Look at https://www.enforcementtracker.com/.

Sort by fines desc :)

Do you know what is done with the money from these fines? Does it merely fund the enforcement teams (seems excessive), or is it put into some EU “general fund”?

FB has a global revenue of ~$86B. Of which 4% is $3.44B. That would make a real mark on the budgets of the poorer half of EU countries.

I wonder why there aren't more enforcement actions...

It's a simple math - how many people are responsible for processing such case? 10-100? So let's say it is 100 people. You only need like 100,000,000 EUR to make it go away by giving each one a 1M. Even if those people go for early retirement and new staff takes on the case, you can repeat this. Even if it happens every year you can do it for 34 years before the money exceeds the potential fine and meanwhile you'll make much more money as it gets pushed back. In reality you probably need to buy top 5-10 people so they can keep pushing it back while being set for life.

This doesn't answer the question "does the money just sit in an escrow account forever or is it eventually spent somehow?"

Generally they go into the coffers of the treasury of the country that issued the fine. This may be further directed to the EU but probably not.

That's an interesting question. I do not know the answer.

Some companies will never learn. Search for Vodafone, for example.

Wonderful, thanks!

Now we are talking :-)

A drop in the ocean.

Indeed. The regulation allows for pretty stiff fines I believe, so with fines this small for companies whose entire business model is persanal data (e.g. Google and Facebook but not an airline or retail chain) the math should be "How large should the fine be in order for it to cost MORE for this company, than actually complying".

Complying with the GDPR isn't "free". It's like these companies belive "oh we can't possibly comply with that because it would hurt our bottom line!".

Give it some time. H&M got a €35mio fine in November 2020 for a document from 2014 stored in a network drive that contained employees personal data. If you do not comply, the more you wait the more risky that becomes.

Indeed, this will be important going forward. Living in EU, with local laws (denmark) being what they are. I hope the conclusion of this suit, will be similar to our laws that state: Any contract signed, that through its terms, makes you relinquish your state-afforded rights. Is by definition void.

Example of a void contract: When Buying a used car, Salesmen makes you sign a contract: "No warranty nor cancelation of contract possible after purchase".

Mmhhh, is it so strong?

I guess what is void is that specific clause. Otherwise, any vendor could include a clause saying "you relinquish some rights" just in the middle of the text and, after the fact, claim that the contract was void and require you to return an item (say, a car).

So, I guess you mean that specific clause?

In German law that would, as a default, actually make the whole contract void, yes. Many contracts therefore contain a clause that hedges against that situation (i.e. something like "if one or more of these items is found void, the rest still applies")

Specifically, the idea of a voided clause voiding the entire contract is sometimes a feature -- severability is not always desired. A simplistic example would be a contract with two clauses, one specifying that A sends B widgets, and the other specifying that B sends A money. You would not want those to clauses to be severable.

The legal term for this is "severability clause": https://en.wikipedia.org/wiki/Severability ("salvatorische Klausel" in German)

I believe this is how it typicaly works. At least the few laws I've read (Finnish law) voids the offending clauses, not the entire contract.

This specific case has a lot to do with Max Schrems & noyb pressing the issue to be litigated, he's a very engaged activist for privacy

https://en.m.wikipedia.org/wiki/Max_Schrems

You can't really trick them into consenting either as the law specifies you need a informed consent. Just having a flag in the database that the user ticked without knowing what they agreed to does not qualify.

I am referring to the fact that people click on the consent boxes without reading what they are agreeing to. I am not sure if informed consent is even possible at this stage. You can put all the details before the user and you will never know they read it. Maybe you could do a test to see if user read, memorised and understood, but still they can just click answers until it goes away.

> I have a feeling they will allow that as otherwise Facebook's predatory business model will make no sense until they find a way to trick users into consent

Luckily European courts don't really give a damn about Facebook or their business model.

It's not that European courts never play favorites with large companies, but Facebook isn't really known for paying a lot of taxes here and doesn't have many employees in Europe (at least an order of magnitude less than e.g. Volkswagen). Facebook is seen as a foreign company that doesn't know how to play by the rules, and was a major motivation for creating the GDPR in the first place.

I am wondering if a recent Apple announcement of a 1 bln investment in a Berlin tech-hub is so Apple can have a friendlier relationship with EU law.

Indeed. Working in research with human data, we spend a ton of time taking GDPR into account and it would be a huge disappointment to see a corp bypass that for profit when we for non profit research cannot.

I have a feeling that GDPR is actually mostly about giving tools to reign in the tech giants rather than stomping on the little guys.

So far there is no suggestion of an ulterior motive. GDPR is just there to protect the privacy of EU citizens and that's that.

>GDPR is just there to protect the privacy of EU citizens and that's that.

From what exactly? You'll see where I was going when you try to answer that simple question.

Because your answer will be -- tech giants.

From having their information processed/sold without their consent. There is nothing implicit in the regulation that targets "tech giants".

Nothing explicit* in the regulation -- but -- it IS the tech giants that egregiously guilty of:

>From having their information processed/sold without their consent.

The targeting of tech giants is implicit here.

Sure. That must be why the first fines were levied at a restaurant, a hospital and a bank.

Yes some of the tech giants are guilty of this. And some aren't. And also some non-giants are guilty of this. And some non-giants aren't. This is a possible kick in the nuts for Facebook and Google. It's not so much for Apple or Netflix, for example.

I don't think it's fair to make the grouping "tech giants " here. It's the "ad-giants". It's the companies whose business model is personal information. It's a small subset of the tech giants. In fact, much smaller adtech companies probably have a lot more to lose from GDPR than fb and google have.

Facebook, unlike a lot of online services, would still be able to target ads just because they know what people like without using any information people haven't consented to. A random news website on the other hand has to start showing me (a man) ads for women's clothing because news sites can't be as sure about my gender (or taste in fashion) as facebook is. So as weith so many things, I think the GDPR is just serving to reinforce the position of facebook, not the other way around.

No, the answer is "Anyone infringes on those rights."

It just so happens that some "Tech Giants" fit into that category.

>No, the answer is "Anyone infringes on those rights."

Nope a small American firm can infringe those rights and face zero consequences. A US Multinational with operations in Europe can't.

So implicitly -- bigger companies are targeted as they have more of a global footprint.

Nope.

https://gdpr.eu/companies-outside-of-europe/

Since you can't read your own link:

>The second exception is for organizations with fewer than 250 employees. Small- and medium-sized enterprises (SMEs) are not totally exempt from the GDPR, but the regulation does free them from record-keeping obligations in most cases (see Article 30.5).

So "Tech Giants" are "anyone with >250 employees"..

That's a mighty tight clutch you have on those straws.

Your feeling is wrong. As linked in another comment, [1] is a list of GDPR fines. As you can see, plenty of non tech giants in there.

[1] https://www.enforcementtracker.com/

A fun fact is that no business likes additional regulatory overhead and risk, but larger companies are much more able to take on the costs associated with compliance.