located in Madrid, to sign it. [1]

Kolibri Image then stated that they would "leave things as they are", which was incorrectly interpreted to mean that they'd use Packlink without an agreement instead of not using Packlink in the future.

In addition, Kolibri Image forgot to update one of their six data processing agreements on various websites which still mentioned Packlink, so their clarification of the matter was not believed.

Finally, the case was dropped because it (partially?) happened before the 24th of Mai.

[1] Drafting a data processing agreement for Packlink is of course not very practical because who knows how they handles their data and why would Packlink sign it in the first place if they don't want to offer a data processing agreement. In addition, the cost of drafting and translating the agreement is much more expensive than the savings from using Packlink as a shipping processor.

In any case, I agree that fining after asking for advice is not a friendly move.

I think you should dig into these cases a little deeper.

The people who can be relied on to do that correctly when money is on the line are called lawyers, and they aren't cheap.

You receive an email with a request for a privacy statement? Great, one way or the other, that's work with potential legal repercussion, which means you probably should talk to a lawyer. Additional expenses and hassle for no good reason.

You make a fix in the email system that accidentally emails everybody at the same time? (It almost happened.) Oops. There's your exposure to some nice fine.

You don't need to be abusing somebody's privacy to be concerned about legal exposure. Just like there are asshole companies, there are asshole users as well who can make your life miserable.

Any hobbyist who doesn't take this kind of exposure into consideration is naive.

I'm sorry but every website collecting personal data should set out clearly and simply what it is used for and how it can be distributed. For asmall hobbyist site you don't need a lawyer, there are plenty of decent templates out there.

That's a pretty weak argument in and of itself. Many crimes are mistakes.

Similarly, many simple mistakes shouldn’t be treated as a crime.

If you make a mistake and you do so honestly, not out of malice and fix it, you are very unlikely to get a fine - you will get guidance and a warning. Unless you are being egregiously slip-shod.

That's not true, unfortunately.

https://www.lexology.com/library/detail.aspx?g=d8d0c69a-620e...

Storing user names and passwords in plain text when you have several hundred thousand users is not a "honest mistake" in 2019. In other fields a commercial entity failing basic security practices can be considered criminally negligent.

That's absurd. Talking purely about the UK right now: there were tens of thousands of cases logged with ICO since GDPR came into power. So far,there were only a handful of companies that had to pay fines and their actions were either borderline criminal,or deliberate refusal to cooperate with ICO.

If it's the case I've seen [1], it wasn't someone sending a little mailing list newsletter to people who have opted in, it was someone sending complaints and CC'ing everyone they could get an e-mail address of. The article I saw also makes it sound very much like he was told to stop repeatedly.

Seems like an appropriate fine. Or do you think I should be allowed to collect 150 e-mail addresses, then e-mail them out to all 150 other people, after some of them told me not to do that?

[1] https://www.rosepartner.de/blog/bussgeld-fuer-offenen-e-mail...

The list has over 1600 recipients making it a bit larger than for "personal use". The quoted 187 recipients might just be one batch of recipients the examined mail was sent to.

The sender is also non-repentant and is running some sort of hate campaign.

I expect there would have been a warning given in that case before assessing a fine. Many of the less serious ones I read explicitly mentioned warnings that were ignored.

Seems to be proof it is being weaponized against behavior one doesn’t like, the behavior which is forbidden by the law.

This isn’t a one time slip up, it’s a 10 times slip up and chances are there were a lot of warnings this guy didn’t want to listen to. So he was hit where it hurts. Poor guy, it’s like he was caught speeding ten times and then got fined.

Woah. That's great!

In Poland we actually have a sort-of tradition, AFAIK started by one of computer security portals, where if you find yourself on the receiving end of such CC-instead-of-BCC, you kindly tell the company responsible that this can and should be picked up with data protection regulators, and it would be nice if they e.g. paid ~500-2k EUR equivalent to a charity of their choice.

I'm totally 100% in support of this against companies. Less so about private individuals, though a 150-people newsletter is kind of thought-out and organized thing, and then 2k EUR in Germany is probably less than a monthly paycheck. A hard hit, but survivable without loss of life quality.

Airbnb Germany did this once in a mail out to all hosts. We started a business (since closed) off the back of it.

Whether this is guy is a victim of overzealous enforcement, or an example of the GDPR protecting people, is completely dependent on the context of the case and the nature of the mailing list.

The linked article suggests that the guy was sending out angry political rants and criminal accusations to thousands of people a day, which adds a further twist.

If that’s true then the gdpr was not used according to it’s spirit at all. They punished annoying guy who was trying to get some attention. Of course google or fb is fine...

This is crazy. I've seen it done plenty of times by accident in the past, because people don't know how to use BCC (and its hidden by default in many clients).

Yeah, but ten times in a row? And that's just in half a month, it sounds it could've been dozens of times over 3 months?

Nothing I've heard about this case sounds to me like an innocent mistake that a reasonable effort was made to correct.

I've accidentally smacked people on the street before (gesturing, probably). That's technically a crime, but it'd be crazy to prosecute me for a little mistake like that. But it's not crazy that hitting people is a crime and that people do get prosecuted for it in egregious cases.

Not just hidden. When using BCC, the information is never transmitted outside the sending server.

I think what they meant is the option to send as BCC instead of CC is hidden in most mail clients.

Thank you. That does indeed make more sense.

It should have been more.The idiots who do this deserve it. My fiancé's ex employeer used to send emails cc'ing contractors that haven't even seen each other.I've seen some small scale companies even try to send marketing emails to their small list of clients..

Different take: This is exactly what GDPR was designed for. It just hasn't been "weaponized" enough yet to have the bandwidth to deal with every situation, so situations like these seem like targeted attacks when in reality they're precisely what GDPR is supposed to deal with.

I personally think ~$15 per leaked email is a reasonable fine. I bet this guy and everyone else who reads this article won't accidentally leak emails again, and that's great.

The thing is if this was a civil case you have to prove some damages had be done by the leak. A random person leaking my email in CC - that happens a lot - is not even necessarily annoying but for sure don't cause any damages.

But how is that different from any of the other privacy violations that are regulated? I doubt many of us could prove any damages from Amazon listening in on conversations made by our kids, or Google not properly disclosing that its tracking our search clicks and GPS location for better ad targeting.

