The exception being: there is no minimum for fines. So a small company could be fined absolutely nothing for an infringement if it was representative of the harm caused or they fixed the issue.
Also. Security representatives--actually called data protection officers--are only necessary at large scale or highly sensitive operations.
The law is being applied gradually. It is already in effect and has been for two years. The approaching deadline is when the penalty clauses will come into effect. How it will be applied remains to be seen, but has no bearing on the validity of the legislation itself.
It is pretty clear what streetlend needs to do to be GDPR compliant: if the user data is actually being sent to the third parties (the ad networks) then users need to explicitly be told this. If the data is not being sent to third parties then users already consent to their data being stored by entering the data (the data is necessary for the performance of the service operated).
Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints).
As for the geography: if your interaction with European citizens is incidental and not purposeful, you cannot be charged under the GDPR. It is only if you are actively trying to target your goods or services to the European market that they will enforce against you. This is obviously the case since they will have no power to enforce the law otherwise, but it is also covered by the three paragraphs of Article 3.
> Next to that: allow users to delete their data when they close their account (this should be as easy as setting cascade on foreign key constraints).
That is definitely not easy and doesn't work like that. That's why it's common practice in any serious system to have 'deleted' flag instead of actual deleting.
> It is only if you are actively trying to target your goods or services to the European market that they will enforce against you.
Yes, and if you target whole world like most sites in the internet do, you're targeting Europe?
GDPR is highly vague omnipresent regulation with huge strict fines. It's like infamous cookie law times a million.
They could make it into a good law, my opinion on what should have been done:
Keep good parts, such as:
- Appoint official 'security' representative who're responsible for breach disclosures, promoting security practices etc, that person can be personally held responsible for shifty company behavior (though nothing draconian) like non-disclosing a breach, so they would be motivated to be on user side in the company.
- Let users ability to download their own data
- Let users clear way to tell company that they want to stop using their account (and related data gathering)
- Mandate more open disclosure of what is done with data gathered from users
And also:
- Mandate easier ways to review EULA and changes to EULA (like each change should be available separately, describe what changed and why)
- Create system of centralized disclosure of security vulnerabilities by third parties, with record showing request and response publicly after some time. Maybe also create some system of grants for third party penetration testing for larger players in the internet.
- Split available data into categories, like 'non-sensitive data', 'sensitive data', 'highly sensitive data'. Medical records, financial records etc is highly sensitive and higher standards are applied. Email and name is non-sensitive data (so you could run a simple forum, or any other simple free service, where you only want email from a user, without being afraid).
- Split companies into tiers, under 50 employees or 100000 users nothing applies; 51-1000 employees higher standard applies; over 1000 - full power applies. This also should be tied with previous point - for example, smallest tier company should still be responsible for some rules if they deal with highly sensitive data, and if it's largest tier company they should be following some rules even if they only deal with non-sensitive data.
- More sensible fines. For example 1% or $100k, whichever is smaller for the first time, 2% or $1m second time etc. Designated security officer can also be held responsible in the same manner (like, % of salary and later being forbidden to work as a security officer). It can also be tied to tiers of companies.
- Start applying law gradually, beginning with just applying it only for european countries.
I believe that would keep benefits for users and won't create giant problems for the industry as a whole.