By Michelle Drolet
Founder & CEO
Ms. Drolet is responsible for all aspects of business for Towerwall. She has more than 24 years of,
Read More3 Minute 32 Second Read
October 23, 2017
The high ceiling on fines that will come in with GDPR will give data regulators much greater punitive power, in theory. In practice, we simply don’t know how fines will be levied.
Maximum fines are rare, but there’s currently a great deal of variance from country to country. For example, in the U.K. the Information Commissioner’s Office can issue fines up to 500,000 GBP, but the highest fine to date was 400,000 GBP ($532,158) for telecoms company TalkTalk, after a major data breach that exposed the names, addresses, dates of birth, phone numbers and email addresses of more than 150,000 customers, and bank account details and sort codes for thousands.
There’s some debate about whether high fines will be levied, and in what circumstances, but it’s possible that some data regulators will want to send a clear message by making an example of a company for non-compliance. Apparently, the European Data Protection Board (EDPB) will offer guidance on fines, but that guidance is not yet available and the first few cases are liable to set a precedent.
The risk of GDPR fines isn’t just the fine amount, but also the fact that your company name will appear in headlines associated with a lack of security. The lasting damage to your brand is hard to quantify, but it seems likely that people concerned about privacy will avoid the brand if an association is made. In the aftermath of TalkTalk’s breach, for example, the company lost more than 100,000 customers.
A severe fine for non-compliance will generate a lot of news stories and any potential customer researching their options may find those stories and be influenced by them for years to come. The way companies collect and use data is coming under increasing scrutiny as privacy concerns among consumers grow, and that trend is only going to increase. Why take the risk?
With uncertainty about the level of fines that will be imposed, businesses need to invest some time and resources into researching GDPR. When Vanson Bourne surveyed 1,600 organizations, it found that 37% of respondents don’t know whether their organization needs to comply with GDPR, while 28% believe they don’t need to comply at all. Ignorance will not provide any protection from fines.
Compliance is a smart move, not just to avoid fines, but to safeguard your customer data. For the most part, the requirements are formalizing a set of principles that you should already be applying. Assess your privacy, hire or appoint a data protection officer, create a data breach plan that includes clear notification within 72 hours, and make sure you know where your data is at all times. Preparing for GDPR compliance is hardly an insurmountable task.
If this prompts companies to review the data they collect and assess whether they need to store it, then that’s a good thing. Too many companies have a data hoarding attitude and it creates unnecessary risk. There’s also no excuse for neglecting to create clear consent forms and privacy policies. Ultimately, companies should not be treating data protection as optional.
We can’t say for sure what non-compliance with GDPR will cost you, but there’s a good chance it will prove more expensive than compliance, and that’s the point.
Cookie | Duration | Description |
---|---|---|
cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |