The goal of this article is not to review if this measure is efficient but rather what is the impact for business. The French agency, the CNIL, keeps a list of all given sanctions through time. We will use an AI-pumped parser and a bit of data science to analyze the past of GDPR sanctions. It is all open-source so that you can check the methodology and report issues if any.

Fair warning however, as always with statistics they are merely matching a story their writer wants to tell. Your company can be prosecuted on any given point of the law and the distributed fines are as much a reflection if the current state of the industry than of the CNIL’s priorities. If nobody had Consent Management Platforms (CMPs) in place, the rate of fines on this topic could be higher, for example.

Given our goal of figuring what are actually the things that will get you fined, a decent first question to look at is the rate of companies getting fined. If only a few every year there would be nothing to worry about, but if the practice is widespread then it becomes a bit more scary.

Two things come up as striking from this graph:

• There is a huge spike in 2021 in terms of the sum of sanctions. This year CNIL woke up and chose violence against the GAFAM. Google and Facebook received fines of respectively 150 and 60 million euros for their cookie policies. The rest of fines is actually pretty moderate.

• The total amount of fines given is increasing seemingly exponentially through time, while the total collected value is decreasing. This is raising the next question: what exactly is the distribution of those sanctions?

Now is probably a good time to point out that in the world of GDPR, fines are mostly proportional to the revenue of the company. They are sized to be painful for your business whilst also not endangering it. Seeing the fined amount is a good way to realize which sizes of companies are being sued. This is also why this article mostly avoids counting the absolute value of fines, as it would not be comparable between cases.

Note — All fines in 2018 are in the 0-1k slice because on the CNIL’s page amounts are not written for 2018. But it’s not too problematic in the sense that most of what we are looking at is the count of sanctions rather than their amount. This will definitely create some noise further down, however.

The 1M+ slices represent mostly big companies (Google, Amazon, Yahoo, Criteo, … you see the kind). Those are notoriously invading privacy of individuals at a massive scale, which explains some constant action in that range. But in comparison to the bulk of the activity this looks pretty exceptionnal. Let’s focus more on the bulk of the sanctions.

In that regard, the 100k-1M column — which represents national companies (TV channels, telcos, etc) — is definitely having some constant action. It got dilluted in 2023 but the absolute value stays equivalent. This will be the most interesting slice to unfold.

And finally you can see a sharp 2023 increase in the 1k-10k slice — small companies such as web agencies — meaning that this raise in sanctions counts that we have seen in the first graph can be attributed to an increased focus on smaller actors.

This looks to be the first major shift in strategy since the beginning: since 2023, small actors are being targetted at a significantly increased rate while large corporations where the previous focus.

But what are those sections about? Is it all about cookies, or is there more to this law than CMPs?

What appears here is a rather balanced picture of different categories all being pursued more or less equally. The most obvious thing is that 2018 is nothing like other years, so I guess they had to start by finding their mark.

Something that seems to emerge as well is a stronger focus on the core company organization. Instead of just wondering if you violate people’s privacy, it is also important to look at how well structured your company is to ensure that the law is applied, whether you design your application to be private or you work properly with your third parties.

Now which of those measures should you be worried about?

Obviously anyone can get hit anywhere and it is going to be hard to make a generic rule. But let’s look at some trends.

First let’s see about cookies and trackers. With so much noise surrounding them, are they so important? Turns out that, not so much. They definitely have been the platform used to battle the GAFAMs, but the smaller the company size and the least important it becomes.

Related to cookies, a line is emerging on consent. But it’s not only cookie consent. Rather, it’s the generic collection of consent for everything that should require it — from ads cookies to receiving commercial emails and everything in between. It is important to disconnect the concept of consent from the concept of cookies. The law never actually mentions cookies, it’s all about what you do with the data and how you justify it.

Talking of justification, this is clearly what emerges on the small red island in the 1k-100k range (web agencies and such). Things that hurt the most are not so much direct violations of the law but rather the lack of measures to apply and justify it. The message is clear, any company of any size should:

• Maintain a register of all PII data processing

• Justify appropriately every single processing that is done1

• Having a DPO in charge of guaranteeing that this work is done and able to talk with authorities

While this is not what bigger companies seem to be lacking of, you can see that they are rather plagued by what is most likely legacy.

A first focus is to be made on security-minded topics. You can see recurring mentions of:

• Data minimization and expiration — limiting the attack surface to exactly what you need and no more

• Data breach handling — you need to have proper security in place to avoid data breach, but you should also be transparent with your customers when their data gets leaked into the wild

• Special categories of data — medical data for example requires a specific care, which is not always given

And then comes in the straight-out malicious data processing:

• Improper commercial prospection

• Lack of information and transparency

• Refusal of user’s rights (portability, opt-out, etc)

Let us also take note of something notably missing from the list of sanctions: not a single mention of using a hosting/cloud provider that is not EU-owned. Nobody got sued for using AWS, DigitalOcean or any other american hosting company. When you see that some of the sanctions are extremely specific, if this was on the map at all there would at least be a trace of it.

