INTRO

1. Since the new General Data Protection Regulation (GDPR) came into effect on 25 May 2018, the focus on data is more significant than ever, and the price for companies who fail to protect their data has never been more costly.
2. As it’s not yet been a year since the new regulation came into effect, we’ve yet to see many fines issued.
3. However, reports show that data breach complaints have increased by 160% since GDPR came into force.
4. This increase is worrying news for businesses, considering the scale of the fines they could be handed, and it shows just how critical it is that companies ensure their staff are trained in everything they need to know about GDPR.

ICO UK 2018

1. 2018 was a busy year for the ICO, the ICO has issued a notice to a Canadian data analytics company, AggregateIQ Data Services Ltd, to stop using EU citizens’ personal data for analytics.
2. The ICO issued the most – and most significant – fines ever in 2018, including:
   1. 11 fines totalling £1,290,000 to organisations for serious security failures
   2. 11 fines totalling £138,000 to UK charities for unlawfully processing personal data in the 12 months to March 2018
   3. The maximum penalty in 2018 was £500,000, issued to both Facebook and Equifax, a consumer credit reporting agency.

The most significant fines under GDPR in europe

FRANCE

1. In January this year, Google was fined a staggering €50 million, the most substantial and most high-profile fine for GDPR violations.
2. The fine was issued by the Commission Nationale de l’informatique et des libertés (CNIL), France’s data protection supervisory authority, for lack of transparency, inadequate information, and lack of valid consent regarding ads personalisation. We covered the story in detail in our January edition of Compliance News, where we examined the exact rules that Google broke.

 PORTUGAL

1. A hospital in Portugal has also received a relatively hefty fine of €400,000 for GDPR violations. The Centro Hospitalar Barreiro Montijo was found to have committed three major violations:
   1. A minimisation principle, by allowing indiscriminate access to an excessive number of users
   2. A breach of integrity and confidentiality as a result of non-application of technical and organisational measures to prevent unlawful access to personal data
   3. Failing to ensure the continued confidentiality, integrity, availability, and resilience of treatment systems and services as well as the non-implementation of the technical and organisational measures to provide a level of security adequate to the risk.

GERMANY

1. a German company was fined €20,000 after the personal data of 330,000 users of its chat platform was compromised and then made publicly available by hackers in September 2018.

AUSTRIA

1. In Austria, one company received a fairly average €4,800 fine for installing a CCTV camera in front of their building but which also recorded images from a large part of the pavement.
2. Large-scale monitoring of public spaces is not permitted under GDPR.

Pre GDPR Facebook Equifax Yahoo

1. Facebook was slapped with the £500,000 fine for its role in the well-documented Cambridge Analytica scandal.
   1. The information of 87 million Facebook users was improperly shared with the political consultancy through a quiz that collected data from participants and their friends.
   2. Facebook was found guilty of allowing application developers access to user information without sufficient consent, failing to make proper checks to secure personal information, and not taking action once the misuse of data was discovered.
2. Equifax was fined £500,000 after failing to protect the personal information of up to 15 million UK customers during a cyber attack.
   1. Hackers stole personal data including names, dates of birth, addresses, passwords, driving licences and financial details. The company had retained data for longer than necessary, making it vulnerable to unauthorised access.
   2. The systems compromised were based in the US, but because the UK branch failed to ensure its American parent was protecting UK customers, the ICO was forced to issue the fine.

3. Yahoo currently wears the crown for the most significant data breach of the 21st century.
   1. In September 2016, the internet giant revealed that its 2014 data breach had compromised the personal data of 500 million users. Later that year, another breach from 2013 came to light that had compromised 1 billion accounts.
   2. That’s one for every seven or eight people on the planet!
   3. But the full extent of the multiple breaches was not acknowledged until October 2017, when Yahoo’s new owner Verizon discovered it was not 1 billion accounts that had been compromised in 2013, but 3 billion accounts!
   4. That’s every single account under the Yahoo name, including Flickr and Tumblr.
   5. The breaches knocked a considerable chunk off Yahoo’s sale price – to the tune of $350 million.
   6. Having once been valued at $100 billion, Verizon paid just $4.48 billion for the core internet business.
   7. In October last year, Yahoo agreed to pay $50 million in damages – of which Verizon will pay half and the other by Altaba, Inc. (Yahoo changed its name to Altaba after the sale of its core business).

But all this was before GDPR came into effect…

1. The fines issued to both Facebook and Equifax were imposed under the Data Protection Act (DPA), where £500,000 was the maximum penalty.
   1. Had their failings been discovered and investigated now, they would have faced significantly higher fines.
   2. Under GDPR, companies can now expect fines of up to:

i.€10,000,000 (£8.8 million) or 2% of total global annual turnover (whichever is higher) for lesser data breach incidents.

ii.€20,000,000 (£17.6 million) or 4% of total global yearly turnover (whichever is higher) for significant data breaches.

But, what would have happened if this breach had taken place post-GDPR?

1. Of course, the scope of the breach was significant.
2. But, what would have been crucial today, was that Yahoo didn’t disclose the extent of the breach within 72 hours as the GDPR requires.
3. And with revenue more than $4 billion for the year 2012/2013, Yahoo would have faced an $80 million fine, or potentially as much as $160 million!
4. The massive jump in maximum fines for data breaches in the UK, from £500,000 to £8.8 million or even £17.6 million, show the significant lengths regulators are taking to protect people’s personal data and privacy.

Source