Hacker News Reader

Comment by vemv | Hacker News Reader

Anyone can expand on what "vindictive reporting from no-win-no-fee legal firms" would exactly consist of?

If an EU citizen believes that their personally identifiable information was obtained without their consent, the EU GDPR allows firms to do an audit on the company. The citizen who filed the complaint would enlist help from a no-win-no-fee legal firm, meaning, if they don't win (with infractions being $10 million minimum), the citizen, who is now a client of the firm, would not be out any money. If they do win, most likely the firm would make a windfall after carving out their share of the proceeds.

Wait! I was under the impression that fines due to GDPR are just that, fines. They are paid to the government, not individuals. At most, getting fined due to non-compliance can suggest that if individuals bring civil lawsuits against the company, they may win and be awarded damages, the amount of which depends on how much damages they can prove they have incurred as a result of misuse of their data, not statutory amounts. Is that not the case? Is the fine actually paid to the individuals?

Or are your suggesting that some patriotic legal firms would do all the legwork for free so that the government treasury would get a boost?

Cease and desist letters from predatory law firms are a very real thing, even in Europe. In Germany, entire law firms have been established for the sole purpose of collecting out-of-court settlement fees for small mistakes in websites' legal notices, which they find using automated searches: http://transblawg.eu/2003/10/13/u-s-comment-on-impressumgerm...

GDPR will give them new ammunition on a European scale.

Your link is from 15 years ago.

Yes, your understanding is completely correct. Only EU member states can levy fines under the GDPR, and it's likely few will have any interest in trying to fine small businesses. Lawsuits are possible, but only for damages, and good luck showing any damages from a minor technical violation by a small SaaS tool. And without any prospect of large damages from a deep-pocketed defendant, good luck finding a law firm willing to work on contingency.

The whole thing is FUD, although mad props to the people behind the linked service for making a play at profiting from it.

I don't have a lot of actual information on this, but the buzz in my privacy professional listservs is that EU courts have been VERY expansive about what constitutes "damage" in related legal spheres, and that those of us coming from a US legal background should not rely on our instincts about what kinds of damage could actually create a cause of action worth suing over.

No. EU courts tend to define damage conservatively, and people suing for damage normally have to demonstrate actual financial losses.

But it's irrelevant here, because the law isn't based on damages.

No, some firm will ask you to pay $100,000 as private settlement because you make a mistake, or else they'll will have to seek remedy by filing a complaint on the EU courts, potentially costing you around 10M

But unlike copyright trolls, the law firm in question can't guarantee that paying the protection money will actually protect you from being reported, so there isn't the same incentive to pay. A protection racket only works if the mafia monopolizes the threat, otherwise any random thug could destroy their business.

> with infractions being $10 million minimum

Stop talking nonsense. It is up to $10 million or 2% of revenue.

https://www.gdpreu.org/compliance/fines-and-penalties/

And so for most websites the fine would be significantly smaller than what lawyers typically earn to litigate.

Hence your entire "no win no fee" premise falls completely apart.

Both amounts are lower bounds. "No win no fee" falls apart because the lawyers don't get a fee for a fine collected by the government, not because the fine is too small.

> with infractions being $10 million minimum)

FFS, this is a maximum, not minimum.

Fines are up to $10 million or 2%, but it can go up to $20 million or 4% of annual global revenue, whichever is higher. That percent, whichever is higher is the key. Facebook's 2017 revenue was ~40.7 Billion. Four percent of that amount isis ~1.6 billion

You said 2 things:

> if they don't win (with infractions being $10 million minimum

But all of the numbers you give are the maximum possible fines. The actual fines imposed by the regulators will always bee smaller than that.

You also said:

> The citizen who filed the complaint would enlist help from a no-win-no-fee legal firm,

That's not how the fines work. They're fines, paid to the regulator. They're not compensation paid to the victim. There's no payout for no-win-no-fee solicitors, and so they're not going to get involved.

Law firms who proactively investigate infringing companies, then sell their service to citizens willing to sue. As an incentive for the potential customer, they agree to only charge if they win.

That's not how GDPR is enforced.

It's enforced by a regulator. The fines are fines, not compensation, and the fines go to the regulator.

There's no route for a private citizen to hire a lawyer and sue.

Reply on news.ycombinator.com