Hacker News Reader

Comment by Ansil849 | Hacker News Reader

Corporations treat fines as cost of doing business. In order to actually be effective, there need to be mandatory minimum prison terms for C-level staff who greenlit a particular program.

View on HN

Depends. If you make the fines company-changing, then they can work.

I'm also all for throwing C levels in jail ALONG WITH the board as well. They want to benefit and sign off on choices of the company? They can also hold said responsibility on illegal stuff.

I do agree that there needs to be more personal accountability, although I think the bigger issue here should be people in the finance world. Some of the fines have been quite large and do serve as a deterrent. H&M was fined 35 million EUR, which is a sizeable number even for a firm their size.

The total amount of all GDPR fines ever (all 907 of them) is ~€1.5 billion [1]. Google's revenue for 2021 alone, was €230 billion [2].

Fines may deter small and medium-sized corporations, but not large ones. Therefore something else might. Like prison.

[1] https://www.privacyaffairs.com/gdpr-fines/

[2] https://www.statista.com/statistics/507742/alphabet-annual-g...

How about making fines commensurate with company revenue?

That and a wildly escalating pay scale for reoffenders.

Or, just a lot bigger fines would probably work.

The maximum GDPR fine is 4% of previous years revenue, or in the case of google $3Bn.

The maximum is 4% or €20M whichever is HIGHER.

So, for a one-person startup, €20M means game over.

https://danuker.go.ro/gdpranoia.html#fines

I wouldn't be surprised if that "or" clause was added specifically to kill one person post box companies that only exist to carry the risk. Big Tech is very good at throwing empty shell companies at problems that involve paying money, like taxes.

This has never been applied and will never be - GDPR enforcement is a joke.

The combined amount of fines across all companies over the GDPR's entire 4-year lifespan is just 1Bn.

there's a transition period. We can't start enforcement with the maximum available penalties.

If the lower don't suffice, we will get closer & closer to the maximum.

The transition period is getting a bit long now and companies are still making billions on violating the GDPR.

Reply on news.ycombinator.com