GDPR fines hit a new level

[Suff]

Back in 2018 I was writing the controls which allowed British American Tobacco to manage the risk of GDPR and evidence (prove in documented format), that they were operating GDPR within the rules.

I got into an argument with the legal counsel for telling the truth. I put the real possible exposure to GDPR in terms of fines into the presentation. She had been lowballing it in a HUGE way. The real exposure was £80m, and £40m respectively depending on which part you breached.

She gave me a really hard time and told me that even £10m wold be a disaster and "anyway", based on existing laws, nobody was going to see more then £10m in fines.

That didn't age well. 2 months after I left BA was hit with a £128m, fine. Since then Google has been hit with over €740m. But now we have a new high. Meta was just slammed with a €1.2bn fine for moving customers data outside of the EU and into their US datacentres.

This can only go on for so long. Meta says they are monitoring the current negotiations between the US and the EU on this situation and will comply with anything they agree. However if no agreement can be made, they may need to pull services.

Just imagine the "public service" GDPR will have given to the people if Meta were to pull Facebook, Whatsapp and Instagram from the EU. If only for a week. Theoretically the UK would have to be pulled too as we operate the same laws given that we didn't repeal them.

These fines have now reached such a level that they start to look like taxes.

[Workingman]

Ah bless, so organisations that play fast and loose with my personal data, in contravention of the 1950 declaration in the European Convention on Human Rights, can now be fined (heavily) due to EU law.

Good! Is my opinion.

And pulling Facebook, Instagram, Twitter, TikTok etc. would be fine by me.

Of course there is a way for organisations to avoid these fines: don't break the law. Simples! That's what I hear when I watch such things as Police Interceptors, Highway Patrol and so on. "If you do not want pulling over then don't break the law". If that's good enough for individuals then it is good enough for big tech companies as far as I am concerned.

[Suff]

I know what you are saying. If there is a company that needs a really good slapping, it's Meta.

There is some merit in it and at the same time there is some form of unreality.

Meta has 1.5bn users. The EU is less than 0.5bn people and clearly not all of them are Meta users. Which means they need to handle data and administrate accounts globally.

6% of net income for 2022/23? One more of these and it will be cheaper to simply rip the entire infra out of the EU, shut down the Irish company denying the Irish their taxes and then tell all their users that their accounts have been moved out of the EU and put up a site to force them to accept the move and sign on.

How many EU Built competing products are there? Do remind me again. SAP, 48% of all software product revenue in the EU, followed by Dassault systems then Sage in the UK with Wincor Nixdorf 4th. Only Sage is consumer but, of course, the UK Is Europe and not the EU.

Whilst I do not see that happening soon, I do see it as an eventual end game. This will become more obvious if the businesses in the EU start to wind down. They have also slapped Google with near $1bn fines and are intending to keep going. As the vast majority of the software companies that provide consumer products are US based, it means that the US is being punished the most.

The US also has the ability to enact laws like this then start "punishing" EU companies. We want to avoid this at all costs. Especially as EU GDP is now MUCH smaller than the US (in fact now smaller than China) and so the relative impact of retaliatory regulations much larger. The UK will get sucked into this because we also implement GDPR.

They have a new hobby horse and are riding it as hard as they can. Unfortunately it is wearing itself through the floor.