I'm being told that the EU would never pursue that with a small business and they'd just tell you what you need to fix.
That also sounds weird to me as an American. I'm not saying it isn't true, just that it's not the way I'm used to thinking about laws.
Look at the US COPPA, with potentially $41,000 per violation. Why isn't this more scary for American website operators? https://www.ftc.gov/tips-advice/business-center/guidance/com...
> A court can hold operators who violate the Rule liable for civil penalties of up to $41,484 per violation. The amount of civil penalties a court assesses may turn on a number of factors, including the egregiousness of the violations, whether the operator has previously violated the Rule, the number of children involved, the amount and type of personal information collected, how the information was used, whether it was shared with third parties, and the size of the company. Information about the FTC’s COPPA enforcement actions, including the amounts of civil penalties obtained, can be found by clicking on the Case Highlights link in the FTC’s Business Center.
I mean, any US website that's compliant with COPPA should find GDPR to be a doddle.
https://corporate.findlaw.com/law-library/ftc-imposes-larges...
The equivalent reaction for GDPR would be if everyone either started making half-hearted efforts to block European users (which isn't what EU wants), or if everyone forced all of their users to agree to the same data collection before they signed up (which as far as I can tell is not legal).
From the law:
> However, an operator of a general audience site or service that chooses to screen its users for age in a neutral fashion may rely on the age information its users enter, even if that age information is not accurate.
This line is basically the entire reason why COPPA is generally not seen as a problem for US businesses.
Are we sure about that? GDPR seems like a gift to European startups who don’t like American competition. BlaBlah car in France got huge, incidentally right around the time the anti-Uber hysteria in France reaches a peak. The sale of Daily Motion to Yahoo was blocked by the French government under ridiculous national economic interest grounds. Europe loves tariffs and trade barriers and they have a history of “protecting” the public from competition. Try shipping spare parts for a child’s stroller to France — I was taxed at 50% — the tax even applying to the shipping fee, not just the parts. My dad made the mistake of sending kids clothes to my kids with the tags still on them — $100 worth of clothes cost me €65 in duties. When I ship small amounts of stuff to the US, I literally have never had to pay a tax. The EU loves protectionism. Farmers literally set fires and throw rocks when Spanish wine crosses into France and the authorities don’t prosecute a single person. Now that EU countries have a bunch of lotteries tickets with American tech companies, the governments are likely foaming at the mouth with excitement over fining American companies. And, sadly, many people in Europe actually think this is about privacy.
For past experience with German privacy regulators (as an example, since our old law was fairly strict too), I'll quote a recent comment of mine:
From what I know, the German DPAs (they are organized on state level) hand out like 2 fines per month each, generally way below the maxima (under old German law, the max was 300000 €), and concluding the majority of cases without a fine. E.g. from the Bavarian DPA (german doc: https://www.lda.bayern.de/media/baylda_report_07.pdf, page 151):
in the years 2015-2016 they had 173 proceedings that involved potential fines. 52 of those resulted in fines. 34 of those fines were <1k€, 13 were <10k€.
If that's the case then I suspect you'll see fewer companies panicking over time. It may just take an adjustment period for companies to realize, "Oh, this legislation isn't actually filled with hidden land mines."
Or you can incorporate outside of the EU (Guernsey or soon enough the UK perhaps?) and ignore the GDPR. At which point we'll just wait and see if the EU has any teeth outside its jurisdiction and how it will enforce this law.
https://government.diginomica.com/2017/08/10/ico-maximum-fin...
