They have a $100B enterprise value, and make ~$4B/year in GAAP income. This is not even the yearly cost of a higher level lawyer. If you make $200k/year then the fine would correspond to a $30 ticket. Lol, just lol.
Also: the crime isn't that bad. They did reported the breach on their own accord, and acted according to the laws at hand. The report may have been two weeks too late, but it was there. Their preventative measures and reaction were deemed good enough, just not timely. A crippling fine wouldn't have been appropriate, given the verdict.
The company could have avoided the fine by doing exactly the same thing they did, just a little faster. The fine counterbalances the cost-savings they may have had by having fewer people work on this. A future manager will probably see the fine, and decide just to put a little more resources into this, so the report can be on time. When that happens, the fine has served its purpose.
OTOH, in a wider context, you have to concede OP's "lol" perspective is true too. The money itself has little/no possible deterrent effect.
"Just for their Dutch operations" is a lawyerly frame... it isn't a business frame. booking.com's Dutch business operations aren't really separate. Any security/transparency practices beyond "compliance" almost certainly exist across borders.
I agree though that a fine (any amount) can be enough to adjust resources/practices on a small scale. On a bigger scale, the threat of a fine (any amount) probably is not enough to deter much. IE, if changes are strategic, costly or impact revenue... a fine will always be cheaper.
Companies spend a lot of money and energy on projecting an image, not only to the outsider but also to the insiders.
Unless they pride themselves for being evil and the cut-throat office politics, I bet this fine will make a dent in someones image and will trigger some policy change or similar.
Companies are not really monoliths, despite of their effort to be seen as such.
The fine? It wasn't even mentioned that a fine would be forthcoming. Until city hall took steps to replace the organisation they refused to modify their systems and stop the still-in-progress leak. It got to be a scandal.
So clearly: the idea is to fine only people they feel like fining. Anything even tangentially related to the government (this is a private for-profit organization (running quite a decent profit I might add, as well as paying management very nicely) that merely works for the government) does not get fined, even for leaking much, much more sensitive information.
Needless to say, CPS has still not changed their processes to better secure medical files. They are still being sent, without any encryption or authentication, over email. So it's not just that they weren't fined: the whole purpose of the data protection law, actually keeping the data safe, was ignored entirely even when they got caught spreading extremely sensitive information around and storing it without encryption.
https://www.rtlnieuws.nl/tech/artikel/4672826/jeugdzorg-data...
> Dit is het ergste wat ons kan overkomen
Sounds like they think it’s some sort of natural disaster that happened to them. I have no words.
Thank god it was two good guys registering the domain.
The relevant question, then: what is the history of GDPR enforcement against small companies? Personally I have no idea, as typically only the big cases make the front-page.
For example, a police officer was fined 48 euro for accessing "personal data in a police database for private research activities", a housing association was fined 500 euro for "publishing photos showing members of the association without their consent" and Borjamotor, S.A. (which appears to be a Spanish Opel dealership) was fined 4000 euro for "sending commercial advertisements to the data subject via email and SMS, even though the data subject had previously revoked his/her consent to receive advertisements and submitted a request to delete his/her data".
[1]https://n7uofv7rfwwdpbwmcuqmohfsnu-adwhj77lcyoafdy-www-aki-e...
2. HN is not a single instance but consits out of many individuals.
=> The "opposing reactions" are expectable.
Netherlands being 1% of the global GDP, this would be proportional to a $50B "global fine" or 50% of the company valuation. So in that sense, it even seems too big.
EU being 20% of the global GDP, this would be proportional to a $2.5B "global fine" or 2.5%, which IMHO seems small-to-fair for a data leak of this type.
>Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
Still, should be 10 or 100 times more.
To be honest, I can live with that.
I would consider as desirable that egregious, systematic and catastrophic security failures would be resulting in fines and penalties large enough to bankrupt companies[0]. But starting from that is rather not a good idea, I agree that some warning is a good idea.
[0] for example 2000$ for every single leaked address that they deliberately collected (if company is scared: then they should not ask user for address data! Companies very rarely actually need it, and they still ask.).
That number is meaningless for how much a company is hurt by a fine. A market valuation is just based on the current stock price. It doesn’t mean that the company has access to that much cash or assets.
>When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:
>(e) any relevant previous infringements by the controller or processor;