Data Protection Regulators Cracking Down on Privacy Violations

Data regulators are issuing more fines than ever before, here’s what you need to know to avoid getting caught in the crosshairs.

The enaction of the EU’s General Data Protection (GDPR) law in May 2018 was a landmark moment in the field of data protection and privacy. Developed in response to surging levels of digital data collection, the legislation sought to strengthen, modernise and harmonise individuals’ data privacy rights across the EU, as well as ensure personal data is better protected from cyber threat actors. 

GDPR was first passed in 2016, giving organizations plenty of time to comply with the new data protection and processing obligations before it came into force.

The new rules were backed up with considerable clout, with regulators authorized to issue fines of up to a maximum value of €20m ($21m) or 4% of annual global turnover, whichever is higher, for privacy or data protection violations.

Since the GDPR came into force, many other countries have passed their own new privacy laws, based upon similar principles. In the US, these include the California Consumer Privacy Act (CCPA), the Virginia Consumer Data Protection Act (CDPA) and the Utah Consumer Privacy Act (UCPA), and many experts believe a federal privacy law is a possibility in the near future.

Other major economies, such as China, India and Brazil, are also planning, or have already passed their own updated data privacy legislation in the past few years.

The GDPR and other data privacy laws have generated plenty of publicity. But to date, just how far have regulators been willing to go to enforce these new rules?

Despite the enormous significance of the GDPR on paper, it was apparent that many organizations were ill-prepared to comply with the regulation when it came into force on May 25, 2018. For example, research from 2017 found that a staggering 84% of small UK business owners were unaware of the forthcoming GDPR. Further research, published in April 2018, found that just a third of websites in the EU had updated their privacy policy in line with the GDPR provisions.

A mixture of the financial cost involved and lethargy are the most likely contributing factors for this inaction.

Partly as a result of this lack of preparedness, regulators took a relatively light touch to punishing GDPR violations during the first three years of its existence. For example, just 0.25% of data breach cases handled by the UK’s Information Commissioner’s Office (ICO) in the first year of the GDPR resulted in fines.

Additionally, in several cases during those first few years, initial intentions to levy heavy penalties were later substantially scaled back. For example, in July 2019, British Airways (BA) was hit with a £183m ($230m) fine after failing to prevent around half a million customers’ data being breached in a digital skimming attack. However, this was reduced to just £20m ($26m) in October 2020, with the ICO citing the economic impact of COVID-19 on the business as the reason for the reduction.

In another case, the ICO’s intention to fine hotel chain Marriott International £99m ($123m) after around 339 million guest records were exposed in a data breach was watered down to £18.4m ($23.8m) following representations from the firm.

From July 2018, when the first ever GDPR fine was issued, through to June 2021, there were a total of 713 fines levied, at a cumulative value of around €294.5m ($359.7m). This represented a rather low-key opening few years of the GDPR. 

Enjoyed this article? Make sure to share it!

Looking for something else?