In fact, I'd argue that leaking an email that exposes a private association with a mailing list to other unknown people has much clearer potential for damage than any of the privacy issues that big companies get fined for. And yes, CC leaks do happen (not a lot, in my experience), but I'm personally upset about it every time - much more so than when I find out Google didn't get my consent before recording half of my internet activity. Just because the violation is something that "happens a lot" because it can be done by accident by a careless individual doesn't mean it's less serious.

+1. Privacy violations sure do cause damages, they're just very difficult to attribute. When someone suffers identity theft, which ones of the dozens of leaking sieves with their data most enabled it?

Can you clarify what you mean by "The thing is"? Are you saying that's good, bad, or something else?

If a behavior is harmful and we want to stop it, but it's difficult to prove direct damages and therefore civil suits have been ineffective at curbing the behavior, then it seems like a reasonable public policy to impose fines on engaging in the behavior without requiring actual damages be proven in court.

(And if it's easy to innocently accidentally engage in the behavior, it seems reasonable to first issue warnings, and then impose fines if the behavior continues repeatedly.)

Whether there are damages depends on the context. In 2015 an HIV clinic in London used the to: field instead of bcc: on a patient newsletter, thus exposing the names of 700 patients, many of whom knew each other due to the small geographic area being served (https://www.theguardian.com/technology/2016/may/09/london-hi...). They were fined GBP180K (under the pre-gdpr regime, incidentally, so this isn't a new risk for businesses).

I think that is why my hospital network uses an online patient account for any messages instead of email. Easy to screw up this stuff if using email.

Yes, proof of weaponized gdpr use indeed (for very specific filtering cases of gdpr use).

In India, I often get government mails (e.g. reminder for some compliance) of local city with all the business owners in CC. I even went to authority in question to tell them about the privacy issue in vain.

So if a EU citizen's email id was part of the list, will it be liable for action according to GDPR?

Yes, but if an entity has no interest in interacting with the EU then they don't have to respond. You only need to care about a country's laws if (1) you want to do business or visit there or (2) you're going to piss them off to such a degree that they convince your home country to come after you.

> This seems to be proof that the GDPR is being weaponized against people and organizations one doesn't like.

Well, against people who publicly share private info of 150 other people who trusted them those emails. 2K euros is not that huge money in Germany, it's not like they'll loose their house over it, and that certainly is a practice that needs to be stopped. Just being an amateur is not an excuse when you deal with other peoples' data.

Frankly I'm glad that GDPR has the teeth to get people to stop abusing reply-all chains and mailing lists.

This seems to be proof that the GDPR is being weaponized against people and organizations one doesn't like.

What didn't they like about this person, and what proved that to you? And what proved that was the impetus for this fine?

250K Euros to LaLiga for their app that tries to find bars illegally broadcasting their games by sampling user's microphones once a minute. I remember when it was discovered what it was doing thinking this must be a massive GDPR issue. I'm a little bit surprised that the fine is this low:

"The national Football League (LaLiga) was fined for offering an app which once per minute accessed the microphone of users' mobile phones in order to detect pubs screening football matches without paying a fee. In the opinion of the AEPD LaLiga did not adequately inform the users of the app about this practice. Furthermore, the app did not meet the requirements for withdrawal of consent."

I'm impressed at the creativity and disgusted that they thought this would be okay at the same time.

Considering some others in there this feels like a slap on the wrist

If they stopped the conduct then it is not supposed to be anymore than a slap on the wrist. GDPR is meant to correct behaviour, not to punish.

Very little money for the kind of intrusion they did.

To whoever did this: thanks!

Such a website can have many uses:

  - Show the average people why privacy is important with concrete examples
  - Find previous rulings for people in a specific situation
  - Stop(reduce.) the "there is no way we're going to be sued for that" by the company's managers

My wish for that website is that in the future, the data is more easily readable and "big-data exploitable" (good luck with that)

Little things I can tell on the top of my head:

  - the height of the fines is basically random, that makes scrolling cognitively heavy imo. Having (...) to click to expand long descriptions sounds fair I think
  - it's not possible to link to a row (useful for giving examples to people)
  - long descriptions deserve multiple paragraphs, they are hard to read as-is.

Also, I think negative rulings would be useful as well, though could send a different political message, so that's author's choice.

> Stop(reduce.) the "there is no way we're going to be sued for that" by the company's managers

I was thinking the opposite. The fines listed are so low, that from a purely financial perspective complying doesn't seem to make much sense. I would estimate all GDPR compliance efforts I've been involved in to be more costly than the largest fine issued in Germany.

I think the spirit is that first offenses that aren't extremely outrageous get lower fines.

The idea, generally speaking, is escalating fines. If a fine of this level doesn't stop you, you will get a substantially larger fine for the next or on-going infringement.

If you look back at comments as GDPR was first coming into effect, you saw a lot of comments here along the lines of 'The EU doesn't want to fine anyone. They want you to become compliant, and will help you do so, and you won't be fined unless you were intentionally being non-compliant'

But then look at this example from Germany:

> Please note: According to our information this fine has been withdrawn in the meantime. Kolibri Image had send a request to the Data Protection Authority of Hessen asking how to deal with a service provider who does not want to sign a processing agreement. After not answering Kolibri Image in more detail, the case was forwarded to the locally responsible Data Protection Authority of Hamburg. This Auhtority then fined Kolibri Image as controller for not having a processing agreement with the service provider. Kolibri Image has stated that they will challenge the decision in front of court since they are of the opinion that the service provider does not act as a processor.

The company emailed the authority asking for advice on how to deal with a service provider who didn't want to cooperate with GDPR, then the authority ignored his request, forwarded their information to another authority, which then fined them for the exact thing which they was asking for advice on.

Yes, the fine has apparently been withdrawn, but how much time, money, and mental capacity did Kolibri Image have to spend dealing with this before the authority decided to drop it?

I'm not actually that sympathetic. If you have a processor that does not want to sign a processing agreement, you have to stop using them. There is no leeway on this issue in GDPR. You are responsible for ensuring that third party processors you engage agree to handle the data lawfully. There's not a lot of context to go on, but it seems to me that the company in question is just stalling. I literally can't think of a legitimate reason for their opinion that the service provider "does not act as a processor". Either you are sending PII to them or not. If you are, then they are a processor. If not, then it's not related to GDPR in any way.

