GDPR has been with us now for just over a year – so what has changed during this period?
Businesses are now much more proactive in their approach to cyber security instigating robust systems and procedures to combat the threat of hackers.
http://cyberbrokers.co.uk/gdpr-data-protection-but-not-as-we-know-it/
The ICO have just published a report “GDPR – One Year On” which sets out a review of its first year in operation.
https://ico.org.uk/media/about-the-ico/documents/2614992/gdpr-one-year-on-20190530.pdf
Countering the Cyber Security Threat
The risk of a data breach is also now higher than ever with the changing cyber risk landscape. New ransomware strains and malware are evolving so keeping up to date protections in place is vitally important. GDPR is a clear driver of the approach that the C Suite has to instigate to protect and secure their businesses.
Among the many areas that IT Security has focused upon is back-up which is essential in protecting data. This makes it retrievable in the event of a compromise of data due to a cyber-attack.
Change in Philosophy
GDPR was a long time coming and businesses have struggled to find the resource to put in place processes to achieve compliance. Some were ahead of the game and some struggled to meet the deadline of 25th May 2018.
The philosophy to cyber security has also reached an engagement point where businesses are looking beyond GDPR. Businesses are now seeking cyber security accreditation’s such as ISO27001.
Global Effect
Other countries are also taking note of the impact that GDPR is having and bringing in similar legislation of their own.
For example the California Consumer Privacy Act (CCPA) which comes into force on 1st January next year.This provides consumers with certain rights over their personal data which is held by businesses and is an obvious parallel with GDPR.
GDPR Fines
Regulators to date have issued in excess of 200.000 fines of which 65,000 were related to data breaches . Fines totalled E56M which includes the E50M levied against Google by the Irish Data Protection Commissioner. In this case new users were inadequately advised how personal data was collected and how this was subsequently used.
The fear of potential fines being issued of up to 4% of global turnover of a business by the regulators has not materialised yet. However from a speech made by Elizabeth Dunham , the U.K. Commissioner of the ICO recently stated in a speech that this may be about to change later in the year. The ICO it is understood have a couple of very large cases that are currently being reviewed.
Both Equifax and Uber have been fined over the past twelve months but this was under previous legislation and not GDPR.
The impact of GDPR does appear to have improved cyber security standards. We are however waiting to see how regulatory bodies will impose the full force of non-compliance in the event of a cyber-attack that results in a significant data breach.
Image : Shutterstock