Many, but not all of them said this. Given that GDPR has absolutely no requirement that warnings be issued, it is not reasonable to expect that warnings were issued and/or ignored in cases where it doesn’t specifically say this occurred.
If, out of all the cases that we do know whether warnings were issued, warnings were in fact issued in the vast majority of them (or even 100% of the known cases), then for a case where we don't know and have no reason to believe is special, isn't the reasonable assumption that it's not special and is no different from the other cases?
The point is, and no one has been able to refute this, that warnings are not required under GDPR. Even if they have issued warnings in most cases thus far, it is still early days. As these actions under GDPR become more common, there is no guarantee that even those countries that have been issuing warnings first will continue to do so. The enforcement of regulations that have the potential to generate massive revenue streams for government entities tends to become increasingly aggressive and creative as time goes on.
I don’t understand why anyone, even those in favor of GDPR, would attempt to refute the black and white text of the law. No warnings are required under GDPR, and thus the potential exists for fines to be issued without warning. There is no argument or opinion to be interjected here. This is a binary fact. Are warnings required? No, warnings are not required. It’s that simple.
It is not. Those terms have enough legal leeway to drive a truck through.
It's why we have regulators, judges and magistrates - to apply judgement and proportionality. Sure there's a few headline cases of some absurdly harsh sentence - and just about always the details reveal there were a lot of very damning circumstances that make the sentence seem pretty reasonable.
Do US judges rubber stamp a maximum sentence each and every time? No. Does every visit by police result in prosecution? No. Is every warning and scaling mechanism offenders get in the US expressed perfectly in statute? No. Otherwise you would have fired all the judges as surplus to requirements.
You're just spreading FUD. Understand the legal system in Europe before spreading such rubbish.
So, by comparing this to legal situations where “it never happens” you are purposely misrepresenting the risk of receiving a fine under GDPR without any type of warning. While having an eighth of weed rarely if ever results in a 5 year sentence in the U.K., clearly not receiving a warning before being fined occurs quite frequently. You have made a false equivalence between these two things.
ICO haven't yet released aggregate figures for GDPR, it's too soon. GDPR is a minor update of DPA, and they have released aggregate numbers on that for a while. Fines are levied in a tiny minority of cases. Warnings are far more common, as is steady escalation. The expectation here is the proportions will remain the same under GDPR.
On weed, actually no, because the default action for weed for the vast majority is just a warning. So no, it isn't clear that getting fined without warning first happens quite frequently, because that's also simply not true. You're very unlikely to see a court without a warning first.
It is not a minor update[1]. The Information Commissioner's Office is extremely aware and vexed, given the current state of affairs, that Data Protection Act 2018, needs to be aligned as closely to the GDPR to allow for information to flow freely after Brexit (Article 45)[2][3].
Furthermore, ICO has not been the epitome of a regulatory body enforcing the law to it's fullest extent, for which it has had the remit for ─ by stopping business' doing a runner or imposing maximum fines, neither has it had a good record on collecting the fines issued. Although, it has made a meal of some of the high profile rain-making cases which have already been in the public eye. It is ironic that there are no real details forthcoming from ICO and one has to resort to FoI requests to get any information on it's previous escapades under DPA 98![4]
[1] https://www.dpocentre.com/difference-dpa2018-and-gdpr/
[2] https://gdpr-info.eu/art-45-gdpr/
[3] https://ico.org.uk/for-organisations/data-protection-and-bre...
[4] https://www.theregister.co.uk/2018/05/25/millions_of_pounds_...
Clearly I am not calling GDPR (2016) a minor update of a subsequent law UK DPA (2018). That is UK's implementation of GDPR, which thanks to the stupidity that is Brexit may indeed have some issues interrelating with the EU. Probably the least of our issues, but still...
UK ICO's stance is fairly well known, but I don't think they can be held responsible for businesses that liquidate in the face of fine. That seems more likely to be an issue of UK company law.
You are confusing ICO's stance and responsibility with it's reluctance to enforce powers, which have already been granted to them by the government, in order to pursue negligent cases and collect fines under the UK law.
The Insolvency Service has general powers to investigate both insolvent and active companies, including those companies that undertake direct marketing activities. If a director has deliberately acted to the detriment of the company and/or its creditors, action may be taken against the directors under the Insolvency Act 1986 or the Company Directors Disqualification Act (CDDA) 1986.
https://gdpr-info.eu/art-58-gdpr/
https://gdpr-info.eu/art-83-gdpr/
You also need to remember that if the regulator has got it wrong there is a remedy available for the person being fined.
About cannabis: generally the first offence will receive a warning unless there are aggravating factors. Police are expected to take an escalating approach: 1st offence = warning, 2nd offence = penalty notice for disorder (which doesn't result in a criminal record if it's paid), 3rd offence = arrest followed by caution or charge and prosecution.
Article 83 is basically a long list of reasons to avoid giving a fine but to give a warning instead.
Why? Many of these summaries aren't official justifications of the fine, they're news clippings. What leads you to believe that if a warning was issued, the news would always mention it? They're not trying to justify the fine, they're trying to inform the public, and they can never include every detail, they always have to leave stuff out. What leads you to believe the news always mentions warnings if issued?
I don’t understand why anyone, even those in favor of GDPR, would attempt to refute the black and white text of the law.
Literally no one in this thread has attempted that, and you incessantly repeating this strawman is why you're being repeatedly downvoted.
Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive
When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:
A) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;
b) the intentional or negligent character of the infringement;
e) any relevant previous infringements by the controller or processor;
i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;