CS1907

GDPR
fine is preliminary," states Ashley Hurst, partner
and head of tech, media and comms at
international legal practice Osborne Clarke.
"Historically, fines were announced once the
final decision regarding the amount of that
fine was reached. It may be that the size of
the proposed fine and the listed status of
British Airways was such that there was no
choice but for IAG to publicly announce the
size of the intended fine."
The proposed fine will also provide
encouragement for a rapidly growing group
of claimant personal injury lawyers looking
to bring post-data breach claims for
compensation, he adds. "It is often difficult to
attribute a data breach to a breach of the
GDPR and even more difficult to prove that
such a breach has led to damage and distress,
so it will be interesting to see whether the ICO
will make any comment about this."
Over the last year, speculation has been rife
regarding the approach that the ICO will take
to fines. "It is now clear that the ICO will not
be gradually scaling up from its previous
£500,000 maximum: the proposed
£183.39m penalty is equal to 1.5% of British
Airways' worldwide turnover of £12,226m in
2017," adds Hurst. "This is substantially less
than the possible maximum GDPR fine of 4%
of worldwide annual turnover, but still
startling and demonstrates more than ever
that cybersecurity needs to stay on the board
agenda." Prior to this announcement, the total
value of all fines issued under the GDPR across
all EU member states had amounted to 56
million euros. This includes a 50 million euro
fine by the French DPA (CNIL) against Google
for what the CNIL considered to be a lack of
transparency, inadequate information and
lack of valid consent, in relation to Google's
use of personal data for the purposes of
personalising advertisements.
And Osborne Clarke’s Hurst adds: "When the
decision is finally published, this case should
provide some long-awaited clarity regarding
the ICO's exercise of its enforcement powers
and, in particular, what it considers to be
'appropriate technical and organisational
measures' to protect personal data, which is
the key technical standard littered throughout
the GDPR."
ANOTHER BIG TARGET
Following on from the BA debacle, Marriott is
next up, as it also faces a huge data fine: £99
million for allegedly failing to protect customer
data. The hotel chain acknowledged in a
regulatory filing in July this year that Britain's
Information Commissioner's Office intends to
impose the fine under the GDPR.
Jake Moore, Cybersecurity Specialist at ESET,
had this to say in the wake of the news
breaking: "Well, the snowball has surely
started to gain momentum now and this just
highlights that it's not just UK companies at
risk of eye-watering fines either. Other firms
who suffered from large breaches post-May
25, 2018, better start saving, because the ICO
Gregory Voss, TBS Business School: the
relatively low levels of GDPR fines is a
reflection of the time it takes to conduct
investigations.
Jake Moore, ESET: other firms who suffered
from large breaches post-May 25, 2018,
better start saving, because the ICO clearly
means business.
FALLING SHORT
For Jason Hart, cybersecurity evangelist, Thales, GDPR hasn't improved data
protection to the extent many in the industry had hoped. "With the number of
breaches being reported dramatically increasing, it's clear the threat of fines and
a potential hit to their reputation is only having a small impact on how seriously
businesses take their cybersecurity. Worse, just a tiny percentage of the attacks can
be considered 'secure breaches', where the stolen data is encrypted, rendering
it useless to cybercriminals. Unless businesses are made to adhere to GDPR
recommendations such as encrypting data directly it will continue to have minimal
impact in the UK."
www.computingsecurity.co.uk @CSMagAndAwards July/August 2019 computing security
11