That's fine, but my point was not that Kolibri Image took the appropriate steps immediately, but whether the commenters here on HN were correct in their estimation that the various data protection authorities would help you resolve compliance issues versus just issuing you fines.

Some more context: https://gdpr.report/news/2019/01/23/small-business-in-german...

Relevant passage: "Discovery of the misdemeanor began with an email from another company to the Hessian Data Protection Commissioner, sent in May of last year, in which advice was requested regarding the failure of Kolibri Image in proving customer data, despite multiple requests being sent. Kolibri Image declined to cooperate, instead laying responsibility at the feet of another contractor."

The article is a bit hard to understand, but it seems that someone asked Kolibri to provide information on how 3rd party information was kept secured. Kolibri declined to answer saying that it was another contractor who was doing it. Reading between the lines, Kolibri seems to have asked for guidance on what to do, but did not receive guidance.

I have to say that I'm even less inclined to be sympathetic. It's a pretty blatant disregard for the GDPR. If you want guidance at that level, hire a lawyer. But in reality, there is no need for a lawyer: it is completely obvious that you can't shield yourself from GDPR simply by saying, "Oh it's this other company's responsibility. And, by the way, they don't agree to do GDPR, so it's out of my hands".

To be a bit more clear, I don't know what the authority could do to help resolve the compliance issue other than to say, "Yes, you have to comply with the law. Sorry that you thought you didn't have to". Is a 5000 euro fine justified -- even without having given guidance. IMHO, yes, however you can see that they thought they were in error and hence are reviewing the fine. The other blurb made it seem as if the compliance issue was only discovered because Kolibri asked what they should do. This article makes it more clear that it's just a normal complaint with a company doing everything in its power to avoid doing anything.

you can't shield yourself from GDPR simply by saying, "Oh it's this other company's responsibility. And, by the way, they don't agree to do GDPR, so it's out of my hands".

To be specific, this is mandated explicitly by the GDPR:

> the controller shall [ensure] to be able to demonstrate that processing is performed in accordance with this Regulation. [art.24]

> Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees [art.28]

> Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller [art.28]

[art.24] https://gdpr-info.eu/art-24-gdpr/

[art.28] https://gdpr-info.eu/art-28-gdpr/

> "Oh it's this other company's responsibility. And, by the way, they don't agree to do GDPR, so it's out of my hands"

In this case, the other company is also in Europe (Spain), so by law must abide by GDPR. It seems they didn't have a contract ready, and Kolibri didn't want to spend money on translating/creating a contract to Spanish.

From what I read from Kolibri themselves (https://kolibri-image.com/causa-datenschutz/), the "processing" was a company that bundles DHL package orders to get batch pricing. You send them the information, they send the order (together with other orders) to DHL, DHL picks up the package and you save on postage. Apparently, Kolibri wasn't sure whether that's actually data processing (but did mention them using the company for this particular reason in their privacy information, according to the Bavarian officials, it isn't). They asked the German branch of the company who said they wouldn't need a contract and subsequently referred them to HQ in Spain. They asked the Hessian official to make the company's German branch comply with GDPR and sign a data processing contract. Instead, the Hessians forwarded it to Hamburg.

Kolibri claims to have stopped using that company after hearing back from the Hessians, but forgotten to remove them from the privacy information on one website. If they are to be believed, they were told "you can't use them without a contract" and stopped using them.

The fine has since been withdrawn and the case was closed.

It's interesting how enforcement changes between countries. For instance, all the fines in Austria where for CCTV and dashcam use, all of France's fines were against large corporations, and the single fine Italy imposed was on the "Movimento 5 Stelle" political party.

These aren't all fines. Most of them are published by a select few individuals or newspapers with a clear focus of interest.

What you are seeing is french newspapers being especially interested in fines for big corporations, this is without a doubt a direct result of the current political situation in France.

  all of France's fines were against large corporations

When determining the amount of the fine, the CNIL took into account the size (9 employees) and the financial situation of the company.

I mean, that is the coalition partner in government right now, so it's a big deal...

The ICO maintains an official list of fines in the UK https://ico.org.uk/action-weve-taken/enforcement/?facet_type...

Notably none of these are (yet) for violations of the GDPR. The ICO has issued enforcement notices, but they haven't levied any penalties so far.

Ah, my bad. Only checked the date of the decisions and assumed they were related to GDPR.

The Uber one is odd, US fined Uber $148m, the UK fined them £385,000.

October and November 2016 - Pre-GDPR, the DPA was still in force. They were fined 80% of the maximum under DPA.

Can anyone explain the N26 case to me?

I've tried to read two articles on it and they don't make sense.

It seems they stored data on users who closed their account to prevent money laundering, which is apparently fine if the bank actually blocks operation of those accounts according to one article.

But somehow this was not the case for those old accounts that were closed? How can you close an account but it's still an operational account? Like, was it still possible to send money to it etc.?

My guess is that the article is wrong and this was simply about them preventing legitimate users to close and then reopen a new account.

I have a hard time believing they were not allowed to keep that data for some time after acccount closing. It seems to be more about how it was used.

My guess is a user requested his data deleted, but N26 just disabled the account.

Then the user signed up again, enabling the same account.

The user then saw their old data hadn't in fact been deleted, and complained to the regulator.

Are banks even allowed to wipe your whole account record? They probably have to keep most of it for tax collectors.

If they only kept the data that was necessary for legal compliance with tax regulations, they wouldn't have been fined. That's explicitly allowed. That they were fined suggests they just kept everything, far beyond what they had to keep.

According to the annual report (https://www.zaftda.de/tb-bundeslaender/berlin/695-tb-lfd-ber...), N26 used to add all former customers to a black list, which is not allowed if there is no suspicion against them.

>>Eine schwarze Liste für ehemalige Kundinnen und Kunden, gegen die keine Verdachtsmomente bestehen, ist rechtswidrig.

translated with deepl: >>A blacklist for former customers against whom there is no suspicion is unlawful.

At the time of the GDPRpocalypse last year, there were a lot of discussions here, and a lot of FUD being slung around about how if your US website wasn't 100% GDPR-compliant you'd be handcuffed if you set foot in an EU airport bla bla bla, or that minor infractions would incur the maximum penalty of millions of euro, bankrupting your awesome adtech startup bla bla bla. Most of it was fueled by the clash between US and EU jurisprudence, the legal systems are actually pretty different.

