But whether or not that it is true, I believe that if Europeans have used Instapaper and they now temporarily shut off access they still are not compliant and in violation of the law. Because they did serve Europeans, so they have their data.
> It’s an evolutionary process for organisations – 25 May is the date the legislation takes effect but no business stands still. You will be expected to continue to identify and address emerging privacy and security risks in the weeks, months and years beyond May 2018.
> That said, there will be no ‘grace’ period – there has been two years to prepare and we will be regulating from this date.
> But we pride ourselves on being a fair and proportionate regulator and this will continue under the GDPR, as I set out in my first myth busting blog. Those who self-report, who engage with us to resolve issues and who can demonstrate effective accountability arrangements can expect this to be taken into account when we consider any regulatory action.
Since GDPR compliance is enforced by EU members, many small companies are exposed to (have customers in) most or all EU jurisdictions, and the EU is very heterogeneous when it comes to regulatory enforcement by member states, I think that they're correct to be worried about the ambiguity around the GDPR.
I'm not arguing against the GDPR - I'm in favor of data protection - but the if/ands/and buts (e.g., speculation) about who is going to get fined, and for how much, is uncomfortable.
Gross, wilful, intentional, deceptive non-compliance. To be honest you have to put quite a lot of effort into managing to get fined for non-compliance with EU regs/dirs.
EU directives are transposed to member states, who are the ones who enforce EU policy. If you're talking about EU members getting hit for non compliance with directive implementation - sure. If you're talking about private sector non compliance with transposed EU directives, that's largely up to how individual member states enforce EU requirements, since EU directives effectively become separate laws once they're transposed by each EU member.
As far as I'm aware, there's little aggregated data on how individual member states enforce (as in, number of cases and total amount of fines per year) EU directives. The EU takes in ~4-5 billion Euros per year in assessed fines, but the total amount should be significantly higher once you account for all of the cases/fines that are assessed on private companies, by individual member states, for non compliance with individual state laws implemented to enforce EU directives.
A lot of the responses to the GDPR shutdowns have been like this - "you don't need to shutdown, because you won't be fined yet."
But I have to ask, isn't shutting down a better alternative to knowingly breaking the law? Weather the fine is $2 or $20M, shouldn't following the law be most important?
And who's to say that Instapaper did not contact the authorities and discuss a plan such as this to mitigate the problem temporarily?
If that's the case, why can't they simply tell this?
I side with the GP: Preventing access doesn't absolve you from complying with the law.
The big thing with shutting the site down is it might make it impossible for users to request information about their data and/or request to have it deleted. That would violate the GDPR and could land the site in trouble.
More or less everyone has given up on following the letter of the law on copyright and has resorted to all sorts of "fair use" ideas that probably wouldn't stand up in court.
Instapaper makes copies of web pages. Does it have permission from the copyright holders for every copy of every web page? No. Are they going to enforce this? Almost certainly not.
Working into getting compliant and have a paper trail to demonstrate how you are progressing in case of control is the only realistic way to do it. That's exactly what a lawyer (in my country of course, perhaps not applicable to other countries) advised me to do. And this lawyer works closely with the public institution doing the enforcing in my country.
From my understanding, I'd be surprised if even 1% of companies were fully compliant today. Yeah, even big ones like Google (I actually spotted something I'm almost certain is non-compliant yesterday on their TestMySite service).
Don't be mistaken, the mails everyone receive about changes of terms for the GDPR and validating consent to receive newsletter are just the tip of the iceberg, they are the easy cosmetic changes.
If I understand correctly what law is, I would say that lawmakers make some laws to express what is moral and what's not (according to them), but not always it's true that our moral standards are completely different from the lawmakers'. If the objective is to be moral, then we should ditch contradicting laws.
But I agree with you, the way most interpret the regulation and its sanction is not how Europeans do laws. The "administrative fines up to ..." as you can read in the text http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... Those high fines are meant for large ill-meaning companies, but the small 2-ppl-SaaS that doesn't report or act on a data breach will get a slap on the wrist and a fine proportionally to their size.
I can't say for sure what's the scope, but I stand by my point that PART of it have a delay to get into conformity.
If you're not compliant, but aren't deliberately not compliant, and are active in trying to address that, and report anything you might be breaching, then they're not going to go after you like hounds (in the UK at least).
The ICO seems to be a fair and reasonable body, they just now have some extra teeth.
Currently GDPR is news and there's a lot of hype around it and Instapaper is getting some attention because they failed to prepare AND, by the looks of it, decided to implement some unnecessary measures.
I'm sorry to say that this looks like a PR stunt. Are they going to block EU users for months? I think any legal action against them was very unlikely, they could have solved the situation quietly.
Can you point to the section of the legislation that says this? It would probably go a long way to stopping folks from freaking out.
BTW: our privacy counsel, at a very good law firm, rates France as amongst the most aggressive of the regulators, given to assessing large fines.
The law is enforced by humans, not robots, and those persons have a culture and habits.
Of course I could be wrong and they could start enforcing heavily on everyone on day one.
But they just don't have the manpower to do that, for starter. And that's just not in the culture either. Law is enforced differently in different part of the world. The US is known for punishment. Other parts are focused on redemption.
Because for how the law is written now you could in theory get a 20M fine for the smallest violation, and it's obvious that a lot of companies will be scared of that and will simply cut out European users, especially small companies that don't have money to spend in lawyers and other stuff.
The EU should clarify the situation, put limits on fines based on the company size (it's foolish that a person that has a blog that doesn't generate any revenue risks a 20M fine!), and give a transition period (yes, the law was approved 2 years ago, but what did the Europe to inform companies of that law and so permit them to be compliant in time ? Nothing, given the fact that everyone began to know about it some weeks ago)
As an European citizen I'm really concerned about this law, it risks to cut out a lot of internet services, and that is bad, also now I'm scared to even put Google Analytics on my personal website, because well you know a 20M fine is not a good thing, sure it's unlikely to get it, but in theory you can, and I don't want to risk.
So, no, it's not unlikely, it's definite.
Second, you don't know that - bored civil servants eager to hit targets and get bonuses for scoring big fines could have gone for a low hanging fruit that is small companies without legal teams scared and paying instantly.
Third, as its current state GDPR doesn't feel like ready "for production", so why would companies want to implement something with so many unknowns?
(Potential savings or revenue) - (Somewhat easy to calculate cost) * (Difficult to assess risk) = Profit. More or less.
But from my shoes (someone that run a business in the EU, is not compliant right now and is talking to a lawyer), Instapaper decision is a bad risk-management decision.
This move is, in my opinion, a bad read on the odds and European culture.
First, culture. The goal (at least in France, but that's probably the same in other countries) is to get you in compliance, NOT to fine you. What this means is that before you get lawsuit and fines, someone will talk to you and work with you to see how you can get compliant.
Second, the odds. Unless you are a big company that thrives on GDPR violations (doesn't seem to me Instapaper is one, but I could be mistaken as I never used the service), you aren't likely to be targeted before a while, at least until a big case is done and over (let's take the odds Facebook is first).
Third, the delay. While the GDPR takes effect tomorrow, you have a grace period of a year for part of it (for example, getting consent for newsletter). I would really be surprised if enforcement start tomorrow.
Well, at least that's my read on the situation. And that's how I intend to do it: pro-actively work into getting in compliance without rushing it too much, and handle things properly as they come.