[WheatMillington]

All you have to do is respect the law and respect your customers. Absolutely the most basic thing we can ask of a new business.

[7bit]

The issue lies somewhere in between.

I agree that businesses who unlawfully sell your data or do not implement a minimum of security measures should be punished hard.

I also agree that a flat 5000 € is problematic. Not because I believe that breaking the law shouldn't be punished. It's because you also get punished if you protect the data and respect your customers, but you don't document the thousand things you must document as a small business.

I don't know if you ever looked at GDPR, but that does not distinguish between a company with five employees and 50,000 employees.

The company with 5 employees must exactly (!!!) implement the same audit trail and processes that the 50,000 employee company has to do. Or worse, there's literally no difference between you founding a company and Facebook.

This shit gets extremely overwhelming extremely fast and that's just killing small businesses.

[latexr]

As someone with experience with it, I heartedly disagree. It’s not that hard to not invade user privacy. You have to go out of your way to be invasive, just respect your users and collect as little data possible. That’s truly the way to go and reduces your liability in a multitude of ways, including protecting you of data breaches (if you don’t keep the data, there’s nothing to steal).