So we have a foreign government (to us) that has asserted authority to reach beyond its borders and into our pockets with an absurdly complex regulation, where a single violation would financially destroy the company. Since I don't have $20 million to give to them, and the families of my employees depend on their income for things like food and housing, I have to either carry expensive liability insurance to protect against that, or block EU traffic. For us, and I suspect most other sites on the planet, that's an easy decision to make. I'll take a 5%-10% hit in revenue from the loss of EU traffic and be able to sleep at night knowing that someone in a country I've never been to isn't out there filing documents that have the ability to destroy my and my employees' livelihoods.
I won't go into the minutiae of why it's so easy to violate and why most of the experts we have spoken to agree that being compliant is an uncertain endeavor at best, even if you want to comply, because that would be a very long winded comment. But if you do a Google search, you'll see the gist of the problems.
If you refer to the flowchart on how enforcement is to be handled (notably including referring to "proportionate"), the FAQs on regulator sites, and even the track record of penalties under DPA you'll find this is not the case.
Why there are some who keep wanting to catastrophise this is beyond me.
The section you are referring to that uses the word “proportionate” gives a brief list of suggestions of the kinds of things that regulators should consider when issuing fines. But it no way limits their legal ability to issue maximum or multimillion dollar fines for minor violations, and doesn’t even define “proportionate”. A hardline country like Germany may easily decide that because they so value their privacy, “proportionate” is a maximum fine for a single violation.
Anyway, "proportionate" isn't as ill-defined as you claim. It's a term of art used in many laws and we (and the courts) know pretty well what the legislator meant with it. Heck, they even list some criteria. If those aren't fulfilled a maximum fine isn't possible. Also, "proportionate" implies that a more severe violation must have a higher fine meaning the maximum can hardly ever be reached.
A law isn't code and shouldn't be read as such.
Yes, they could, as is clearly stated within the text of the GDPR. Regardless, most websites outside the EU aren't going to want to put up with the headache, and will block EU traffic. Who wants the risk?
For example, "due regard shall be given to" has a very specific meaning with decades of precedent and does not mean whatever pops into a layman's head when reading the text.
Can you please quote the "concrete points" made in the parent post?
> the extraterritorial reach, and the absurd maximum fines that can indeed be assessed for a first, single violation
As I said in my comment, I don't think those are big issues if you comply with the law (and 99% of the law is common sense or was already in place in most countries), but they are points that a lawyer might indeed have brought up.
Might be a good opportunity to make some contacts in the Trump administration too, who will be interested in asserting US sovereignty.
That's a big risk, given the size of Europe and the fact that it the US is your current target demographic, it's not a far stretch to think Europe might be, too.
Blocking the EU effectively means the same thing, though, because it's announcing to everybody that you're ignoring that market and leaving the door open for companies who can copy your business model but are willing to respect user's privacy. Not to mention the reputation damage from snubbing their privacy laws. The door's still technically open, but it's going to be much more difficult.
I also wonder if this kind of announcement will backfire a bit for these companies. When I see a "We're dropping the EU over GDPR," article, I don't think about how bad the GDPR must be, but instead I wonder what shady activities these companies are doing that makes them unable to comply, and that makes me avoid them.
The general public are pretty clueless on these things (look at the surprise around Facebook lately), but I do feel it'll cost them some users.
The law has a bunch of unintended consequences that are about to be unleashed. Or maybe, they are consequences that are fully indended: a de facto trade barrier against non-European companies who’s own laws conflict with GDPR.
They are. You just need to tell them what you want to do with their data, and then do what you told them you were going to do. And not something additional ("oh hey look at all these IP addresses stored for security purposes, I bet we could make funny graphs about Bob's sleeping schedule too!") That is apparently too hard for many companies, so now this is codified in law and can actually be enforced.
There are some additional clauses like right to view your data, correct it if incorrect, and remove it if there is no longer a need for it... but that has existed in Dutch law since 2002 and few people ever exercise it. I recently did for the first time when I found out someone was doing WiFi tracking based on MAC addresses (I didn't remember giving consent), and I got an email from them (which looked like it took 15 minutes to look my data up and type it out), so it's not such a big deal.
How can we be required to delete IP addresses in our logs yet also be required to keep access audit logs for 7 years.
A bullshit law written by people that assume everyone is Facebook and data mining.
I don't know where you got this idea, but I strongly suggest you find someone who has experience with the GDPR and discuss this with them. These two things are not even remotely close to any grey areas that could land someone in hot water.
Then you may well be able to rely on the Legal Obligation basis for processing, namely that “processing is necessary for compliance with a legal obligation to which the controller is subject.”
To be honest, for better or worse I kinda tuned out your indignation at the intricacies of maintaining compliance the moment I saw "HIPPA". HIPAA - the Health Insurance Portability and Accountability Act.
Just how many Europeans would you have with US therapists? Besides, the GDPR specifically mentions data that is already covered under other privacy mandates.
IANAL but from what I read and heard (indirectly) from lawyers at work this is not a problem. GDPR doesn't apply to data that you are required to keep for other legal reasons.
The only new thing seems to be higher fines and aligning laws in all EU countries, rather than having different implementations of roughly the same thing. But if you don't comply with GDPR, odds are that you should never have been able to do business with a lot of European countries. To the best of my knowledge, you should have geoblocked the Netherlands long ago (the only country I know the laws well enough of, to say that there is truly only a small difference between the 2002 WBP and the new GDPR) if you have to close to the EU for GDPR.