Comment: The following analysis was done in May this year. Since then, the costs have continued skyrocketing...
GDPR is officially one year old. How have the first 12 months gone? As you can see from the mix of data and anecdotes below, it appears that compliance costs have been astronomical; individual "data rights" have led to unintended consequences; "privacy protection" seems to have undermined market competition; and there have been large unseen — but not unmeasurable! — costs in forgone startup investment. So, all-in-all, about what we expected.
GDPR cases and fines
Here is the latest data on cases and fines released by the European Data Protection Board:
- €55,955,871 in fines
- €50 million of which was a single fine on Google
- 281,088 total cases
- 144,376 complaints
- 89,271 data breach notifications
- 47,441 other
- 37.0% ongoing
- 62.9% closed
- 0.1% appealed
Comment: Google and other big corps are happy to pay the fines. But ALL small and medium businesses across the EU are currently undergoing 'compliance procedures' - audits, effectively, carried out by nominally independent agencies like accounting firms. These companies cannot afford the fines, so they're having to pay for their files being scrutinized for compliance on customers' data protection. The smallest firms are paying around 1,000 euros each...
Unintended consequences of new data privacy rights
GDPR can be thought of as a privacy "bill of rights." Many of these new rights have come with unintended consequences. If your account gets hacked, the hacker can use the right of access to get all of your data. The right to be forgotten is in conflict with the public's right to know a bad actor's history (and many of them are using the right to memory hole their misdeeds). The right to data portability creates another attack vector for hackers to exploit. And the right to opt-out of data collection creates a free-rider problem where users who opt-in subsidize the privacy of those who opt-out.















Comment: Hundreds if not thousands more will be added to that list by the time this bloodbath is through. Great governance there, EU. No wonder you're so popular in Europe...