https://www.sec.gov/Archives/edgar/data/1703056/000170305626...
2024 Home security giant ADT says it was hacked (34 points, 14 comments) https://news.ycombinator.com/item?id=41193157
2021 Home Security Tech Hacked into Cameras to Watch People Undressing and Having Sex (32 points, 6 comments) https://news.ycombinator.com/item?id=25876366
2015 How to Hack an ADT Alarm System (78 points, 68 comments) https://news.ycombinator.com/item?id=8947172
Violators of GDPR (personal data) may be fined up to €20 million, or up to 4% of the annual worldwide turnover of the preceding financial year, whichever is greater.
Under NIS2 (cybersecurity), financial penalties may be up to either €10 million or 2% of the global yearly revenue, again, whichever is the greater amount.
- CEO Ville Tapio was convicted criminally under the GDPR.
- The company failed in 2021.
- Finland's NBI tightened criminal code on privacy violations of data subjects, either intentionally or through gross negligence, if they cause damage or significant inconvenience to the data subject.
No prison time, and the conviction was overturned. Your post rather got my hopes up when it suggested that a CEO faced consequences...
They did face consequences. That ex-CEO (and CTO) also essentially had their reputations shredded, and their behavior was publicly scrutinized (have you ever seen the Comcast CEO grilled by Congress? I haven't). Sure, it would be better if they had actually gone to prison. But my point is GDPR has to teeth, unlike US state digital privacy laws.
I seem to recall some media circuses here and there about CEOs being subpoenad by Congress, for example Zuckerberg. I don't really consider that a consequence in any meaningful sense.
Apparently the appeals court also released the hacker, even though his extortion led directly to the suicide of two people, and damage to thousands of others. Maybe the GDPR was meant to have teeth, but I can't help but wonder if the Helsinki Court of Appeals is for sale.