Why is having all your medical data leaked on the web by a 5 person company any less damaging than by a 5000 person company? Or all of your internet history? Your face recordings?

What you're really just creating here is an economy for small companies to steal and datamine your data and then resell it to others.

For all the constant grinding about FB/Google on this website, small startups are usually a significantly larger privacy catastrophe with little morals and very little security. Most of them don't even consider privacy and security as something to be thought of while they're throwing out their MVP.

False dichotomy. You can still have stuff penalties for leaking PII.

No false dichotomy there - stiff penalties for leaking PII IS the regulation.

Not the one Facebook is proposing.

Good idea, though I'd add another metric: market reach, in terms of, for the case of social media, users.

This might have other metrics though -- sources / sellers, for a market or middleman entity, some weighted metric of business customers for b2b suppliers (such that an F-10 company weighs more than an F-10000 company). For physical management (say, commodities), total tonage moved. Et cetera.

To be fair, GDPR was first proposed in 2012. In 2016 it was written into law, and then in 2018 it became enforceable. It was these adtech companies that choose to ignore implementing it and/or to do it as late as possible.

If you have regulations by revenue/employee count then the companies will restructure themselves to be below those thresholds.

While true it is harder for companies to manipulate those 2 measures.

E.g. could Facebook run with 20 staff? Would Facebook and its shareholders be satisfied with 20m in annual revenue.

This scenario requires trade offs. My opinion is that monopoly, political and market dominance is a sub-optimal outcome

It could certainly run with 20 staff – it would just spend a lot of money on license fees to a separate Facebook Services Inc that provides software and server administration services. This is similar to how companies avoid tax e.g. IKEA and Starbucks.

It could similarly avoid large profits but avoiding large revenues works be trickier. But I'm not an expert in these things, so maybe it's possible if you really know what you're doing.

Then you just base it off of the number of employees overall in the parent company, not the number of employees in the subsidiary.

The problem is, there's no legal distinction between a company that own shares but is "really" part of the same company, vs a completely separately company owning shares e.g. a pension fund.

Base it off user count too, problem solved.

That's easy to fix, just apply the rules only to companies having more than a hundred shareholders, and count shareholders of the parent for any subsidiary. Then you can't restructure Facebook to have less than a hundred shareholders because the number of shareholders is independent of the internal corporate structure.

So any non-public company would be exempt?

There are multiple private multi billion dollar companies and I wouldn't be surprised, if they all have less than 100 shareholders.

> So any non-public company would be exempt?

All of the major tech companies are publicly traded.

Being publicly traded is also a major risk factor for hostile corporate behavior, because the top executives of private companies tend to be the owners and care more about the long-term than short-term profits, so it even makes sense as an explicit policy choice to regulate publicly traded companies more than private ones.

Non-public non-cooperative ones actually. Having thousands of members is very common in cooperatives.