Hacker News Reader

Comment by unity1001 | Hacker News Reader

Not so since GDPR. GDPR is enforced at every level, including the individual. Whereas 10% of the global revenue of a megacorp only upsets the shareholders a little without ever risking the megacorps power, it can literally bankrupt or starve individuals and small businesses, most of which operate with thin margins.

https://www.enforcementtracker.com/

This trend is similar to how the megacorps block out competition in the US by killing small businesses and making it very difficult to engage in economic or engineering activity through the regulations they sponsor.

This law in particular seems to be the product of the private German interests which at the moment dominate the Euparl. So, yeah, its happening in Europe now too.

View on HN

Per your link, proportionality seems to be working. Big fines are directed towards big companies (cf. Fines Statistics). For individuals (“private person” or “private individual”), it seems they mostly are fined 3-digits amounts, with some in the 4-digits, and 3 at 10-11k.

> proportionality seems to be working

The fine is arbitrarily decided. There isnt anything solid governing the amount if the fine is not % of revenue. So it totally depends on the whim of the regulator. Which is totally in lieu of the principles of civil law that Europe uses. Its more like the common law practice in which the authority can interpret things and can act arbitrarily without solid, inviolable, democratically-made laws governing its behavior.

This may look like working today. Tomorrow you may find it disproportionately hitting whichever segment or sector that the interests behind the incumbent regulatory appointees target.

> The fine is arbitrarily decided. There isnt anything solid governing the amount if the fine is not % of revenue

This is wrong. See GDPR article 83, and https://edpb.europa.eu/system/files/2022-05/edpb_guidelines_...

> This is done by evaluating the classification of the infringement in the GDPR, evaluating the seriousness of the infringement in light of the circumstances of the case, and evaluating the turnover of the undertaking. The third step is the evaluation of aggravating and mitigating circumstances related to past or present behaviour of the controller/processor and increasing or decreasing the fine accordingly

How is 'evaluation' done and who does the 'evaluating' you think...

There is no solid legal directive defined in GDPR regarding static amounts. They hinge on on the regulators' interpretations.

Thankfully, there is still 38 pages left after that quote. You will have a hard time finding a flowchart in a law though…

Anyway, my point was that the fines dispensed nowadays are sensible. As for the future, DPAs know very well that the instant they go rogue, ie. distribute disproportionate fines or misinterpret the law, their decisions will be reversed by an appeal court. It already happened, in fact.

edit: I just read this on the website of my govt:

> The court that sentences the offender is free to set the amount of the fine, but not to exceed the maximum amount set for that offence.

Turns out judges here have even more leeway than my DPA! The finepocalypse should come any day from now. And don't get me started on courts of assizes.

The static fines' maximums are defined in the 'Legal Maximums' section. The other 38 pages are not needed. Next time, do read the reference you are sharing.

> Anyway, my point was that the fines dispensed nowadays are sensible.

The sensible fines of today do not guarantee the fines of the future. The precedent concept does not apply to civil law. When an authority is given free range interpretation power like this, the next batch of regulators can interpret it in however they want. Which is in itself a violation of civil law principles.

> ie. distribute disproportionate fines or misinterpret the law, their decisions will be reversed by an appeal court

No Open Source contributor will risk getting such a fine, then going through a lengthy court battle to revert it. They will just stop contributing.

Good afternoon.

> in which the authority can interpret things and can act arbitrarily without solid, inviolable, democratically-made laws governing its behavior.

A speeding ticket has a fixed fine, anything more complex than that has some level of arbitrariness.

This is how things work in pretty much every other country of the world.

And of course fines are appealable, etc

Reply on news.ycombinator.com