>The data is all collected from public sources, such as news articles and government filings.
It's exactly the same as Wikipedia; yet nobody calls Wikipedia a "sensitive database."
I mean "So?" from a privacy standpoint, from a business standpoint it's an issue for Dow Jones.
Mostly the sensitivity is in controlling write access rather than read though.
http://lexindicium.com/2018/03/19/data-mining-and-gdpr-compl...
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
Right to:
information about the processing of your personal data;
obtain access to the personal data held about you;
ask for incorrect, inaccurate or incomplete personal data to be corrected;
request that personal data be erased when it’s no longer needed or if processing it is unlawful;
object to the processing of your personal data for marketing purposes or on grounds relating to your particular situation;
request the restriction of the processing of your personal data in specific cases;
receive your personal data in a machine-readable format and send it to another controller (‘data portability’);
request that decisions based on automated processing concerning you or significantly affecting you and based on your personal data are made by natural persons, not only by computers. You also have the right in this case to express your point of view and to contest the decision.
In particular, the clauses about access to personal data and to have decisions being made by a natural person seem relevant here.
The threat of the gigantic fine is what gets people into compliance to prevent this from happening.
Lots, possibly even the majority of companies in Europe beefed up their IT security procedures because of this, and I wouldn't be surprised if almost everyone that sits at a keyboard in Europe didn't get called into a meeting to talk about how important it is for them to keep their customer's data private and ways to do that.
Without something like this in place, companies can just not even care about users data.. because 'oops, we did nothing to protect it' is still a valid excuse.
On the other hand, they also don't provide internet services to people.
Because while the rulemaker believes that there is a range of potentially reasonable judgments based on particular circumstances, they do not believe that range is unbounded.
> The only reason I can think of is to protect large corporations.
The fixed minimum upper limit of $20 million is actually probably to prevent (or limit the effect of) large corporations using smaller subsidiaries and fancy accounting for GDPR-risky activities, rather than the upper limit protecting large corps.
1. To prevent cruel and unusual punishment.
2. To set expectations about the seriousness of the infraction in the eyes of the law.
I am not a lawyer or a legal scholar, so I'm sure there are more reasons.
When a store says “Everything up to 50% off”, that doesn't mean everything is half price.
I think that is the catch?
Not just punishing the small percentage who get 'caught' while doing nothing to actually help the problem - ala the drug war. And for everyone who thinks it's just big evil companies who get punished, one of the first GDPR fines was $4k against an Austrian small business owner whose video surveillance around his building was deemed too broad it violated peoples privacy.
I'm not declaring GDPR a failure by any means but all policy must be judged on a long-term full-picture basis. Not simply on "good intentions" of the bill + a few high visibility wins early on, then moving on as if the world is a better place.
GDPR tells you what you can't do and what the penalty is for being caught in violation, just like a speeding law tells you what speed you can't exceed and what the penalty is for being caught.
OTOH I guess this is relevant information and so they should be allowed to have it under GDPR rules? I'm obviously not a lawyer although my work, like most programmers' is affected by GDPR, PCI and whatnot.