Some of us argued that no, this is not the apocalypse, the law says that fines will be proportionate, and the various national agencies will work with you to ensure you are compliant. And unless you willfully do the kind of shady shit the law is meant to protect against, you're fine.

Seems we were right. This list looks pretty sane to me, with one exception.

250k€ for using the microphones of all users of an app to spy and determine if they were in a pub that showed football matches without a license. Fuck yeah.

400k€ for a hospital that had effectively unrestricted access to all patient files for all staff. Yes. What would the HIPAA-equivalent fine be?

1400€ for a police officer abusing systems doing lookups for personal gain. Yes.

170k€ for a school district allowing public access to personal data of all minor-aged students. Yes, yes, yes.

The one exception is the fine on Google in France. This is purely a political bullshit game over control and loss of control.

> Seems we were right.

Arguably, and so far.

There are sites that just block requests from the EU, there's a difficult-to-measure chilling effect on small businesses, and just because nobody's been hanged over it in year one doesn't mean it won't be abused, oppressive, or have other negative unintended consequences in the future.

> There are sites that just block requests from the EU, there's a difficult-to-measure chilling effect on small businesses

food safety regulations have a chilling effect on businesses that would try and sell arsenic-laced food.

dumping poisonous byproducts of a manufacturing process in a river will also net you a stomping by the society, another instance of a chilling effect of regulations.

i'm happy with these chilling effects, they relieve me of the need for constant vigilance. they enable our society to function. we do not need to fear for our mental of physical health and (private) lives all the time, we can focus on higher-order things instead.

I feel differently about it, but I think that's totally fair. Just pointing out that it's not quite the case that opponents' predictions turned out to be wrong.

Some did, at least for the first year. But some haven't.

> There are sites that just block requests from the EU

The only sites that I've seen with this are local US news sites that don't even have to follow GDPR.

Could you elaborate on why you think they do not have to follow GDPR? Do you think they can continue to track all their visitors as before, including the odd EU citizen?

Something I often see in discussions about GDPR on HN is that the law is vague. A hugely valuable comment on a previous GDPR discussion (which unfortunately I've been unable to track down) pointed out a marked difference in style between US and EU law. In the US, laws are usually very detailed and explicit about what will happen in all cases. If that's what someone is expecting, EU law is indeed very vague - because the underlying idea is that judges are trusted to interpret law in the context of constitutions, precedent and so on. EU citizens are much more used to this kind of language, so many of the discussions on here are people shouting past each other because there's a more fundamental issue about the way laws are phrased. If you're in the US and want to quibble with the language, please bear in mind the broader context of EU law. And if you're in the EU please bear in mind that people in the US are used to much more explicit legal language. If we all did that some of the discussions on HN about GDPR might be more meaningful.

The other thing that seems to happen a lot is that people are looking for a stick - any stick - to beat GDPR with. The current top-voted comment - https://news.ycombinator.com/item?id=20279249 - is a prime example. These lists of fines often don't give context (which, to be clear, is a failing of the list too) and often when you dig into these things you'll find that the ruling is entirely sensible. People need to give a bit more credit to legal systems than to think "Someone was fined 2000 euros for using CC instead of BCC in his little mailing list newsletter of 150 people in Germany" could possible be true. If a fine seems ridiculous, do a bit of digging before you take a short summary at face value, and you won't be left with egg on your face when people point out what actually happened.

Perhaps this shouldn't be surprising, but what this site makes clear to me is that GDPR enforcement is more lax on major companies than many people expected, and more severe on private individuals.

For all the breathless reporting of how GDPR would ruin companies financially by levying fines on worldwide revenue, there is exactly one fine listed that exceeds 400k EUR. Granted, it's 50MM EUR to Google, but that's still a drop in the bucket compared to Google's worldwide revenue.

On the other hand, commenters below have pointed out that some private individuals have received fines in the hundreds to thousands of EUR for actions such as "using Cc instead of Bcc in emails" and "using a dashcam". I agree that these are privacy lapses but it's pretty unfortunate to see the power of the state used for these purposes rather than bringing serial data privacy abusers in line.

This could be a case of enforcement against large companies taking longer to conduct, given the complex nature of the cases and the resources of the legal teams involved. My understanding is that a lot of stuff is pending before the Irish data protection agency.

That certainly plays a role, especially as soon as courts get involved (or will get involved), see e.g. the pre-GDPR cases against Facebook still bouncing around the Irish court system. Smaller cases can be handled without international coordination, the facts are often easy to determine, ..., which makes them faster to process.

And the rules about international coordination mean other countries have to wait for Ireland in many cases.

This is a good point! Hadn't thought of that.

GDPR isn't in effect for a long time and a big case against Google and similar companies isn't easy. Doing this needs in depth research in the ways they process data and through the terms, which were written by hghly paid lawyers. Doing this right is hard and if the goal is not to make money but to improve privacy there is value in pushing them in a political way over fighting longncourt cases - during which they probably won't change a bit.

Also there is this rule, that primarily responsibility is in the country where the corporation has their European legal headquarters, and for many the tis Ireland and the Irish government prefers getting 0.5% in taxes for those corporations over having issues with them and having them move to Malta or something.

Except that of course it wasn't about "using Cc instead of Bcc in emails" but using CC instead of BCC in mailing lists with hundreds of recipients and also not about "using a dashcam" but using a dashcam illegally, which in itself can imply a much higher fine in some European countries regardless of GDPR. So not as benign as you are trying to make it sound.

I honestly don't see how "using a dashcam illegally" is such a big deal, nor how "hundreds of recipients" on an email are a big deal. The email list seemed to be just rants.

I wish they would tell what the harm of both of those actually was.

Traffic tickets don't require harm to be actually done either. It's potentially the same kind of thing, at least for the dashcam case.

But shouldn't the fine then be using the dashcam law and not GDPR?

The analogy was that GDPR fines, similar to other administrative fines (which was the term that had escaped me) like traffic tickets, do not require damage to be shown (although it plays a role in setting the amount of the fine) - unlike e.g. cases pressing for damages, brought by a wronged party, would be.

The law regarding dash cams (if there is an explicit one, I don't know enough about the situation in Austria) might just declare it a privacy violation, and thus defer to the enforcement mechanisms created by GDPR.

Yes, makes sense. I think it case of Austria, there are fines specified for dashcams, so it's interesting they decided to use the GDPR instead.

