It is remarkable that large corporations do not employ many people in their organisations that have the foresight to warn their Directors that what they might be doing will not only subject them to record breaking fines by the EU, but will also cost them billions. I had time to ponder this while going through several evasive security checks the other day at a bank that was one of the past winners of an EU fine. The EU not only sets a fine on large corporations for violations of competition and anti-trust, they also will target fines on violations of GDPR to anyone worldwide who does not respect the privacy rights of a European citizen or company connected in some way to the EU. Fines have a set standard but could be more or less broad, often involving a certain percentage of the company’s global value. Because the EU will go after profits the company obtained outside of the EU, it makes these fines very large, and theoretically acts as an effective deterrent against the problematic actions taken by the company. This week, Google received its third penalty from the EU and was fined 1.5 billion Euros for abusing its market dominance by restricting third-party rivals from displaying search ads between 2006 and 2016.
While the EU is known for setting strict fines, and the US anti-trust authorities often target the same violations and add fines independently themselves. It is not as if EU penalties are a new phenomenon, as record breaking fines by the EU have been placed over ten years ago on companies like Microsoft. With the GDPR it becomes even more interesting. In theory, someone who was born in Germany over forty years ago but lived abroad the entire time might be able to file a complaint against the country they immigrated to for violating their privacy rights via a foreign non-EU bank operating in that third country. An evasive non-European government policy that affects someone connected to the EU may produce a right for the EU to penalise the other government if they violate the privacy rights of an EU citizen. Theoretically, if a foreign government allowed a large corporation to violate the GDPR of one of its citizens abroad, with support of the foreign government, it could allow the EU to punish corrupt foreign practices via a privacy rights violation. This would be a very broad and unlikely application of the GDPR or the role of the EU Commission itself, but companies should assume the risk in any case.
Sanctions as well as penalties are often justified in order to limit financing of organsations that create harm to individuals and groups. Effective application of these acts and pieces of legislation promote open and transparent governments, even when those same governments block access to duly owed information or act in the interests of a private company over the interests of people and their democracy. It is hard to justify that the actions of a large company or a government bending the rules to support that company benefits citizens. Even if the action was done in the past, the damage to their competitors and consumers was done. Even if done in the past, damage to a democratic system has taken hold, and if a large fine is the best or only method to challenge such power, it should be that companies take responsibility for their own actions, and pay when they violate everyone else’s rights.