It is also worth mentioning that it doesn’t look like data processors got into any trouble. There are some examples of controller/processor relationships being sanctionned but it seems like most of the responsibility falls on the shoulders of the controller.

Overall, lots of categories are used few times and it is clear that the CNIL will target anything they can. But emerging patterns also come to show that a lot of focus is given not only on what you do but also how you do it. The main requirement of GDPR in the end is that you care about PII.

Conclusion

Is GDPR hurting innovation? Should you be afraid of getting fined?

After initial years that were mostly focused on crucifying GAFAMs, it seems that the CNIL is getting a knack for smaller players as well. We don’t know yet how many sanctions will fall in 2024, but the rise in 2023 has been steep.

It is also becoming obvious that the infractions that companies will be sued for highly depend on the company size due to both the practices required to operate at this company scale and the tendency to invest or not in PII management. As such, here are the recommendations of what to change depending on your company size.

Global companies — GAFAMs and other big players in web marketing

• Notch it down on World Domination

National companies — TV channels, telcos and other companies operating at a national level

• Assign a budget on sanitizing your data management. Eventually you will have to spend this money either as a GDPR fine, or as a hack ransom then as a GDPR fine. If you do it as an afterthought, the outcome will be a superficial façade falling at the first push.

• The same goes for letting users exert their rights. It needs to be built-in into your tools and processes, otherwise it will not happen when you need it.

• There are a bunch of forbidden commercial practices that you cannot be having anymore, indeed.

SMEs — Smaller local businesses, startups in initial stages, web agencies but also the local doctor for example

• Make sure to empower one person to be responsible for data management

• Keep a register up-to-date with all PII processing and appropriate justifications

So what of our question? Is GDPR hurting businesses? There is no denying that this regulation forces companies of all sizes to assign budgets on items that do not have a direct ROI, under the threat of a fine.

On the other hand, this serves to protect companies from themselves. The principles of data security for example are forcing down a much better hygiene which will over time save big houshold names from massive ransoms and data breaches. The industry still needs to gain a tremendous amount of maturity on the topic — this is but a push in the right direction.

The same goes with commercial opportunities. Have you seen the Mad Men episode about Lucky Strike? This is a similar situation. If you can’t do it, neither can your competitors. This is not the scope of this article, but you can imagine that the damage is not so great provided that everyone respects the law.

Which all leaves us with a mixed feeling. On one hand this is acting for the betterment of European society and has important positive externalities — a safer online experience for all of us. But it is only driven by the stick. Instead of giving huge tax credits for often bogus R&D2, maybe a little help to the most vulnerable businesses could help them keep their books in order.

So how do you increase the amount of decisions you can take? In a way you can’t, because of what I said. But on the other hand, you can by focusing yourself on the decisions that matter.

The question now becomes: how do you automate the decisions that do not matter? Some call me psycho, but here are the strategies that I’ve applied throughout my life to avoid useless choices.

Time management

Managing your time and priorities is a daunting task. A million things more urgent one than the other try to grab your attention. And if you’re like me, most likely you will just hyperfocus on the fun thing of the moment and forget completely about the rest. Which for the longest time has been my time management technique: just focus on one thing at a time, for one month or more straight.

And if you are bootstrapping it’s probably fine even though it can hurt you in the sense that you get completely blindsided by what you are doing and never take the time to do basic things such as checking for competitors, exploring advices that you’ve received or even simply looking for solutions that are not 100% in-house development.

Instead, you need to get a scheduler such as Reclaim, which is now my god and master, commanding my actions through my agenda.

The first thing it does is take a todo list and schedule it. If I’m able to break down the things I have to do into small, actionable tasks (that can later be extended or shortened) then it will automatically schedule all of them around my meetings and other obligations, while also making sure that everything moves in parallel and in accordance with their respective priorities and deadlines.

The other thing is that it allows to plan 1:1 meetings with your team. As you become a manager it’s essential to talk to your developers regularly and if you’re like me with no notion of time then 6 months can happen without realizing you didn’t follow up on anyone from your team. It will find the time for this in your agenda and make it happen.

Lastly it will allow you to have various rituals like checking your mails or monitoring tools. Super useful to keep an eye on things regularly while also working like crazy on other stuff.

Overall, Reclaim has massively decreased the amount of decisions that I need to take on a weekly basis, allowed me to multitask while it was previously impossible for me and also allows me to have an idea of when I’m going to be able to deliver a specific task.

Food

Don’t get me wrong I am a huge foodie and in fact spend most of my holidays hunting down restaurants and bars to discover local tastes. But let’s not get confused: there is eating as a hobby and there is eating because otherwise you’ll faint on your keyboard. I’m talking about the second one here.

Depending on your personal preferences, revenue levels and overall situation, different tactics can apply. For myself I’ve had the following ones:

Frozen dishes. The basic version is to go to your local frozen foods supermarket (Picard in France), stack up a month’s worth of food in your cart and store this in your freezer. While highly criticized by friends and roomates for this practices, I believe that it is a relatively balanced and extremely efficient way of managing your meals. Not to mention cheap, since I’ve basically been going through my student years and early entrepreneur stages with this technique.