Interesting one from Spain, accessing user's microphones to crowdsource publicbroadcast violations:

> The national Football League (LaLiga) was fined for offering an app which once per minute accessed the microphone of users' mobile phones in order to detect pubs screening football matches without paying a fee. In the opinion of the AEPD LaLiga did not adequately inform the users of the app about this practice. Furthermore, the app did not meet the requirements for withdrawal of consent.

Glad to see some enforcement. Reputable companies have used resources ensuring compliance. Good to see it hasn't been wasted.

Does anyone know of a similar list for ADA violations?

Many people are complaining about some fines, but here are some others I see that are evidence of this working extremely well:

- A police officer was fined for using his department's tools to get someone's private phone number for his personal use

- A rental agency was fined for leaving renter's private data (ids, etc) open to the public for six months after being notified of the vulnerability

- A company was fined because they were continuously filming their employees at work without explanation

- A political candidate misusing private citizen data for campaign purposes.

- Rental car companies tracking drivers by GPS without notifying them

- Hospital staff having fake doctor profiles to view unrestricted patient data

This is convincing me that GDPR is a great success.

All but maybe one of those looks like it was illegal prior to GDPR, so I'm not sure GDPR is what you're praising.

GDPR unified and clarified all the different directions and laws active in EU member states before. So while most of those indeed were illegal before in one or more member states, all of them are illegal now in all member states. As such, GDPR does not really extend privacy protection de jure but merely helps enforcement by unifying protections de jure and hence allowing for a more efficient enforcement de facto.

Which one, out of interest? I can imagine all of them being illegal in some member state.

Depending on the circumstances (I didn't actually look into it) the rental car tracking could have been done in ways that were at least arguably legal under EU law (though at least several member states had legislation that would have covered that).

Weird there's no fines in UK.

As somebody else pointed out, they're being tracked by the ICO [0]. I think they previously had a blog where they documented enforcement while the UK was still under the older Data Protection legislation but I can't seem to find it.

[0] https://ico.org.uk/action-weve-taken/enforcement/

From what I can see, noe of the fines use the GDRP. They're all for pre-May 2018 breaches, so use the old DPA.

The Information Commissioner's Office maintains a list of the UK fines.

> The ICO has specific responsibilities set out in the Data Protection Act 2018, the General Data Protection Regulation (GDPR), the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.

https://ico.org.uk/action-weve-taken/enforcement/?facet_type...

https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...

The fact that someone was fined for using a dashcam is beyond absurd.

Some countries don't consider public space free-for-all for recordings, and have different balances between privacy and the interest in recordings. E.g. in Germany, legal dashcams require a trigger to keep a recording long-term, so no long-term recordings exist in the normal case, but in the case of e.g. a crash the interest of the car owner in evidence is fulfilled.

So, I assume that recording in public spaces is illegal in general and they make a specific exception to allow dash cams on the conditions mentioned?

The general consensus in the german legal system is that a dashcam that records on loop is not allowed; you basically film people without their consent and with the intent to distribute to third parties (the police) for no good reason (the possibility of a crash).

On the other hand, what is permitted is dashcams with shock sensors and trigger buttons. The shock sensor gives you a good reason (very high probability of a crash).

Using the trigger button is okay if either there was a crash (or something illegal) or if you mask out any identifiable details about the car and person involved afterwards.

Generally, recording public spaces is illegal, if you setup a security camera on your property, you have to make sure it's not filming outside your property in an unreasonable manner (you may be allowed to film the sidewalk, for instance, if you suspect someone is salting your garden out of revenge, but only until you have proof and then you have to make sure to delete all non-essential footage).

Privacy in public space is an important right that doesn't exist in the US.

Do these specialized dashcams keep a buffer? Otherwise it seems both the shock and trigger button would activate too late to capture the moments before the 'crash' which typically are more important for determining the cause.

There is usually a buffer, how much depends on the camera.

It is a weird one in Germany. Generally you can record everything because of a law called Panoramafreiheit, however once you start to have discernible individuals on your photograph/video you need their consent, because individuals own the Bildrecht (”image rights”) to themselves, while you as the creator own the Urheberrecht (”creator rights”). And it needs both for a image to be taken legally.

So you get their written consent, ask them if it is okay or take the risk that they will e.g. see themselves in your movie and force you to take it down. This fits with the general feeling that filming another person without asking is seen as extremely rude.

The key here is that people need to be recognizable, so pictures of crowds usually don’t count.

Certain architects can also forbid circulation of photographed versions of their building if it is central subject of the photograph — but I only know of one such thing.

Note that this all was enshrined in law way before GDPR.

Unless you stick your camera into other people’s faces without asking or plan to distribute your images on a bigger scale you will probably manage without ever hearing about these laws.

>So, I assume that recording in public spaces is illegal in general and they make a specific exception to allow dash cams on the conditions mentioned?

The act of recording isn't the problem but the retention of the data records. If you have no need to keep a recording of a day's video for any purposes, then that falls under the provisions of likely being exploited data (e.g.: being used to build a profile of a person's travels throughout the day, week, year, etc.).

In the sense of the allowances, it's about balancing the need of the data's use (e.g.: in car accidents) versus the privacy impacts to other individuals (e.g.: you post your dashcam footage to YouTube and don't obfuscate faces or license plates).

An example of this, pre-GDPR, was when Google was forced to obfuscate faces and license plates in Google Maps for Street View.

"a man illegally used a dashcam, he was fined 300 euros. It was a camera recording the use of a car from the driver's point of view, which is illegal."

Insane.

Some countries are sane enough to enshrine privacy in public spaces into law, because of the potential for abuse.

This is slowly but surely being eroded also in Germany. Multiple cities are trialling full video surveillance to stop the terrorists.

e.g: Some USA towns have near 100% video surveillance through the Amazon doorbell cameras (Ring) of the town's inhabitants. Some content is publicly available, cops can also request it.

Then Amazon is posting captured video as Facebook advertisements to identify suspected thieves.

https://www.vice.com/en_us/article/pajm5z/amazon-home-survei...

Good. Fuck thieves.

The tricky part is evaluating the side-effects and undesired outcomes and balancing those.

Otherwise any fool can say that we should abolish privacy to punish group because they're bad. And indeed they've been saying that for decades.

