Not in a useful way I've noticed because a small company can service hundreds of thousand easily thanks to the power of the internet. CCPA, for example, essentially sets the cutoff at 50000 users which you can get to pretty quickly with a consumer startup. The cutoff helps the local pizzeria I guess but not any actual competitor to incumbents.
Is it out of the goodness of their hearts that large companies complain about regulation hurting small businesses? Or is it because the regulation will cost them a ton of money they'd rather keep in the bank, and they know they already have enough market capture to continue to obliterate small businesses either way?
When someone says that regulations on large companies will actually hurt small businesses, the first thing you should do, is look who is claiming that, and see where they get their funding from. It's almost always a think tank funded by the biggest player in the market being discussed.
First off, I haven't seen big companies making this argument. Can you point us to a high quality source where one does?
Secondly, suppose the size of a market is X and BigCo has a 0.9X slice of it. Suppose the cost of complying with new regulation is 0.5X. Now it is impossible for anyone else to compete with BigCo, since there is no way for second place to be profitable in the market. However, BigCo is still worse off. Their revenues are now X, but their profits are now -0.4X compared to what they were before, since they gained 0.1X revenue and lost 0.5X in compliance costs.
So, if a BigCo were to make such an argument, that's at least one case where they could deploy it honestly while at the same time having their own best interests at heart.
The fines must be effective, proportionate and dissuasive for each individual case. For the decision of whether and what level of penalty can be assessed, the authorities have a statutory catalogue of criteria which it must consider for their decision. Among other things, intentional infringement, a failure to take measures to mitigate the damage which occurred, or lack of collaboration with authorities can increase the penalties. For especially severe violations, listed in Art. 83(5) GDPR, the fine framework can be up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher. But even the catalogue of less severe violations in Art. 83(4) GDPR sets forth fines of up to 10 million euros, or, in the case of an undertaking, up to 2% of its entire global turnover of the preceding fiscal year, whichever is higher.
The minimum (of the maximum) set by the “whichever is higher” clause is needed to remain effective with non- and low-revenue entities. Something like Clearview (universal face recognition but startup with little revenue) would otherwise be free to ignore the law.
If your small company does enough damage to warrant a 20 million fine, it probably deserves to die. These fines also aren’t assessed arbitrarily: there’s a specific list of factors to take into account, and all decisions are subject to judicial review under the established principles of proportionality.
You hope bureaucrats do not act mechanistically and do not apply proportionality, but over and over again in recent history you see that exact behavior. Which is why no business trusts a statement of 'they'll be might be nice, but nothing is effectively stopping them from not being nice other than some platitudes'!
One argument goes something like this:
The state always reserves the right to extinguish you, either by execution or permanent non-judicial incarceration, regardless of laws.
We all can only always hope state-level actors don't abuse their powers.
Whether they are or aren't at any particular time is somewhat subjective.
GDPR makes business more difficult, but it codifies a human right to privacy that, much like worker safety, should have been implemented anyway.
The present regulation does the opposite. It ultimately implies that any company that does not comply with the insane US post 9/11 laws on large scale spying, extrajudicial sanctioning and, arguably, racial and ethnic discrimination, will be sued into the ground.
Scary especially for non US citizens, who are not in practice afforded judicatory or constitutional rights in the US
I bet many agree here any that those US laws and actions are bad too. I really care about privacy myself also, more than the typical tech worker looking at the actions of my coworkers compared to me.
If there was GDPR casual or GDPR lite for small businesses, kind of like small business taxes where hiring an accountant once a year for a few thousand euros was enough, then I don't think people would be up in arms about the GDPR.
If GDPR-casual was good faith level of actions where all you did is kept a log of privacy data clearing requests, like a copy of an email and a copy saying you did it back, and then did a best effort cleanup, I don't think anyone would care. It's the very large compliance burden that GDPR imposes, with a lot of liability gotchas everywhere if you don't implement bureaucratic detail #2929 that put people up in arms. And if you say that it isn't like that, it shows you haven't really looked at what is required by the GDPR or tried to implement it in your company.