Hacker News Reader

Comment by downandout | Hacker News Reader

You appear to be spreading false rumors about them issuing warnings even though they don’t have to. When I organized the data on this site by fine amount, not a single case on the front page said anything about any of the companies fined having received a single warning.

So, by comparing this to legal situations where “it never happens” you are purposely misrepresenting the risk of receiving a fine under GDPR without any type of warning. While having an eighth of weed rarely if ever results in a 5 year sentence in the U.K., clearly not receiving a warning before being fined occurs quite frequently. You have made a false equivalence between these two things.

View on HN

You need to read both of these, and you need to understand what they mean in the context of EU law.

https://gdpr-info.eu/art-58-gdpr/

https://gdpr-info.eu/art-83-gdpr/

You also need to remember that if the regulator has got it wrong there is a remedy available for the person being fined.

About cannabis: generally the first offence will receive a warning unless there are aggravating factors. Police are expected to take an escalating approach: 1st offence = warning, 2nd offence = penalty notice for disorder (which doesn't result in a criminal record if it's paid), 3rd offence = arrest followed by caution or charge and prosecution.

Neither of those links you pointed to say anything about warnings being required, or even customary for that matter.

Because you haven't understood the context of what the EU means when it says "proportionate".

Article 83 is basically a long list of reasons to avoid giving a fine but to give a warning instead.

Why would you expect a site built to report GDPR fines and penalties to report GDPR warnings?

ICO haven't yet released aggregate figures for GDPR, it's too soon. GDPR is a minor update of DPA, and they have released aggregate numbers on that for a while. Fines are levied in a tiny minority of cases. Warnings are far more common, as is steady escalation. The expectation here is the proportions will remain the same under GDPR.

On weed, actually no, because the default action for weed for the vast majority is just a warning. So no, it isn't clear that getting fined without warning first happens quite frequently, because that's also simply not true. You're very unlikely to see a court without a warning first.

>GDPR is a minor update of DPA

It is not a minor update[1]. The Information Commissioner's Office is extremely aware and vexed, given the current state of affairs, that Data Protection Act 2018, needs to be aligned as closely to the GDPR to allow for information to flow freely after Brexit (Article 45)[2][3].

Furthermore, ICO has not been the epitome of a regulatory body enforcing the law to it's fullest extent, for which it has had the remit for ─ by stopping business' doing a runner or imposing maximum fines, neither has it had a good record on collecting the fines issued. Although, it has made a meal of some of the high profile rain-making cases which have already been in the public eye. It is ironic that there are no real details forthcoming from ICO and one has to resort to FoI requests to get any information on it's previous escapades under DPA 98![4]

[1] https://www.dpocentre.com/difference-dpa2018-and-gdpr/

[2] https://gdpr-info.eu/art-45-gdpr/

[3] https://ico.org.uk/for-organisations/data-protection-and-bre...

[4] https://www.theregister.co.uk/2018/05/25/millions_of_pounds_...

That is an entirely different issue. GDPR is effectively an update of DPA 1998 that it replaces. Most is the same, definitions and scope are widened and modernised. A company that had implemented DPA(1998) was most of the way there for GDPR(2016). If you're going to get pedantic, DPA 1998 is one of the many implementations of EU's DPD 1995 as there is a fundamental difference between EU Regulation and EU Directive.

Clearly I am not calling GDPR (2016) a minor update of a subsequent law UK DPA (2018). That is UK's implementation of GDPR, which thanks to the stupidity that is Brexit may indeed have some issues interrelating with the EU. Probably the least of our issues, but still...

UK ICO's stance is fairly well known, but I don't think they can be held responsible for businesses that liquidate in the face of fine. That seems more likely to be an issue of UK company law.

>UK ICO's stance is fairly well known, but I don't think they can be held responsible for businesses that liquidate in the face of fine. That seems more likely to be an issue of UK company law.

You are confusing ICO's stance and responsibility with it's reluctance to enforce powers, which have already been granted to them by the government, in order to pursue negligent cases and collect fines under the UK law.

The Insolvency Service has general powers to investigate both insolvent and active companies, including those companies that undertake direct marketing activities. If a director has deliberately acted to the detriment of the company and/or its creditors, action may be taken against the directors under the Insolvency Act 1986 or the Company Directors Disqualification Act (CDDA) 1986.

That's the Insolvency Service, which isn't ICO, and presumably they (IS) would have to instigate action. I've no idea how it interrelates with ICO's powers, but I'm completely outside my knowledge here.

Reply on news.ycombinator.com