Actually he was lucky. Austrian law says the fine should be €10,000. It is not legal to own or to use a dashcam in Austria, like in a few other European countries

Not true. You can have a dash cam, but it has to be the kind that continuously overwrites its own data and only records when it detects an accident. You can also record based on your intent - if your intent is to, say, capture a scenic drive ,then you can do that. If your intent is to just capture the license plates of 1000s of other cars that pass you, you can't do that.

These laws were changed in ~2018 in Austria.

How can a dashcam possibly detect an accident? Wouldn't that basically start recording after the fact and hence be mostly worthless?

The dashcam will record into a, say, 5-minute buffer until the accelerometer registers a high value, at which point it starts writing into a new file (so the buffer becomes a permanent record of the 5 minutes prior to the incident).

That's one way to implement it, one can come up with many others.

Dunno how well this will work if you need to claim that the pedestrian or cyclist just darted in front of you. But then again, maybe you don't want that kind of thing recorded.

Yes, if you hit a pedestrian and didn't brake, dash-cam footage of that would not be helpful to your court case.

Actually, the lack of a permanent recording (barring technical issues easily identified by forensics) would be very helpful... to the person you hit.

There is almost always a button for manually triggering a recording.

Is that legal in Austria?

Shouldn't be any more illegal than recording something with your cellphone (when not in the car) that you are interested with. I'm not quite certain about the legal code in australia but private recordings should generally be exempt from a lot of things.

Accelerometers. How it works is there is something like a 5 minute, constantly overwriting video file. Once the accelerometers detects an abrupt deceleration, it determines an accident occurred and marks the previous 5 minute segment of video as read-only.

No, they are allowed to have a buffer of last X minutes.

According to this 2013 news article it is "up to €10,000": https://helpv2.orf.at/stories/1717004/index.html

It's good to be reminded of how many backwards laws there are in the world. Every country is a little bit fascist and insane and it makes you appreciate the good parts of your own country.

Until you realize the "receiving end" of that: It also means that in those "fascist" countries, you have a right not to be filmed, even in public.

..by private citizens

That's also quite rediculous

That's just a reductionist stance and when you follow that line of thinking to its conclusion then it would mean being illegal to record anything outside of your own house which is ridiculous because people need to film their kids going to the beach or take selfies in the mall. The negative side effects of prohibiting public photography greatly outweigh the positives.

See... and most countries that recognize a right to privacy even in public have found a way to let people film their kids, while still making it illegal to point a private surveillance camera onto a public area (be it from your window or a car).

There is a difference between taking a picture of your kid with someone in the background, and intentionally taking a picture of that person. And turns out that in practice, the law is able to distinguish those two even though technically they're quite similar.

I disagree. I don’t give a fuck that you want to take a selfie. Don’t include me in it, period. I have a right not to be photographed.

Of course... different strokes. That’s why different countries exist.

And I couldn't care less about having that right. I would rather have freedom.

If you view the world from the point of view of [rights I have] vs [rights I don't have], you may as well be a happy pig in a cage. This worldview is in fact fascist, because it implies that the state should "give" you rights (giving you this type of right means taking away someone's freedom).

The opposite view is giving you the freedom to do anything as long as you don't attack someone (physically) or steal from them. If you want to prohibit something you must have good reasons, not "let's give everyone rights" or "it makes people feel bad".

Having a "right to not be insulted" means that you don't have the freedom to insult. i.e. you have no freedom of speech. If you put emphasis on the "right", you view the world like the pig in a cage, if you put emphasis on the freedom side, the opposite.

What's insane, the fact that you can't just go around recording people and cars?

On public streets, yeah, that's kind of insane. It's pretty common for people to have a dashcam running with a buffer so if you're involved in a not at fault accident or someone vandalizes your car, or such things, you have documentation.

Some societies think that tracking people on public spaces isn't acceptable either. I don't know why it would be insane - if anything, losing all privacy because you stepped out of the house is the insane thing.

Insane would be the fact that i cannot use pictures/video taken in a public setting for my personal use. Publicising these pictures/videos are another thing and that is covered by GDPR.

If it's a model with a buffer, it's allowed. What is not allowed is to have lying around hours of footages with licences plates, etc. on it.

Of course, that's why it says "illegally". Those dashcams can be installed legally, and this guy's wasn't legally installed.

Where is info on how to install it legally and why this stupid ban on dashcams when GDPR actually allows it (it made dashcam usage easier in my home country as now you don't have to register as data processor because dashcams fall under surveillance). I feel that this is a bad thing - you have a regulation that covers all EU but some countries have their specific laws overriding it and banning things that are allowed under GDPR.

In public? Something your brain already does?

Yes, that's what's insane.

The same link mentions issuing a GDPR reprimand against a person for using a security camera inside their own home.

Where does it say that? The linked article says "recordings of their house", which very well could e.g. be a camera on the outside, capturing surrounding public space.

(also probably existing law, not GDPR specifically: video surveillance has been fairly strictly regulated for a while)

The one I saw said that the CCTV system in the home was also set up to record other peoples' properties too.

It's not the GDPR that made this illegal. It was most probably illegal before the GDPR, and it was probably enforced by the same agency that now enforces GDPR. The GDPR is an umbrella that covers all the new things it introduced, but also a lot of old things the various national data privacy agencies covered.

Recording in one's own home is exempted under the GDPR[0].

I suspect something broader was involved here.

[0] Article 2(2): "This Regulation does not apply to the processing of personal data [...] by a natural person in the course of a purely personal or household activity"

A prime example where GDPR would apply to a security camera in your own house would be if that camera was used to record renters (including short term rentals e.g. AirBnB) without their knowledge.

For example, I recall reading about cases of renters finding out that the landlord has installed hidden cameras in the bedrooms and showers.

I wonder where the line is drawn when it comes to things like that.

Yesterday I was walking on the side of the road and some girl was half way hanging out of the passenger window recording a video of the scenery. I was able to see her from a few hundred feet away.

Eventually the car intersected with me and I was in the line of sight of the video for a second or 2. Of course I made a stupid pose to photo bomb her video which I found hilarious while continuing my walk home.

But under GDPR, is she technically in violation for recording me without my consent? I can't imagine how any of that could really be enforced. What about all of those Youtubers who happen to record people in a busy place like NYC or Vegas. Do they really get written consent from 400-500 people in the background for 10 seconds of video?

