Hacker News Reader

Comment by M2Ys4U | Hacker News Reader

> I don't think you really "sue" anyone for breaching GDPR. I think you report it to the local authorities, and then they pursue a case.

You can.

Article 79 explicitly states that data subjects have a "right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

Article 82 also states that "any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered."

View on HN

As to the theory, I stand corrected!

As to the practicality of suing for violations, how would you quantify "damaged suffered" from saving a cookie in my browser?

Remember GDPR is a general law about data collection so it could be anything, not necessarily cookies.

>As to the practicality of suing for violations, how would you quantify "damaged suffered" from saving a cookie in my browser?

The GDPR does not regulate cookies at all, at least unless they are a form of processing of personal data, so you wouldn't be able to sue for that.

It's the ePrivacy Directive that deals with cookies (and storing/accessing other data on your devices), and that lacks any sort of private cause of action, at least at the EU level. Directives (unlike Regulations) have to be transposed in to domestic law in EU member states, so depending on where you are there might be a private enforcement mechanism, but I doubt it.

It would probably be some very large number backed by a theory like "this violation has deprived the plaintiff of their ability to fully control the disposition of their private information and activities, thereby creating permanent direct and indirect risks whose damages to the plaintiff's income, income potential, business, reputation, and family are limited only by the malevolent collective imagination of an unbounded pool of individual, institutional, or governmental adversaries."

Specially in EU where largely we do not go for punitive awards. Fines yes, but not punitive awards...

Reply on news.ycombinator.com