Hacker News Reader

Comment by cstross | Hacker News Reader

Some crazy figures here:

The maximum fine for such a breach is 4% of the company's global revenue.

Microsoft, in 2021, turned over $168Bn. Google turned over $181.69Bn. Amazon turned over a staggering $457.96.

Between them they had a combined turnover of $807.65Bn, making them liable for a fine of up to $32.3Bn per year (assuming revenue is flat and they all get hit for the maximum penalty and don't do any kind of damage limitation).

The EU general budget in 2019 was only €148.2Bn. So such a fine would actually cover nearly 20% of the running cost of a 27 member multilateral trading entity with a population larger than the United States.

View on HN

IAB Europe is the entity being fined, not their participating partners. The linked PDF says their fine is 250k euros, which is "proportionate to the infringment" and less than the maximum.

Seems like the IAB is essentially volunteering to be the scapegoat to shield everyone else. 250k is peanuts compared to how much the industry has made breaching the GDPR over the last 4 years.

IAB's business model is broken at this point. The EU's point is that you can't rules-lawyer your way around GDPR violations by outsourcing the lawbreaking to a paid scapegoat company: having ruled the practices to be essentially illegal, this is going to end up being kicked up a level to the big advertising corporations themselves (by which I mean: Google, Amazon, Microsoft).

> this is going to end up being kicked up a level to the big advertising corporations themselves

When? In a century?

It took them years to reach a conclusion that even a layman skim-reading the GDPR would reach in an hour.

> making them liable for a fine of up to $32.3Bn per year

> their fine is 250k euros

massive disconnect between reality and imaginary worlds.

System is very broken if they can avoid liability with this.

When the GDPR was first becoming law/being talked about a lot, I recall there being a lot of posts from people in Europe explaining to us Americans one of the major differences between the European system of regulations and ours, which I will paraphrase to the best of my understanding:

When the EU sets a maximum fine level, that's there to give their courts discretion to drop the hammer on companies that have clearly been abusive. Expected practice there is more generally to lead with something that's more of a warning. Then, if they do it again, they can escalate toward the maximum.

The 32.3 billion figure there was the maximum possible fine for the combination of Microsoft, Google, and Amazon. Personally, I'm unclear on whether anyone besides IAB is currently being fined, but in either case, the point here appears to be to send the message "what you're doing isn't OK, clean it up now" rather than "all your revenue are belong to us".

For now.

That's pretty much it. Intent matters. A lot. Unless there's evidence suggesting they deliberately broke the law, the fine is going to be rather low.

If they keep doing it, they can't say they intended to follow the law, and they'll be punished more severely.

Reply on news.ycombinator.com