The line is drawn at surveillance of a public place [0] and in this instance only in Austria, as other commentors have pointed out the laws may have changed in 2018 to allow for dashcams that continuously overwrite old footage but I can't verify that. It is not illegal to make recordings in a public place in Austria, although you may have some limitations on what you can do with that footage if it captured other people and those limitations may change depending on what was captured (i.e., whether it was incidental, or footage of a crowd).

In Germany for instance dashcams are perfectly legal, you only have conditions on what you can do with that footage afterwards, for instance posting it on Youtube or social media is a big no-no, and unlike Austria you're likely to get a warning in Germany instead of a fine [1].

[0] https://helpv2.orf.at/stories/1717004/index.html

[1] https://www.derstandard.de/story/2000092017999/erst-vier-str...

This can vary between jurisdictions but in all jurisdictions i know, photographing someone in a public location is always legal and never requires consent. Whether publishing requires consent varies, in the normal case it does for commercial but not for journalistic purposes.

Note that laws written this way usually distinguish “taking photos” from “surveillance” - so mounting the camera on a street corner immediately changes the legal context. This may be why dash cams fall into the surveillance category in some places.

Depends heavily on the jurisdiction. In Germany, there would be two parts to this; Panoramarecht (Right to Panorama) and some general opinions of judges.

Panoramarecht means that the girl can film into a crowd or public space for her own reasons if she wants to. As long as she doesn't put one person in the center of the image or focuses on them in other ways, it's generally permitted.

There is also some more general law handling, if you posed for the picture, judges would generally agree that this constitutes consent to be recorded (a more recent case would the famous Angry German Hat Incident, in which a very angry right-wing man walked up to a camera team to complain about being recorded; the judge ruled that the camera team was justified in recording at first due to Panoramarecht and the man walking up to them, knowing they were recording, rightfully so, constituted consent to be recorded further).

Posing to a camera or walking up to it basically means consent in germany; you noticed the camera and you did take actions that would put you center in the image or make you a focus point.

As far as i understand this doesn't fall under GDPR unless the video is published because of personal use. If she publishes the video, you have the right to ask her to take it down/remove your PII from the video. But there might be additional local privacy laws that change things and GDPR has nothing to do with it.

As we learned from this listing, the video's controller is required to notify the subject that he appears in the video before processing it. If the controller does not have enough information to contact the subject, he cannot fulfill that requirement, and is therefore noncompliant.

I would disagree because "The rules don’t apply to data processed by an individual for purely personal reasons or for activities carried out in one's home, provided there is no connection to a professional or commercial activity." Obviously when you put the video out in the world those rules start to apply (especially if you make money from that - ads etc.). I don't see how GDPR applies if i take pictures on my vacation and show them to my family/friends after (this is purely personal use). Even in case of surveillance (dashcam, cctv) you don't need to get consent from every person, you just need to inform them (signage) that surveillance is happening.

1) We don't know much. GDPR allows processing if it's for purely personal use, so if he's putting it on youtube with ads that takes it out of purely personal use.

2) As the linked news article says, Austria may be getting the balance between cautions and fines wrong, which is why they may face a case in EU.

> In Germany, for example, people use caution instead of punishment - which is why Austria may face an EU case.

Austria has had a ban on dashcams for years, though, so it is not a new thing brought by GDPR.

Another EU country with a similar ban is Luxembourg.

Based on this article [1], it looks like EU country laws on dashcams ranges from similar to the US, to legal but with restrictions on the duration, retention, or use of the footage, to illegal to use subject to fines, to illegal to use subject to prison, to illegal to even own one regardless of whether or not you are using it.

How aware are EU drivers of these differences? Is it well known to those in places with less restrictive rules that their cameras could get them in a lot of trouble if they take them with them when they take a road trip that passes through other EU countries?

[1] https://www.express.co.uk/life-style/cars/998528/Dash-cam-ca...

Don't know dash cams specifically, but it's common knowledge that laws surrounding what's in your car (e.g. emergency kit) vary and you need to check up on that.

It's basically impossible to know. Even laws which should be really clear, such and if and when you need winter tires are not clear.

At the end of March I drove across Europe from south of Spain, and had summer tyres on. The weather conditions were good, so I was fairly confident I would be ok without winter tyres, but a lot of European countries have laws requiring then at certain points of the year.

I knew in my destination country you needed winter tyres until April 1st, but I couldn't find anything clear on all the countries in-between. Austria was actually the toughest, my understanding is their laws are you need winter tires if the road conditions dictate you need them. In some cases snow chains can be used, but not on highways. But this was based on reading English forum posts from 10 years ago, so I have no idea if it's still correct. I tried to find something clear from an official authority (probably doesn't help I don't speak German) or an automobile association website, but couldn't.

No HTTPS?

Yeah, I tried adding it manually and it didn't work. Very strange!

Indeed, very strange. A privacy website that transmits unencrypted?

Domain is owned by https://cronon.net/

Why are there so many violators marked as "unknown"? Is that from the sanction being redacted or the aggregator's lack of information? The header paragraph states that not all violations are made public, but the ones that are made public can also be redacted?

How come The Netherlands does not appear in the list?

A was curious about the dashcam fine so I looked it up and it seems some vary ordinary usages of cameras are violating GDPR:

> It was a camera recording the use of a car from the driver's point of view, which is illegal. Two people were reprimanded for using surveillance cameras for their own home without permission.

I assume "driver's point of view" means looking out of the front windshield? Is this not how dash cams are meant to be used? (On second though perhaps this is a translation issue... the article was in German). And then I assume the surveillance cameras were mounted outside and recorded people in public?

Both of the possible scenarios here seem pretty benign and ordinary by US standards.

Maybe I’m just looking at a wrong place but can you tell me what currency is used in fines? I’m assuming it’s EUR but wanted to double check.

looks like there may be a data entry error for Czech Data Protection Auhtority (UOOU) summaries. they may have mis-spelled authority.

There sure are a lot of political parties, and not many big tech companies in that list.

What do you do if e.g. Instagram ignores your GDPR requests? I have sent them multiple emails about misuse of my personal data and they only replied with a template that didn't address my emails?

