Also EU companies tend to be more mindful and take data protection very seriously, even before GDPR was a thing, so finding gross offenders is a rare occurrence anyway.
Edit: for anyone wondering SAP has ~110,000 employees worldwide, Google has ~180,000, so comparably mega scale tech company.
I am not sure that is completely correct, considering SAP's cloud offerings.
SAP runs your instance, but isn't responsible for what you do with it.
I'm absolutely in favor of making it impossible for adtech to make any profit at all as long as they build their business on monetizing user data and exposing their users to all kinds of hazards.
I find it funny that so few people here see a problem with that kind of behavior. It's as if they expect society to serve the market, instead of the other way around.
Ironically, currently 2023 entries.
I was really expecting better comments from hackernews. If we're talking about vibes you should acknowledge that it makes sense for the EU to protect their people and their personal information from really large foreign companies. Even more so from companies that are aligned with the state that has one of the largest military powers in the world.
You really shouldn't on topics related to the EU. There is an incredible amount of misinformation peddled, and asking for sources or actual analysis beyond simple statements that keep being repeated is usually met with either silence or insults.
No. All I did was opening enforcement tracker, click on France, and look for familiar names. It was faster than writing my previous comment. I knew about one of the Carrefour cases, and the Criteo case though.
>The authoritarianism and the insanity of the laws in the first place is/are a far bigger problem
What is authoritarian or insane in GDPR? Or its previous iteration, the DPD (from 1995)? Oh no, we expect companies to handle personal data with care, the horror.
Some of these do business in foreign countries, but all of them are unmistakably Dutch.
I've left out the largest news organisation in the Netherlands, the Belgian company BPG Media, but they have bought up a bunch of local news organisations.
Non-EU-originating companies on the list: - Tiktok - locatefamily.com
Tiktok got fined by the Dutch DPA for not providing their privacy statement in Dutch while still doing business in the Netherlands. Further research into Tiktok was transferred to the Irish DPA (this fine). I suppose the Dutch DPA could've lodged a complaint with the Irish DPA for not providing the necessary documents in Dutch, but that seems rather silly to me.
locatefamily.com did not have EU representation at all so there was no need to process the complaint anywhere else. I doubt the fine will ever be collected, but who knows, maybe the owners are stupid enough to open a business in Europe somewhere down the line.
But also, primarily European companies did generally take it a lot more seriously than multinationals. (Sometimes too seriously; while this has calmed down a bit, you'll sometimes see companies enforcing absolutely absurd policies around data on the basis that they incorrectly think they're required for compliance).
For example, it was US companies that stopped serving ads until they had GDPR infrastructure in place, while some very bad actors in the UK where not collecting consent at all.
On the other side, European companies are usually smaller, so their get lower fines, which won't make the headlines. Which is, why you might not hear so often about the fines against European companies, which still happen. And if we are honest, we usually only hear about the super-penalties anyway.
At least in my experience, when I deal with a service in the EU, their privacy policy fits on a few A4s, with the important bits frontloaded and written in an easily understandable way. Even most banks don't really hide what they collect on you and they explain why they collect it.
It's only foreign companies that tend to insist on massive privacy policies that border on being incomprehensible and use them to skirt the law. Seriously, just look at Googles privacy page for example - it's a single giant page that mostly just restates over and over "Google may collect info about you". It's unclear what the data is being used for, it's extremely reliant on other pages to detail what's being used and your average person has probably lost the plot by now.
It's difficult to put it in any other way, but foreign companies are the ones who think they can get away with breaking the law and make it as difficult as possible to trace what they're doing with your data. European companies just tend to actually follow the law. That's why all the landmark cases are against foreign tech giants.
These are the moments I’m grateful to be living in the EU. GDPR was a huge circus of blame on EU bureaucracy back when it was introduced. A lot of hate poured out that every single paper you sign now needs to have a second separate GDPR thing for you to sign. Stupid Brussels making your life more complicated! But now everyone seems to be used to it.
It's probably different for organisations coming from outside the EU who get EU customers over the Internet.
A lot of people were wrongly influenced by DPD consulting wannabes on their first gig. I have seen small org burn years of contacts they could have kept or easily manage in respect with the provisions of the law.
Why do you think that these fines are "unbelievable" and "unreasonable"? Because for me they are rather on the low side, given the business practices, the reach and the potential for abuse that these companies have.
2) 2.6% of revenue for a company that isn't even profitable.
3) 2.6% of revenue for a global company, how much of this then is only EU revenue?? Are they supposed to get their legs cut off just for breaking one law of the 5 million that they're suppose to comply with?
4) This was a first offense for this company.
5) They're not doing anything harmful with the data. It's a social media platform. We need to relax. The burden should be on the parents.
Yes, they wont learn otherwise.
So the fine seems appropriate to me.
We do have to keep people around if they behave in ways that harm society, but society is not morally bound to keep companies existing despite them misbehaving. They are not living conscious entities. They are organizations created for the purpose of accumulating money. And if they cannot do that without violating the laws, then they should be dissolved.
That's not an "authoritarian mindset". That's just the mindset "the law applies to everyone".
2) Just because they are incompetent doesn't mean they get to break the law. Why should incompetent businesses be absolved from any wrongdoing?
3) If they want to do business in the EU they have to play by the EU's laws. If they cannot abide by the EU's rules, they probably should not try to make business in the EU.
4) That's why they only have to pay 2.6%.
5) There were multiple breaches that exposed user's data. You might think that exposing user's data is not that serious, the EU has decided otherwise. The burden by law is with the company, not the parents.
Such a thing would need to exist before the EU would be able to fine it.
The Irish DPC is also reportedly quite busy, by virtue of shouldering a disproportionate amount of the enforcement work for non-EU companies (due to tax-driven HQing there). They have taken cases against European entities as well however: notably they even even taken cases against the Irish government for violations around mandating biometric public service ID cards.