Yes, that's the point: at the moment, vacuuming up every bit of data is essentially free, so companies take a maximalist approach to it, and aren't paying nearly their fair share of the resulting externality costs. Personal data storage needs to become costly enough that companies are forced to decide if it's actually worth it.
I would also add that, just like every other time an industry failed completely at self-regulation and just ran wild until public outrage forced the government to step in, this wouldn't be happening if companies had been responsible. But CA and Experia and Unroll.me proved that was never a possibility.
IMO, it's that a) people in EU care more about privacy and b) the political influence of the data processors in question isn't as strong as in the USA.
b) (with swapped roles) is the reason why the diesel emissions cheating and the FIFA bribery cases were investigated in the USA. They were open secrets, but nobody did anything about them in their countries of origin because of regulatory capture.
The other thing is that the EU parliament has some internal political shuffling that most people aren't even aware of. I don't know anybody in real life that can name even one of the parties (or groups) in the EU parliament. It's very difficult to say that they're definitely doing what the people want.
>How do you think that GDPR is the optimal way to achieve... Well, what exactly are you saying is the goal? You are only alluding, thus letting everyone complete your argument with whatever they may find most credible.
Simply make it more difficult for established/outside companies to target the EU market. It's not a conspiracy, so there isn't like a step by step plan that could be taken by the EU to actually do this. Only some people and groups in the EU seem to be really interested in something like this.
You can't ask them for advice either. They'll tell you that they're there for enforcement.
"The lower level of fine, up to €10 million or 2% of the company’s global annual turnover..."
That could crush smaller companies, but for large companies it's a slap on the wrist.
This is straight from Article 83 of GDPR: "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher"
Moreover the next fee level is: "20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover"
Data brokers in Vermont will now have to register as such with the state; they must take standard security measures and notify authorities of security breaches (no, they weren’t before); and using their data for criminal purposes like fraud is now its own actionable offense.
It defines data brokers as businesses in Vermont that buy and sell data on people with whom they have no direct relationship. Seems like a reasonable law - unlike GDPR, they aren’t trying to reach outside of their jurisdiction, they aren’t trying to wipe out entire business models, there are no absurd fines, it’s easy to know if you’re violating it (because you would know that you have setup a data brokerage in Vermont), etc. My guess is there are only a handful of “data brokers” as they define that term within Vermont, so this affects very few people.
Some excerpts that define some key terms:
"(2) "Business" means a commercial entity, including a sole proprietorship, partnership, corporation, association, limited liability company, or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, charterd, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent, affiliate, or subsidiary of a financial institution, but does not include the State, a State agency, any political subdivision of the State, or a vendor acting solely on behalf of, and at the direction of, the State.
(3) "Consumer" means an individual residing in this State.
(4)(A) "Data broker" means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship."
They use the broad definition of a “business” because in the US you can be incorporated in Delaware and actually operate in Vermont. This is actually a common thing - most US corporations are incorporated under the laws of either Delaware or Nevada but operate within their home state. But the state only has the ability to regulate the actual operations of businesses operating within Vermont.
Data brokers are scum. They do not produce any value, they do not improve the society, they have no positive effect on anyone. No reasonable person should stand up to protect them from liability.
The scary part is the big companies will have the money to lobby for regulations to be written in a way that is easy for them to comply with while shutting out smaller companies and startups.