Do you have any examples of something like this happening in Europe.

I understand that Americans tend to think like this. But proportionality works quite well in Europe: Large companies get more scrutiny and higher fines while small companies get a warning.

Yes (see my reply to your sibling comment 1) but these are not large cases and I'd rather not connect this HN account to my real life activities.

All but one of the cases ended in a warning, but it does show the increased scrutiny that smaller entities seem to enjoy.

Edit: just to clarify me or my business were not directly involved with all those cases, but in the one that we were, it was something we had simply overlooked with regards to GDPR and all was good immediately when the auditor determined we had resolved the problem

1 https://news.ycombinator.com/item?id=35012128

Not so since GDPR. GDPR is enforced at every level, including the individual. Whereas 10% of the global revenue of a megacorp only upsets the shareholders a little without ever risking the megacorps power, it can literally bankrupt or starve individuals and small businesses, most of which operate with thin margins.

https://www.enforcementtracker.com/

This trend is similar to how the megacorps block out competition in the US by killing small businesses and making it very difficult to engage in economic or engineering activity through the regulations they sponsor.

This law in particular seems to be the product of the private German interests which at the moment dominate the Euparl. So, yeah, its happening in Europe now too.

Per your link, proportionality seems to be working. Big fines are directed towards big companies (cf. Fines Statistics). For individuals (“private person” or “private individual”), it seems they mostly are fined 3-digits amounts, with some in the 4-digits, and 3 at 10-11k.

> proportionality seems to be working

The fine is arbitrarily decided. There isnt anything solid governing the amount if the fine is not % of revenue. So it totally depends on the whim of the regulator. Which is totally in lieu of the principles of civil law that Europe uses. Its more like the common law practice in which the authority can interpret things and can act arbitrarily without solid, inviolable, democratically-made laws governing its behavior.

This may look like working today. Tomorrow you may find it disproportionately hitting whichever segment or sector that the interests behind the incumbent regulatory appointees target.

> The fine is arbitrarily decided. There isnt anything solid governing the amount if the fine is not % of revenue

This is wrong. See GDPR article 83, and https://edpb.europa.eu/system/files/2022-05/edpb_guidelines_...

> This is done by evaluating the classification of the infringement in the GDPR, evaluating the seriousness of the infringement in light of the circumstances of the case, and evaluating the turnover of the undertaking. The third step is the evaluation of aggravating and mitigating circumstances related to past or present behaviour of the controller/processor and increasing or decreasing the fine accordingly

How is 'evaluation' done and who does the 'evaluating' you think...

There is no solid legal directives defined in GDPR regarding static amounts. They hinge on on the regulators' interpretations.

Thankfully, there is still 38 pages left after that quote. You will have a hard time finding a flowchart in a law though…

Anyway, my point was that the fines dispensed nowadays are sensible. As for the future, DPAs know very well that the instant they go rogue, ie. distribute disproportionate fines or misinterpret the law, their decisions will be reversed by an appeal court. It already happened, in fact.

edit: I just read this on the website of my govt:

> The court that sentences the offender is free to set the amount of the fine, but not to exceed the maximum amount set for that offence.

Turns out judges here have even more leeway than my DPA! The finepocalypse should come any day from now. And don't get me started on courts of assizes.

The static fines' maximums are defined in the 'Legal Maximums' section. The other 38 pages are not needed. Next time, do read the reference you are sharing.

> Anyway, my point was that the fines dispensed nowadays are sensible.

The sensible fines of today do not guarantee the fines of the future. The precedent concept does not apply to civil law. When an authority is given free range interpretation power like this, the next batch of regulators can interpret it in however they want. Which is in itself a violation of civil law principles.

> ie. distribute disproportionate fines or misinterpret the law, their decisions will be reversed by an appeal court

No Open Source contributor will risk getting such a fine, then going through a lengthy court battle to revert it. They will just stop contributing.

Good afternoon.

> in which the authority can interpret things and can act arbitrarily without solid, inviolable, democratically-made laws governing its behavior.

A speeding ticket has a fixed fine, anything more complex than that has some level of arbitrariness.

This is how things work in pretty much every other country of the world.

And of course fines are appealable, etc

i can say with quite some confidence that huge companies in europe do not get the same level of scrutiny from the tax department as some regular joe does.

They will come after the little guy with the full force of the state, with their lackeys wearing a pistol belt, and you had better comply, or else. Meanwhile they dont have resources to perform audits on the big guys

Source: I made it up

This is not what has happened with previous regulations. In fact, it's mostly weaponized against US companies, but that's mostly because it's fun and deserved.

Source I have experienced this with my own business, and saw it happen to other commercial as well as non-commercial entities with previously implemented acts and directives.

It's not dissimilar to how the tax authorities always seem to pick small timers for a random extensive audit.

Won't someone think of the poor oppressed small business owners.

It's not like they're the cause of half of regulations or anything due to all the scummy small business owners...

You are missing the point entirely.

Yes think of smaller entities - which are not all commercial, mind you - just don't think of them more often and more thoroughly than the multinational megacorporations that have been racking up endless violations, most of which they are continuously worsening rather than fixing, and are in many cases actively trying to litigate into oblivion.

there is nothing in history that could be used as a precedent to predict how this will be enforced. big companies will be in the news very hard for violating these laws. no-name small timers might get a slap on the wrist. but pretty sure fines will be proportional. about time companies are held accountable

As previously implied this does not conform to my own observations

The idea is good and I'm all for it, but mostly due to said observations I'm not convinced its practical implementation will be very effective at all

That is the modus operandi of US regulatory apparatus. Example: Glaxo Smith Klein !knowingly! killed ~150,000 Americans by pushing Avandia for a purpose that it was not approved for. They knew that it would kill a lot of people before they launched it, and they started bribing and coercing medical professionals and institutions, including top names in the US to lie about it. They kept an information siege of lies up until whistleblowers protected by Qui Tam principle blow the cover, protected by the government.

The result?

GSK paid $4 bn in fines. They made $11 bn in profits from that drug. Net $7 bn even with the fine.

...

This is the way regulation works in the US. And this is why the Americans dislike it: Small businesses can never risk that. Big businesses dont need to care about that. Its designed to kill the small for the sake of the big.

The Eu used to be different. But judging from how this law is crafted, it might be changing.

this is "GOOD BUSINESS" and bad (evil) everything else. oh the humanity

Yep. One person among the US authority that led this prosecution explained very well what GSK was did in an Al Jazeera documentary. He said: "This wasn't a mistake. This was a good business plan."

That's not how regulations work. Big corporations are targeted first, because they're big obvious targets and have auditable paper trails. Small-time hobbyists are the ones who fly under the radar.

The distribution of consequences rather than discovery of violations is what I expressed my cynicism about.