On May 25, 2018, the much-anticipated GDPR went into affect, requiring that firms get specific permission from customers and prospects to use their information. Businesses had 2 years to ready themselves but the numbers of how many were actually prepared in advance were not impressive. Just 20% of companies were fully prepared and compliant. Roughly 53% were still implementing regulations shortly after May 25 and the rest opted to take their chances with a “wait and see” approach.
Since May, the scramble to comply has relaxed but the penalties for those who are not compliant but experience a data breach will face penalties that are anything but relaxed. Violators will face heftier fines than ever before. And now that significant breaches have occurred, initial fines are being levied.
British Airways awaits their fine for a data breach spanning a couple weeks in late summer. Facebook has recently been fined £500,000, the largest fine possible the Information Commissioner’s Office (ICO) could impose pre-GDPR for its first breach occurring from 2007-2014. Had that breach happened before this year, the fine would have been substantially larger.
Again, Facebook is facing multiple violations for breaches, some that occurred prior to the GDPR and others that do fall under GDPR rules. Because Facebook breaches have been fully their fault and often not disclosed in a timely manner, the fines they face will undoubtedly be larger.
3) Facebook breach could have impacted third-party apps; Is huge GDPR fine on the horizon?
After a few rounds of these large companies being hit with staggering financial consequences – to say nothing of the repeated hits to their reputations –it will sink in that these regulations have big teeth. Europe is determined to protect its users’ privacy and that impacts US companies in multiple and significant ways.
Companies have a choice to improve their security posture, take out breach insurance, or set aside 4% (or more) of their global revenue for future fines. We predict (and hope) that before long, companies will begin to see it’s a much wiser choice to invest their resources in improving their security and protecting themselves rather than paying the steep price of getting caught in investigations or exorbitant breach fines.