Hacker News Reader

Comment by hedora | Hacker News Reader

Given that the maximum fine is 4% of revenue, I wonder if they’d make more money treating the law as a tax, and just paying the fine.

This is doubly attractive if they can have a European subsidiary that only pays the fine on European revenue.

(I’d rather see the penalties be strengthened, to be clear.)

View on HN

“Officer, I already got a ticket for speeding last week”, you mean?

That won’t work. It’s 4% max, per infringement.

This is less attractive when you realize that all big companies will have a non-European subsidiary pay a non-European component of facebook for all their advertising needs, which would hugely lower the revenue base that 4% is calculated from.

It's 4% of worldwide revenue.

But an independent corporation wholly owned by Facebook would not have worldwide revenue.

> an independent corporation wholly owned by Facebook would not have worldwide revenue

Legal concepts like "beneficial ownership" [1] and the definition of an "affiliate" under U.S. securities law [2] deal with this.

TL; DR When it comes to taxes, modern law isn't tricked by incorporated Russian dolls [3].

[1] https://en.wikipedia.org/wiki/Beneficial_ownership

[2] https://www.law.cornell.edu/cfr/text/17/230.405

[3] https://en.wikipedia.org/wiki/Matryoshka_doll

Ireland was kind enough to leave a grace period for closing the double Irish tax loophole and give companies time to switch to a new tax loophole. https://www.irishtimes.com/business/economy/multinationals-t...

Cooperations have had 2 years meeting GDPR requirements.

If you're late to the party, which I think the majority businesses in and out of Europe are, means you have made other priorities.

Question is whether or not how hard they hit when GDPR goes live 25th of May. That remains to be seen, but it wouldn't surprise me if there's a `grace` period.

Even if you could somehow hide that, the penalty is 4% of global revenue or 20 million euros, whichever is higher. So That's still a very high fine since it's per violation and I'm sure I'm not alone in that I will be sending facebook, google and many other data companies these requests as soon as the law takes effect.

For the owning company/persons and all other companies they own?

Per case. 1 case per week and that's bankrupt in 6 months.

strengthened? this is already such a large undertaking with huge risk. it’s not 4% of EU revenue, it’s global revenue.

i think many small businesses are going to have to shut down EU operations because of GDPR

Of course you could simply comply with the law. It's only made to look super difficult by those that would like to avoid compliance. But in practice it is actually fairly reasonable and if you were a conscientious operator you most likely already had 90% or so of the technical measures in place long ago.

Maybe an unpopular opinion, but I think GDPR is not net good. It has its good parts, but overall it doesn't really improve security (think of all the big data breaches, GDPR wouldn't help there), but makes many things harder, especially for small companies and hence stifles innovation. Like the infamous "cookies law" but on larger scale. Governments pressure private companies with this, but in the same time are making it easier and easier for themselves (govmnts) to spy on people and infringe on people's privacy (in the name of fight against terrorism, or "for the children" etc)

GDPR can help advocates for privacy within an organisation. Rather than argue with nebulous harm from potential bad PR, you can say "If we don't do this, we risk a fine of $LOTS"

GDPR puts legal teeth with $MegaFines onto a lot of internal IT political battles beyond security, too.

Unified project processes, mandatory architectural reviews, IT-driven planning... if you're in a domain with lots of personal data the answer to why can't be cowboys and ignore IT 'just this one time' goes from "because we are trying to do IT right, dammit" to "because it's illegal" or "because the compliance costs are too high".

GDPR is already reducing the number of data breaches before it has even come into existence. Try booking a pentest from a company with a good rep in Europe right now and see what answers you get. Companies have finally woken up to the fact that security is no longer optional, that's a good thing in my book.

> think of all the big data breaches

It actually mandates that you need to protect the data, and if it gets breached you need to notify the data subjects. So for example uber couldn't have a massive breach and just pay the hackers off and keep quiet.

The GDPR is a massive good for users of online services.

The basics of it aren't hard: build your systems to not store too much data you don't need, get permission for the data you store, make sure it's secure and make sure you can delete it when needed. I don't think that is too much to ask, do you?

EDIT:

> Governments pressure private companies with this, but in the same time are making it easier and easier for themselves (govmnts) to spy on people and infringe on people's privacy

Looking at how prism and other programs worked/works it seems like what GDPR encourage (Don't store what you don't need) would have actually helped against that.

With GDPR it will be harder to create a service that stores everything about you forever to be retrived by FISA or whoever, and simpler to create a service that just stores what it needs, and encrypts everything it can.

Good, take down all companies that violate GDPR. Good riddance.

The counter to that is all you are left with is giant mega corps that can pay the associated costs. I'm not sure that this is a much better alternative

Or you'll end up with small business that don't make their money taking a garden rake across your personal data and bagging it up for the world to see.

Reply on news.ycombinator.com