Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR Enforcement Tracker: List of GDPR fines

enforcementtracker.com

Post reply on HN
Print view View original

231–240 of 301 posts

Re: GDPR Enforcement Tracker: List of GDPR fines

#231

Post by Radle »

notafraudster wrote: post #42
throwaway13337 wrote: post #3

Wow. Here's an crazy one: Someone was fined 2000 euros for using CC instead of BCC in his little mailing list newsletter of 150 people in Germany. "The fine was impossed against a private person who sent several e-mails between July and September 2018, in which he used personal e-mail addresses visible to all recipients, from which each recipient could read countless other recipients. The man was accused of ten offen…

I support this fine in principle. Maybe not the magnitude, maybe not without a warning, and of course a three liner isn't enough context to be sure. But using CC instead of BCC causes a massive leak of personal information, especially when either the subject being discussed or the people on the list are sensitive. In my life this has mostly been annoyance at large org stuff, but my wife has had this happen with a sen…

There were multiple warnings and the guy was a repeated offender. He had already been fined earlier.

Re: GDPR Enforcement Tracker: List of GDPR fines

#233

Post by Radle »

tomatotomato37 wrote: post #19

It's interesting how enforcement changes between countries. For instance, all the fines in Austria where for CCTV and dashcam use, all of France's fines were against large corporations, and the single fine Italy imposed was on the "Movimento 5 Stelle" political party.

These aren't all fines. Most of them are published by a select few individuals or newspapers with a clear focus of interest.

What you are seeing is french newspapers being especially interested in fines for big corporations, this is without a doubt a direct result of the current political situation in France.

Re: GDPR Enforcement Tracker: List of GDPR fines

#234

Post by TeMPOraL »

throwaway13337 wrote: post #3

Wow. Here's an crazy one: Someone was fined 2000 euros for using CC instead of BCC in his little mailing list newsletter of 150 people in Germany. "The fine was impossed against a private person who sent several e-mails between July and September 2018, in which he used personal e-mail addresses visible to all recipients, from which each recipient could read countless other recipients. The man was accused of ten offen…

Woah. That's great!

In Poland we actually have a sort-of tradition, AFAIK started by one of computer security portals, where if you find yourself on the receiving end of such CC-instead-of-BCC, you kindly tell the company responsible that this can and should be picked up with data protection regulators, and it would be nice if they e.g. paid ~500-2k EUR equivalent to a charity of their choice.

I'm totally 100% in support of this against companies. Less so about private individuals, though a 150-people newsletter is kind of thought-out and organized thing, and then 2k EUR in Germany is probably less than a monthly paycheck. A hard hit, but survivable without loss of life quality.

Re: GDPR Enforcement Tracker: List of GDPR fines

#235

Post by HelloNurse »

DanBC wrote: post #218
downandout wrote: post #82

[flagged]

> What makes you expect this? Unless you and I have read entirely different versions of GDPR, no provision of GDPR requires any warning of any kind prior to issuing fines. It's not in GDPR because it's part of EU law. Two parties to a case need to attempt to fix it before going to court. In the UK this is why you have letters before action setting out what you think your case is, how you want it to be fixed, and what…

It isn't a case between two parties, it's a crime. Do you expect "warnings" for arson or robbery? Then why do you expect warnings for data disclosure?

Re: GDPR Enforcement Tracker: List of GDPR fines

#236

Post by moduspol »

henrikschroder wrote: post #25

At the time of the GDPRpocalypse last year, there were a lot of discussions here, and a lot of FUD being slung around about how if your US website wasn't 100% GDPR-compliant you'd be handcuffed if you set foot in an EU airport bla bla bla, or that minor infractions would incur the maximum penalty of millions of euro, bankrupting your awesome adtech startup bla bla bla. Most of it was fueled by the clash between US an…

> Seems we were right.

Arguably, and so far.

There are sites that just block requests from the EU, there's a difficult-to-measure chilling effect on small businesses, and just because nobody's been hanged over it in year one doesn't mean it won't be abused, oppressive, or have other negative unintended consequences in the future.

Re: GDPR Enforcement Tracker: List of GDPR fines

#237

Post by [deleted] »

throwaway13337 wrote: post #3

Wow. Here's an crazy one: Someone was fined 2000 euros for using CC instead of BCC in his little mailing list newsletter of 150 people in Germany. "The fine was impossed against a private person who sent several e-mails between July and September 2018, in which he used personal e-mail addresses visible to all recipients, from which each recipient could read countless other recipients. The man was accused of ten offen…

[deleted]

Re: GDPR Enforcement Tracker: List of GDPR fines

#238

Post by Angostura »

TomVDB wrote: post #99
comboy wrote: post #94

Earlier quoted context omitted.

> unless you're sure you that can afford making these kinds of mistakes, don't provide a service on the internet DOT sounds good

Everybody makes mistakes. Which makes GDPR a recipe to hand over whatever remains of the Internet to only corporations that afford paying for them.

If you make a mistake and you do so honestly, not out of malice and fix it, you are very unlikely to get a fine - you will get guidance and a warning. Unless you are being egregiously slip-shod.

Re: GDPR Enforcement Tracker: List of GDPR fines

#239

Post by Angostura »

TomVDB wrote: post #206
hdfbdtbcdg wrote: post #167

Earlier quoted context omitted.

Why could GDPR possibly make someone shutdown such a website? Pure FUD. EDIT: Downvotes don't change reality. The OP is spreading FUD. Edit: unless the website was actually abusing users privacy in which case I'm glad it is gone.

You receive an email with a request for a privacy statement? Great, one way or the other, that's work with potential legal repercussion, which means you probably should talk to a lawyer. Additional expenses and hassle for no good reason. You make a fix in the email system that accidentally emails everybody at the same time? (It almost happened.) Oops. There's your exposure to some nice fine. You don't need to be abus…

I'm sorry but every website collecting personal data should set out clearly and simply what it is used for and how it can be distributed. For asmall hobbyist site you don't need a lawyer, there are plenty of decent templates out there.

Re: GDPR Enforcement Tracker: List of GDPR fines

#240

Post by vonmoltke »

Dayshine wrote: post #221
downandout wrote: post #121

Earlier quoted context omitted.

Many, but not all of them said this. Given that GDPR has absolutely no requirement that warnings be issued, it is not reasonable to expect that warnings were issued and/or ignored in cases where it doesn’t specifically say this occurred.

Huh? It does have this requirement: Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each i…

I don't see anything in that text that requires a warning.
Post reply on HN