GDPR Enforcement Tracker | Hacker News Reader

GDPR Enforcement Tracker

enforcementtracker.com

57 pointssturza20 comments

200EUR The private person used a dashcam to make recordings of public road traffic and then published them on YouTube as a compilation.

Who has free time to identify the driver and do a court case against him/her? And where did the 200EUR come from? Court cases are more expensive than that and it has the effect of mattering only to unwealthy person.

Yeah thats some bullshit. You should have no expectation of privacy in public, especially regarding publicly visible vehicle tags. I could see if someone was specifically collecting vehicle tags ALPR and posting videos of them all, but a normal dashcam needing censored?!

> You should have no expectation of privacy in public, especially regarding publicly visible vehicle tags

That's not how European privacy framework work at all... You cannot just randomly share personally identifiable information. In Germany Google is forced to blur any PII data such as vehicle tags, or even full houses. It's the same for other platform.

See here for the Google Street view case: https://bits.blogs.nytimes.com/2013/04/23/germanys-complicat.... Or this one, more recent: https://www.inverse.com/article/32886-google-map-privacy-var....

I know, I'm disagreeing with that framework. There is no easy way to correlate vehicle tags to a real person's name for an average person. Banning video of anything that might include a vehicle tag is just burdensome and dumb.

Also, that's way different than say banning the use of ALPR by companies. I wouldn't be as opposed to that as its happening in mass.

Nice, although I did find this one for 560EUR:

``` Fine imposed on Forbes Hungary for publishing a list of the 50 wealthiest Hungarians and a list of the largest family businesses without a sufficient balance of interests (Art. 6 (1) f) GDPR). ```

What do they mean by 'sufficient balance of interests'?

Under GDPR, companies must have a legal basis to process personal data. Processing personal data without a basis specified in law is illegal. One of those legal bases is that processing personal data is "necessary for the purposes of the legitimate interests pursued by the [company]". For companies that chose this as their legal basis, they must conduct a balancing test between the benefits provided by the processing and potential impact to individuals whose data is processed.

If you don't do that balancing according to the whims of the data protection authority, your data processing will be a violation of GDPR.

If you don't have documentation of that balancing, the authority will presume you did not do any balancing, and therefore your data processing violates GDPR.

I'm guessing that means the court found the public's interest in knowing did not outweigh the listed people's interest in privacy

Outweighed to €560 extent

This should read “GDPR lack of enforcement tracker”.

I see no major fines for neither Google nor Facebook (the latter was only fined once on a technicality that has nothing to do with their tracking efforts).

Are you not seeing the 50 000 000 EUR+ fines to Google [1][2][3] then just sort by size of fine

[1] https://www.cnil.fr/en/cnils-restricted-committee-imposes-fi... [2] https://www.datainspektionen.se/globalassets/dokument/beslut... [3] https://www.autoriteprotectiondonnees.be/publications/decisi...

Smaller fined for regular companies will have much more of an impact. Companies will realize the too can be targeted.

Don't know why you are downvoted. This outcome was obvious from the beginning. Europe’s GDPR enforcers do not have the capacity to investigate Big Tech, just small fishes.

Google and Facebook love the GDPR, they have the resources and lawyer to circumvent the spirit of the GDPR. Their smaller concurrents do not.

Big claims, any specific sources on the “love”, lack of capacity to investigate bog tech and “circumvention”? Also, maybe you missed all the google and facebook fines in the link.

Every time EU fines some US. tech people claim that EU is picking on them specifically.

They are probably cleaning their house, before they go after the big guys.

Its the right thing to do.

Honestly just block all EU traffic with iptables and the geoip module.

Life doesn't need to be like this if you have no business there.

As someone in Europe, I second this. If your website is so invasive that it's too burdensome to comply with extremely reasonable privacy rules, I don't want to accidentally visit it.

My issue is mainly with the unintended consequences, the notifications and such rather than actually respecting reasonable privacy

I run a bunch of websites with none of this nonsense and as such don't need to bother inserting an annoying interstitial for millions of hits telling people about laws in a world far removed from my own or theirs.

Or just don't care if you are not on EU. I don't think there is clause for something like denial of entry or arrest on arrival.

Reply on news.ycombinator.com