You inform your national data protection authority:

https://edpb.europa.eu/about-edpb/board/members_en

Two of these are much more intense than I would have guessed:

>The fine concerned the proceedings related to the activity of a company which processed the data subjects’ data obtained from publicly available sources, inter alia from the Central Electronic Register and Information on Economic Activity, and processed the data for commercial purposes. The authority verified incompliance with the information obligation in relation to natural persons conducting business activity – entrepreneurs who are currently conducting such activity or have suspended it, as well as entrepreneurs who conducted such activity in the past. The controller fulfilled the information obligation by providing the information required under Art. 14 (1) – (3) of the GDPR only in relation to the persons whose e-mail addresses it had at its disposal. In case of the remaining persons the controller failed to comply with the information obligation – as it explained in the course of the proceedings – due to high operational costs. Therefore, it presented the information clause only on its website. According to the UODO this is not sufficient.

So, basically, only use open source datasets that come with contact information for every subject.

and

>The fine was imposed in relation to a data subject's request for data correction and erasure. NAIH levied a fine against an unnamed financial institution for unlawfully rejecting a customer’s request to have his phone number erased after arguing that it was in the company's legitimate interest to process this data in order to enforce a debt claim against the customer. In its decision, the NAIH emphasised that the customer’s phone number is not necessary for the purpose of debt collection because the creditor can also communicate with the debtor by post. Consequently, keeping the phone number of the debtor was against the principles of data minimisation and purpose limitation. As per the law, the assessed fine was based on 0.025% of the company's annual net revenue.

You can't just retain the database rows pertaining to accounts with current or likely litigation, but must choose the specific fields relevant to the nature of the dispute. Even the companies that successfully implemented propagation of deletion across their systems are probably going to get spanked for this one when some column in some backwater warehouse backup isn't strictly necessary for the precise claims in that account's lawsuit. Wow.

I hope this puts to bed suggestions that others were "overreacting" to GDPR, that there would be anything other than the meanest, most aggressive, most literal application to every case. Maybe this is a good thing! Maybe everyone needs the fear of God put into them. But I hope GDPR boosters who went around minimizing the threat to good-faith actors admit that they were wrong.

RE first example, read the linked official report[0]. Some choice quotes:

"the company did not meet the information obligation in relation to over 6 million people. Out of about 90,000 people who were informed about the processing by the company, more than 12,000 objected to the processing of their data."

"In the relevant case, the entity had postal addresses and telephone numbers and could therefore comply with the obligation to provide information to the persons whose data are being processed. Therefore, this case should be distinguished from another case decided by the Polish DPA a few years ago, when another company did not have such addresses at its disposal."

"The President of the Personal Data Protection Office found that the infringement of the controller was intentional, because - as it was established during the proceedings - the company was aware of the obligation to provide relevant information, as well as the need to directly inform persons."

"While imposing the fine, the authority also took into account the fact that the controller did not take any action to put an end to the infringement, nor did it declare its intention to do so."

This is precisely the kind of crap GDPR was meant to address, and I very much like the decision made here.

EDIT: If I'm Googling correctly and found the correct company, then here's an extra irony: they actually offered services and advice to companies in preparing for GDPR coming into force. It's safe to say they were fully aware of the obligations under law when they performed data mining on government databases of entrepreneurs.

[0] - https://uodo.gov.pl/en/553/1009

> But I hope GDPR boosters who went around minimizing the threat to good-faith actors admit that they were wrong.

What? No. Your first example talks about "open source datasets" -- no such thing exists for my personal data. If you've gathered my data you need to tell me why you gathered it. Dumping it into a dataset for other people to use is clearly not ok.

Your misdescribe your second example. Notice the company weren't fined just because they had the phone number. They were fined because they had the phone number, they were asked to delete it, and they declined to delete it. The company were not claiming they couldn't erase the phone number because it would be too hard. They were trying to say that they wouldn't erase it because they needed it for debt collection. The regulator disagreed.

Neither of these are good faith actors and these are exactly the kinds of data misuse I wanted GDPR to handle.

Does enforcement changes behavior? I guess the time will tell. But I do expect some insurance companies start selling GDPR coverage policies soon.

Contracts to insure against legal fines are considered immoral and therefore unenforceable.

You can get liability insurance, but that's different (not legal fines but civil law damages).

My guess is that nobody is going to sell coverage for fines that could range up to €20 million that can be assessed under a set of regulations as vague, difficult to follow, and up to interpretation as GDPR.

There's nothing difficult to follow in GDPR... unless you're specifically trying to continue collecting too much personal data while trying to skirt the law.

Oh wow

Germany and this ridiculous requirement:

http://www.enforcementtracker.com/?imprint

If you put a website online you've got to put all your personal information in it.

Not any website. If it is purely private and non-commercial you don't have to.

Also, it doesn't have to be "all your personal information". Your Name is required and an address where you could be served with court papers. A P.O. box is not required, but the address where your company is located is fine. It doesn't have to be your private home address. An email address is required, but that again doesn't have to be your private one. It just has to work. A few other things are required, e.g. where your LLC is registered if it is an LLC.

Which coincidentally is the same kind of information you have to provide for public perusal if you register a company.

> If it is purely private and non-commercial you don't have to.

Unfortunately, this does not include a lot of websites that most people would classify as private. For example, a blog still needs an Impressum.

In addition, you will even be classified as commercial, and therefore require an Impressum, if you don't make any money, for example if you use ads to (try to) pay the hosting cost.

> A P.O. box is not required

In fact, you'll have to pay a fine of usually 5000€ if you use a P.O. box without a summonable address.

A blog is not automatically non-private and commercial.

If you have ads you make money. Just possibly less then you spent on hosting.

And yes that should have read "A P.O. is not sufficent.". Sorry for that mistake.

Your name is more than enough to track you down if you live in a town. A PO box won't help you.

I've got an imprint, including my mobile phone number, on my partly personal, partly business website for about 15 years now. In this time I have not received any calls or unwanted mail on this address. Not a single one in all those years.

Maybe your website is not popular enough. I had a website a few years ago (not anymore) and since then I receive about one call per week of "Microsoft" employees asking me to install some backdoor software.

Well, I can't complain about visitors and views and the resulting business out of that. Maybe I'm just very lucky, but it's not such a big deal as OP wants it to be.

You also need to make the links obvious. The light grey on white they do on that page likely isn't compliant, and neither is their privacy information ;)

What's ridiculous about that?

Everybody can stalk you if they don't like what you've published for example.

That comes with the territory of online ownership. If you want anonymity then pay someone else to host your data.

"Host it somewhere else" doesn't make German citizens somehow immune to German law and their "imprint" requirement.

Reply on news.ycombinator.com