Hacker News Reader

Comment by Traster | Hacker News Reader

It's worth noting that this is exactly what GDPR is meant to stop. Specifically, if they take your data they need consent and they need to be upfront about what they're going to use that data for. So if they say "Hey, would you like us to store this data for auto-complete" and then take it and use it to create a google pay account, then they don't have consent and can be fined.

View on HN

Corporations treat fines as cost of doing business. In order to actually be effective, there need to be mandatory minimum prison terms for C-level staff who greenlit a particular program.

The maximum GDPR fine is 4% of previous years revenue, or in the case of google $3Bn.

This has never been applied and will never be - GDPR enforcement is a joke.

The combined amount of fines across all companies over the GDPR's entire 4-year lifespan is just 1Bn.

there's a transition period. We can't start enforcement with the maximum available penalties.

If the lower don't suffice, we will get closer & closer to the maximum.

The transition period is getting a bit long now and companies are still making billions on violating the GDPR.

The maximum is 4% or €20M whichever is HIGHER.

So, for a one-person startup, €20M means game over.

https://danuker.go.ro/gdpranoia.html#fines

I wouldn't be surprised if that "or" clause was added specifically to kill one person post box companies that only exist to carry the risk. Big Tech is very good at throwing empty shell companies at problems that involve paying money, like taxes.

I do agree that there needs to be more personal accountability, although I think the bigger issue here should be people in the finance world. Some of the fines have been quite large and do serve as a deterrent. H&M was fined 35 million EUR, which is a sizeable number even for a firm their size.

The total amount of all GDPR fines ever (all 907 of them) is ~€1.5 billion [1]. Google's revenue for 2021 alone, was €230 billion [2].

Fines may deter small and medium-sized corporations, but not large ones. Therefore something else might. Like prison.

[1] https://www.privacyaffairs.com/gdpr-fines/

[2] https://www.statista.com/statistics/507742/alphabet-annual-g...

How about making fines commensurate with company revenue?

That and a wildly escalating pay scale for reoffenders.

Depends. If you make the fines company-changing, then they can work.

I'm also all for throwing C levels in jail ALONG WITH the board as well. They want to benefit and sign off on choices of the company? They can also hold said responsibility on illegal stuff.

Or, just a lot bigger fines would probably work.

Someone will quickly point out that this is exactly the advantage American startups have over European ones.

Reply on news.ycombinator.com