Hacker News Reader

It's a number that will cause them to sit up and take notice, without starting a multi-year legal war. It signals to booking.com and other companies that the regulator is not asleep. The implicit threat is: fix your behaviour, everyone, or worse fines will follow.

To be honest, I can live with that.

View on HN

I also would be fine as long as "or worse fines will follow" is true.

I would consider as desirable that egregious, systematic and catastrophic security failures would be resulting in fines and penalties large enough to bankrupt companies[0]. But starting from that is rather not a good idea, I agree that some warning is a good idea.

[0] for example 2000$ for every single leaked address that they deliberately collected (if company is scared: then they should not ask user for address data! Companies very rarely actually need it, and they still ask.).

For catastrophic failures the fines certainly become very large very quickly. And follow up fines if behaviour isn't changed do go up as well. So far, it's usually the former as most companies adjust by their first fine.

The size of the fine will probably increase the value of the company and sector as it reduces model assumption for future regulatory penalties now that a precedent has been set.

Reply on news.ycombinator.com