DPO has been thoroughly refuted in this thread. He doesn't need a DPO; if he wants to hire a DPO that can be him.

This is the furthest thing from true, like almost every single question about this terrible law. Vague law + faceless bureaucracies + universal application + crippling penalties...sounds like a brilliant combo to destroy people’s lives.

as usual, the rebuttal is: there have been this kind of laws in Europe for a decade. For example, if you're operating in Italy and don't provide 2 separate checkboxes for managing personal data directly and indirectly at sign up time you're in breach of the law.

Do you remember many people's lifes crippled by this?

Wait. So, I've had a site where there was only a single checkbox to create an account.

Now, if there was someone from Italy (I don't know, the site's gone for years now, highly unlikely but theoretically possible) does this means I'm a possible law offender and should avoid visiting Italy?

Oh, it also had no cookie banners, too...

Could be, the reason no one was hurt is that those laws weren't actually enforced any much? If so, I believe GDPR's promised to be different.

the GDPR will be enforced by the same entity that was enforcing this before, so why would it be different?

The truth is that obviously the authorities don't have an incentive to come after a minor player.

It's certainly true that even before the GDPR, almost any nontrivial business could reasonably be argued to be violating some mostly-unenforced law. I don't see that as a reason to shrug, and make the problem one step worse.

Selective enforcement of commercial law is a routine tool of unfree states--look at something like the tax charges against The Cambodia Daily. To trust in regulatory discretion is to trust that no government in the EU--a continent that within living memory hosted Francisco Franco, Giorgios Papadopoulos, and much worse--will ever be run by people you disagree with. In the extreme, a dictator can always ignore or rewrite the law; but somewhere in the slide from our present democracy to that, I don't think it's unimaginable that the GDPR could be abused.

I support privacy regulation. I don't see why it requires us to abandon the rule of law.

ETA: Downvote if you trust Viktor Orban, I guess? I'm presuming a strong case of "it can't happen here"....

The EU isn’t a continent, and the dictators you mentioned didn’t control EU countries.

My wording was awkward, but I think the meaning is clear. "...in the EU--the union of countries primarily located in a continent that..." ?

And what am I missing? They were dictators of Spain and Greece respectively. There are millions of people who can remember their rule alive in those EU countries today. What changed in the last fifty years to make a recurrence impossible? Turkey narrowly missed joining, and it's basically there now. Hungary seems well on its way.

The threat of being suspended from the EU and the (potential) economic damage from that? You can’t be a dictatorship and keep the same rights in the union, as per the Copenhagen criteria and Article 7.

[1] https://en.wikipedia.org/wiki/Copenhagen_criteria#Political_...

[2] https://en.wikipedia.org/wiki/Article_7_of_the_Treaty_on_Eur...

Article 7 doesn't seem to mean anything does it?

Spain just crushed a political movement trying to organise a referendum through force. It arrested the leaders and the rest of the EU is helping them catch the ones that fled. They call it a rebellion and state that Catalonia can never be independent.

Not an Article 7 violation, apparently. According to the EU it's merely an internal matter.

Hungary elects a government by a wide margin, it's a popular government, and the government reflects its people's disagreement with EU policies that aren't in any treaties and weren't in anything Hungary previously agreed to. This is apparently a violation of "rule of law" and "not democracy".

The EU's definition of democracy is anything that helps the EU, simple as that.

You are trying to justify a coup. A coup by a minority of the population that has a distorted view of history as a result of years of astroturfing.

So if applying the law is "crushing a political movement", let's crush it all the way. Nobody is above the law.

I didn't actually take sides or try to justify anything, just pointed out the contrast.

However a coup is a military overthrow of a government. What the Catalonians tried to organise is a vote, not a coup.

And Russia considers itself to be a democracy. There's a big gray zone between good government and a self-admitted dictatorship. Smart modern authoritarians know that they need to maintain the pretense of democracy (for reasons like the one you note), and they do a passable job--look at something like Cambodia. That's what makes tools to exert personal power while still complying with the law as written so important.

Why do you think the GDPR needs to give the government that much power? For a simple example: Why is 20M EUR the right statutory maximum? If the regulators would never enforce it, then why does it need to be so high?

Because otherwise some companies might conclude that it is cheaper to continue to violate the law and simply to pay the fine. See Volkswagen, which got fined billions for violating the law (and rightly so), and they're still in business and have not withdrawn from the markets where they were fined. But it looks as if they did learn their lesson (for the next 30 years or so, this wasn't the first time they got caught with something like that).

Volkswagen-sized companies would be subject to the 4% of revenue limit, since that's >20M EUR. That 4% seems high to me, but not insane.

The 20M seems insane to me. If the standard for smaller companies were e.g. 100% of the last five years of revenue plus 50k EUR, then can you imagine a case where it would be cheaper to violate the law and keep paying the fine? That would be a lot less menacing to small, non-commercial or semi-commercial projects.

There is signifiant disagreement to what extent Facebook and Google are compliant.

I'm pretty sure the regulatory bodies are thoroughly and wholly excited to take on Google and Facebook with some hefty fines and clarify the GDPR and how it applies. I can't wait either.

Google and Facebook have financial impacts in complying due to the very nature of their business.

They comply later than everyone else not because they didn’t see it coming or didn’t prepare for it, just that it wasn’t in their interest to do it earlier

I have, just not in this comment. See elsewhere in this thread, it's hard to miss.