Hacker News Reader

Comment by tomalpha | Hacker News Reader

I can imagine they have tight margins. This might be more painful than an apparently small percentage might appear.

Their profit was $1.5B last year. $41M is less than 3% of that. Not nothing, for sure. But the GDPR allows for up to what, 4% of revenue? Their revenue was $24.3B. That would have been $970M in fines then. H&M got a slap on the wrist. Just like all the other companies before them.

To me it seems like a strong warning since it's a "first time offense". Not too high so as to break the company (and say push it to exit the German market). But significant enough to make sure they don't do it again. My guess is repeat offenders will get higher fines.

Nah, for example Google/Alphabet is a continuous offender ever since GDPR become enforceable and was already fined 3 times according to https://www.enforcementtracker.com/

GDPR is not supposed to kill companies but to make the respect the law and this fine is a warning shot. If H&M ignores GDPR again, the fine will be significantly higher.

How would fining even _100%_ of their profits for this year kill the company? It'll annoy the shareholders who don't get dividends this year. Maybe they should take more notice in future.

Note that this is 2% of profits, not revenue.

Compare this to the average German citizen. It would be 2% of the amount they manage to save, not 2% of their income. That would be 2% of about €4500, or €90. [1]

That's a parking fine level.

[1] https://www.bundesbank.de/resource/blob/617492/cd59713c156ad...

Where is that stated? As a European I would very much expect GDPR to send home the companies who can't play according to the laws.

If they fix themselves after the first fine, killing them would’ve been worse. That’s why it isn’t supposed to do that. For the repeat offenders, they can be fined up to 4% of the profit. If that 4% still doesn’t fix you up, you’ll be fined again and again until you either fix yourself or are killed. So it’s working as intended.

Actually it could be 4% of the revenue IIRC. And that can definitely company-ending. Of course that should be an endgame.

Google recently introduced yet another opt-out nagbox. It shows up for example on search and youtube. Non compliant. Repeat offender. What should be the right course of action? As far as I'm aware GDPR was not supposed to be another Cookie Law, it is not working as intended.

Reply on news.ycombinator.com