25th May 2018 has passed, the F.U.D. (Fear, Uncertainty and Doubt) pedalled by consultancies, software companies and (some) certified data protection experts has mainly dissipated into the ether.
For some, it was a repeat of the "Millennium Bug", which was seen by some as a damp squib.
Technical Control inadequacies
However it takes the data protection authorities (DPA) to adjust to the new normal. We are starting to see what the various DPA have been up to in the European Union.
The various DPA or Supervisory Authorities (SA) have just got into their stride. The infractions centre around insufficient transparency and inadequate technical measures.
Non-technical shortcomings - Article 15 - Subject Access Requests
Research from cloud data firm Talend reveals that the scale stretches far beyond technology firms, with an estimated 74 per cent of UK organisations failing to address requests from individuals seeking to get hold of their personal data within the one-month specified time period. The research, which is based on personal data requests made to 23 companies based or operating in the UK, found that only 17 per cent of companies complied correctly with the requests, while a further 9 per cent gave incomplete or delayed responses. This is likely to be another source of GDPR transgressions.
What will organisations do in the face of the notices and fines?
It'll remains to be seen which approach the large corporations will take; they may want to try the route of legal appeals, with the sole intention of dragging all concerned into the courtroom for years, I don't think the European judicial system will allow such shenanigans though, the DPA will probably take a very dim view of this if any one tried it on. (* just my lay person opinion, I have no legal training in litigation).
Why the (potential of) large fines?
People and business largely ignored the Data Protection 95/46/EC directive and things have moved on, literally with personal data held in the "cloud" and by mega-corporations located in third-countries (any country outside the European Economic Area basically). So a big stick in the form of fines on global turnover was devised.
Fines are not the only sanctions that can be applied, the most onerous for data controllers or processors is the imposition of stopping all personal data processing, which probably prove catastrophic for the company concerned.
The penalties issued so far are designed to sting, to be dissuasive and to prove the DPAs mean business.
The most likely scenario is for organisations to commit to proper data governance as the EU is too large an area to ignore, plus other trading areas are bolstering their data protection regulations, even in the USA, with California Consumer Privacy Act, Canada's PIPEDA and Singapore's PDPA (2012).
It'll end up being the cost of doing business.
The Fine timeline
October 2018
CNPD (Comissão Nacional de Protecção de Dados), Portugals DPA was the first to issue a fine of 400K EUR (448M USD) under GDPR in October 2018 to Barreiro-Montijo Hospital Center for insufficient control and access to databases holding patient personal data.
CNPD also justified the penalty on the fact that 985 physicians were registered with active accounts that gave access to clinical files, including special categories of data, although the staff of the Hospital only had 296 “active” doctors on the inspection date.
November 2018
Second GDPR fine, the first fine issued by LfDI Baden-Württemberg under GDPR, was
for violation of Art. 32 GDPR (Security of Processing)
Knuddels.de, a German social network operator was fined 20K EUR (22.5K USD).
The company had notified a data breach from July 2018 to the supervisory authority in accordance with Art. 33 GDPR, reporting that personal data of 330000 users, such as e-mail addresses and passwords, had been leaked.
January 2019
CNIL (Commission nationale de l'informatique et des libertés), the French DPA kicked-off 2019 with a
€50M (57M USD) fine against Google LLC, "for lack of transparency, inadequate information and lack of valid consent regarding the advertisement personalisation and behavioural advertising"
On 25 and 28 May 2018, the National Data Protection Commission (CNIL) received group complaints from the associations None Of Your Business (“NOYB”) and La Quadrature du Net (“LQDN”). LQDN was mandated by 10 000 people to refer the matter to the CNIL. In the two complaints, the associations reproach GOOGLE for not having a valid legal basis to process the personal data of the users of its services, particularly for ads personalization purposes.
The purpose of these complaints was to point out the unlawful nature of the data processing for behavioural analysis and advertising targeting purposes carried out by Google, showing in particular its lack of valid legal basis.
In this case CNIL applied under 0.05% of Google's global turnover of 96B EUR (107B USD) to arrive at 50M EUR (56M USD) fine.
I'm not going to list out every single GDPR transgression, you can find that here, The next significant fine of 400K EUR (was issued by CNIL, to Sergic, a real estate business for
Failure to implement appropriate security measures; failure to define appropriate data retention periods for the personal data of unsuccessful rental candidates.
Basically retaining personal data with no legal basis.
July 2019
UK's DPA, ICO (Information Commissioner's Office) made a splash with its first notice of intention to fine British Airways £183 million (228M USD) for the infringement GDPR.
On a reported turnover of 23B EUR (in 2017), a 203M EUR (£183M) represents 0.88% of IAG's global turnover.
The proposed fine relates to a cyber incident notified to the ICO by British Airways in September 2018. This incident in part involved user traffic to the British Airways website being diverted to a fraudulent site. Through this false site, customer details were harvested by the attackers. Personal data of approximately 500,000 customers were compromised in this incident, which is believed to have begun in June 2018.
Information Commissioner Elizabeth Denham said:
“People’s personal data is just that – personal. When an organisation fails to protect it from loss, damage or theft it is more than an inconvenience. That’s why the law is clear – when you are entrusted with personal data you must look after it. Those that don’t will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights.”
This was followed by another significant notice of intent to fine, this time Marriott International Inc more than £99 million (123M USD).
A 123M USD fine represents 0.53% of Marriott International Inc's reported turnover of 23B USD for 2017.
The proposed fine relates to a cyber incident which was notified to the ICO by Marriott in November 2018. A variety of personal data contained in approximately 339 million guest records globally were exposed by the incident, of which around 30 million related to residents of 31 countries in the European Economic Area (EEA). Seven million related to UK residents.
It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018. The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.
“The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.
“Personal data has a real value so organisations have a legal duty to ensure its security, just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”
In both cases, British Airways and Marriot International Inc have co-operated with the ICO investigation.
Both have made improvements to its security of data and practices since the data breach.
Both companies will be given the opportunity to appeal against the findings and the scale of the fine before a final decision by the ICO.
I publish a weblog, so do take a look if this sort of thing is of interest.
Personal commentary. Views are the author’s own.