I wonder if anyone who are cheering this fine, actually read and tried to implement GDPR. It is a nightmare to be fully compliant for small companies. It is mostly just a theater (like endless cookie consent dialogs in anonymous browsing), to employ more experts and bureaucrats. EU is now pushing privacy laws that severely undermine privacy.
I did, it is easy, you just don't spy on people and have a point of contact and you're good. It becomes hard when you want to spy on people and also remain compliant with the no spying law.
You can even spy if you want to, just ask for consent
I don't think that logic works. In your vein, if I say " If it gets hotter, I'll want it to be colder" that would imply that if it gets colder I'll want it to be hotter. That doesn't necessarily have to be the case thought. If they made a profit and I want them to pay more than the base fine doesn't mean if they made a loss I want them to pay less than the base fine. I think the rest of your come t stands though. The…
It's not about what you want nor is it about exacting revenge. The end goal is simply a marketplace where a given behavior isn't happening. Appropriately structured fines should accomplish that.
It's a nice theory, but only works if the company gets caught and fined enough times to make a difference. Even a zillion dollar fine is useless if the law isn't applied. Also, when the fine comes out of corporate coffers, not individuals' pockets, there is less incentive to comply with the law. If you really want results, fines should come out of management's personal bank accounts, not to mention some jail time.
As I understand it, this second complaint is not against the original company, but against the government authority that handled his case.
There's two government authorities here, the one he reported it to (Swedish), and the one that the first one forwarded it to (Norwegian). The former is the one he seems to be currently taking to task for failing to follow the law, the latter is the one that meaningfully handled the case.
It's also worth noting that it's not the first time Swedish DPA has been criticized regarding GDPR complaint handling:
https://noyb.eu/en/gdpr-rights-sweden "GDPR Rights in Sweden: Court confirms that authority must investigate complaints. So far, the Swedish IMY has taken the view that users don’t have party rights in GDPR procedures."
https://noyb.eu/en/noyb-takes-swedish-dpa-court-refusing-pro... "IMY frequently just forwards a complaint to the company that illegally processes personal data - and then immediately closes the case without investigating." (no decision on this as far as I know. A bit surprising since it has been almost 2 years)
Went to a new doctor. As part of the check-in process, I was asked to "sign" a little digital pad, so, as I was told, they could properly use my insurance. I asked to see the hard copy of what I was signing and they couldn't find one. Then, for some reason, they were unable to print one. I gave up and scribbled my sig with my finger and then was seen by a doctor. It's maddening.
I'm sure someone smarter than me has a solution. Those papers you're required to sign are generally the result of regulation. Some law got passed that say "you can't share info unless you get signed permission". The person dreaming up the law thought that would be enough to stop getting them to share info. But, even if they cared about privacy, they don't want to increase all their expenses and run their own IT depar…
Many people now have devices with secure storage with them at all times. Maybe it’s time we owned our data and decided who gets it and when.
Obviously this doesn’t work in all situations and for all people, but it’s a start.
There's also issue with EU companies forcing candidates to agree to their anti-privacy policies (confusingly named "privacy policies") as a requirement before the job interview. Those anti-privacy policies will state, that you grant the company and third-parties (so, anyone) permissions to use your data (including voice and image) for any purpose. (Of course, it is stated in a slightly obscure fashion, so a layman ma…
I did, it is easy, you just don't spy on people and have a point of contact and you're good. It becomes hard when you want to spy on people and also remain compliant with the no spying law.
You can even spy if you want to, just ask for consent
Getting consent in a truly compliant way is basically impossible (it should be opt IN, not opt OUT). Though we've trained people to just accept literally everything now.
It's not about what you want nor is it about exacting revenge. The end goal is simply a marketplace where a given behavior isn't happening. Appropriately structured fines should accomplish that.
It's a nice theory, but only works if the company gets caught and fined enough times to make a difference. Even a zillion dollar fine is useless if the law isn't applied. Also, when the fine comes out of corporate coffers, not individuals' pockets, there is less incentive to comply with the law. If you really want results, fines should come out of management's personal bank accounts, not to mention some jail time.
Sure, if the regulator doesn't move to enforce then the law won't have any effect but at least to me that sounds like a problem with the government as opposed to a justification for draconian penalties.
Targeting management seems like a tactic that should only be employed where great urgency exists such as life threatening danger. I don't think marketing material is anywhere close to qualifying.
I hate my inbox being inundated with spam as much as the next guy but that doesn't mean drawing and quartering the perpetrators is justified.
> The reply I received a few days later did me the favour of putting the violation on the record. Their position, in their own words, was that "in order to receive marketing / offers, it is a condition to be a member of the customer club." That one sentence is the whole case. They had taken a right I am entitled to exercise for free and turned it into the price of admission. I don’t understand… it would be one thing…
He was an Elkjøp/Elgiganten customer club member. He wanted to keep the club membership and discounts/offers, but stop the marketing emails. Elkjøp’s setup told him the only way to stop the marketing was to cancel the club membership altogether.
To me, Elkjop seems perfectly reasonable here. But EU policy disagrees.
> The reply I received a few days later did me the favour of putting the violation on the record. Their position, in their own words, was that "in order to receive marketing / offers, it is a condition to be a member of the customer club." That one sentence is the whole case. They had taken a right I am entitled to exercise for free and turned it into the price of admission. I don’t understand… it would be one thing…
Alternative approximate translation: while I urinate on you tell me it's raining.
I understand where he's coming from, but it is still hilarious that he sued the legal entity that won the case for him, after they found the case in his favor.
Seeing that he influenced the creation of the GDPR, the general sense of hopelessness in the rest of the populace, and the failure of the governing body to do it’s jobs - I suppose he is the only person who would be taking people to account.