GDPR Lessons Learned

Uncertainty and contradictions defined the first year of General Data Protection Regulation (GDPR) enforcement. 

Companies tiptoed into compliance under threat of colossal fines that would shut down their operations (€20 million or 4% of their annual global turnover, whichever is higher). However, despite the one-year anniversary of the GDPR being marked by 144,000+ complaints from users and 89,000+ reported data breaches, the fines levied in that period were relatively modest.

Analysts believe that the first year of GDPR was a teething period. As businesses continue to struggle with the law’s compliance requirements, it’s time to ask what we can learn from this transition, and where do we go from here?
GDPR Penalties Are Escalating

Other than Google being hit with a £44 million fine for lack of transparency, few companies felt the full force of the GDPR during the law’s first year. That is, until British Airways and Marriott set new records for data privacy penalties in July 2019.

British Airways was fined £183 million by the UK’s Information Commissioner's Office (ICO) after 500,000 customers’ personal data was compromised in a cyberattack. Only one day later, the ICO hit Marriott with a £99 million fine because 339 million guest records had been breached through an unsecured reservation database. 

Other fines across the EU corroborate that the GDPR’s one-year anniversary marks the end of regulator leniency. Spanish soccer league La Liga were penalised £222,000 for spying on fans, because they did not adequately explain in their terms of service that their official app activated the microphone on a user’s device during game time. 

Elsewhere, an online Polish retailer was fined £557,000 for “insufficient organizational and technical safeguards” that caused a data breach, and a Swedish school board received a fine of £16,000 when its facial recognition trial for student attendance didn’t stand up to GDPR scrutiny.

Although these fines aren’t as headline-grabbing as those against British Airways and Marriott, they do indicate that regulators believe all types of organisations have had sufficient time to understand the principles of the GDPR, and should be fined accordingly if they don’t comply. 

The key takeaway for businesses is that they can no longer be complacent about compliance — GDPR fines continue to escalate, and regulators do not discriminate.

Only the Beginning of International Privacy Laws 
The impact of the GDPR has been felt beyond its penalties, with its framework inspiring new privacy laws worldwide. A total of 107 countries have now introduced legislation to protect data privacy. For example, the California Consumer Privacy Act (CCPA) is on the horizon in the US, and is based on a model with similar principles to the GDPR.

As more laws get introduced, companies will be forced to rethink how they do business with the world. After the GDPR went into effect, over 1,000 US publications chose to shut off their content to users in the EU, either because they struggled with compliance, or didn’t think it was worth the cost.

The introduction of the GDPR has set in motion the creation of new global data boundaries, which companies must navigate with caution if they want to avoid financial consequences. In this way, any company that makes GDPR compliance a priority now is also giving itself a headstart with other international privacy laws as they come into force.

Conclusion
Regulators currently have a backlog of data breaches to process, which will likely lead to another wave of record-breaking GDPR penalties in the coming months. Moreover, while regulators have been catching up on this backlog, users have been gradually learning what new rights they have to their data.

According to a report by the ICO, 64% of data protection officers said they have seen an increase in customers and service users exercising their information rights since the GDPR came into effect on 25 May, 2018. Not only are regulators wielding their GDPR authority with more confidence, but users are becoming more aware of their data’s value - and further informed regarding the care companies must take when they process it.

From all angles, understanding compliance requirements and having a firm GDPR overview has never been more important.

___________

Simon Fogg is a legal analyst and data privacy expert for Termly. His focus for the past two years has been tracking the GDPR and its international impacts.

You Might Also Read: 

The GDPR Wake-Up Call Is Being Ignored By Business:

 

 

« Cyber Intelligence & Business Strategy
Cyber Training For Every US Federal Employee »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ComCode

ComCode

ComCode provides consulting services and solutions in the area of digitization and cyber security for mid-sized and big businesses.

CyberWrite

CyberWrite

Cyberwrite was founded to provide underwriters around the world a unique and innovative Cyber Underwriting platform.

ObjectSecurity

ObjectSecurity

ObjectSecurity is a leader in authorization policy automation. With OpenPMF, you can manage application security policies for access control and auditing.

PerimeterX

PerimeterX

PerimeterX is the leading provider of solutions that secure digital businesses against automated fraud and client-side attacks.

UM Labs

UM Labs

UM Labs is a developer of security products for Voice over IP (VoIP), protecting SIP trunk connections, safeguarding mobile phone communications and enabling BYOD.

Awen Collective

Awen Collective

Awen Collective develops software-based tools for performing Digital Forensics, Incident Response and Cyber-Crime Investigation.

Cyber Resilient Energy Delivery Consortium (CREDC)

Cyber Resilient Energy Delivery Consortium (CREDC)

CREDC performs multidisciplinary R&D in support of the Energy Sector Control Systems Working Group’s Roadmap of resilient Energy Delivery Systems (EDS).

CIRT Burkina Faso

CIRT Burkina Faso

CIRT Burkina Faso is the national Computer Incident Response Team for Burkina Faso.

24By7Security

24By7Security

24By7Security are Cybersecurity & Compliance Specialists with extensive hands on experience helping businesses build a defensive IT Infrastructure against all cyber security threats.

Adyta

Adyta

Adyta specializes in cybersecurity solutions adapted to the needs of sovereign institutions, business groups and other organizations that handle information and sensitive or classified data.

Siege Technologies

Siege Technologies

Siege Technologies is a pioneer of multi-purpose cybersecurity products and services that enable customers to leverage both offensive and defensive technologies.

Buchanan & Edwards

Buchanan & Edwards

Buchanan & Edwards delivers forward-focused technology solutions that help our clients transform the way they perform their missions.

Xmirror Security

Xmirror Security

Xmirror Security focuses on integrated detection and defense of the continuous threat to the DevSecops software supply-chain with artificial intelligence technology as the core.

BCyber

BCyber

BCyber is a Swiss Cyber Security company that provides security products, training, and managed services to protect diverse IT and OT environments against cyber, physical, and cyber-physical threats.

Vircom

Vircom

With a large majority of cyber attacks starting with email, Vircom provides protection against the worst email security threats to your business.

HLB Mann Judd (Fiji)

HLB Mann Judd (Fiji)

HLB Mann Judd (Fiji) (formerly known as HLB Crosbie & Associates) is a well-established firm of accountants and business advisers in Fiji.