Food subscriptions. In the same vein but definitely tastier and healthier you will see subscription services like Wetaca in Spain. Did not always exist, not sure how easy is it to find over the globe, but overall a cheap and efficient way to get relatively balanced meals. It’s what I’m currently doing most of the time and it’s great, they even change the menu for me and I don’t need to decide anything.

Recipe round-robin. Entrepreneur life has highs and lows and there was a short period during which I had to dip below the poverty line. Not a great time but probably the healthiest eating habits I’ve ever had. What I did was create about 5 to 10 recipes that took 5 minutes to cook then go to the market every week-end to buy the products directly from the producer and then cook just those recipes on repeat.

Fast-food obsession. My theory about fast food is that it’s only good if you can eat it every day of the week at every meal. When I lived in India I used to work in an IT building where all there restaurants were of a mediocre quality and it was becoming quite hard to alternate between the same dishes all the time. Eventually I ended up eating McDonald’s for every literal meal from breakfast to dinner. Never lost so much weight so fast for some reason. Anyways, it’s not a healthy option but if you don’t abuse you can get through a hard year or two without issue using this strategy.

Overall, it’s important to place your bets in accordance to what works for you.

Transport

So surely you’ll want to move around. For example to go to work, to meet clients, etc. Let’s see how you can avoid useless pain in the process.

The first strategy to optimize transport is to not need transport. Start your company from your home, work remotely and save up on an office, etc. Can be daunting for the mental health, but for a time it is a good fix.

Another important point — except if you’re american I guess? — is to live in a densely populated area. By having all necessities close-by you avoid yourself complicated trips and can instead walk there most of the time. Which is especially important for the next point as well…

Don’t have a car. Cars are commonly known as money hogs because of the price you need to pay and on top of all the mechanical issues you’re going to get with it. People reading this claim that this statement is due to the fact I don’t have a driver’s license — and it is linked — but it’s also that up until recently I could not afford one in terms of costs and in terms of mental load. Instead, public transportation, taxis or car rental can often be a more economic option and a much lower mental load. Of course, YMMV.

Shopping

During my early years as an entrepreneur, the Christmas period was quite a stressful one. On top of being generally a very dense period in terms of work — client’s budgets need to be spent before the end of the year — you also need to think which gifts you’re going to get for your family. And when you pay yourself with one peanut on a half, the issue becomes quite the balancing act.

You basically end up going around all the shops of the city center fishing for ideas and taking notes of what could potentially be the best combination of things you could generate.

This was an issue until I realized that all I had to do — and sorry if it sounds obvious to everyone now — was to shop online. Instead of physically spending your energy walking a hundred thousand steps over your Saturday afternoon, you can simply switch from tab to tab, order and wait for things to arrive home.

These days I’m almost never buying anything in physical stores. Which can be pushed even further with delivery apps. Since they allow you to search items by name it gives you an index of all the objects and brands you can find in various stores. Want to drink your favorite kind of beer within the next 30 minutes and you don’t know where to find it? Type the name in Glovo and you’ll get a completely random kebab shop open at 2am which can ship it to you.

Administrative emails

If you’re like me you probably hate replying to emails, especially those that have few connection to your actual business. Administrative stuff, tax declarations, getting refunds from an e-commerce, etc. But I’ve managed to lower the cost of doing so substencially by using ChatGPT in a strategic way.

First I’ll take the email/message and ask ChatGPT to summarize what it says, figure what they want from me and give me options of what actions I could take.

Then I’ll pick an option and ask ChatGPT to reply accordingly. I’ll say it in my words, not constructed, not polite. And then it will write an nice long polite answer that says exactly what I need. Copy/pasta, send and done. Such a relief to proceed this way!

Entertainment

It’s important as a founder to change your mind from work regularly, otherwise you’d just become completely crazy. In terms of entertainment however, everyone got their jam so I’m not going to get super exhaustive, but let’s throw a few ideas.

Obviously everyone is going to have some kind of VOD subscription, but I also like to structure my entertainment around no-decision options.

It’s going to sound dumb, but TV is a good option. Especially paid cinema channels. Turn on your TV in the evening on a channel that you know you enjoy and you’ll for sure see something fresh wihtout spending any neuron on chosing it. On top if that it can rythm your day if you work from home and give you a motivation to stop working.

Another thing I like to do is to show up in big bobo cinema in the heart of Paris and picking a movie randomly on a combination of what is showing in the next hour and what posters are catching my eye. No reading synopsis, nor thinking what the movie is going to be about… I’ve seen amazing movies like that, totally recommend.

Conclusion

You could read this article thinking: why is idiot flaunting his lazyness over the Internet, but that would be missing the point. Throughout my life I’ve had to deal with a termendous workload and fairly low executive planning skills. You cannot do it all. And yes a lot of the techniques mentioned here are individually obvious if you start considering the issue but what matters most is to create for yourself a consistent way of life with the right combination of everything that makes your life as unloaded as possible, leaving your brain free to think what will make a difference in your business.