One year On from GDPR but what have we learnt?
This week marks one year since the General Data Protection Regulation (GDPR) arrived on 25 May with much speculation and uncertainty. Julia Seary, partner at Roythornes Solicitors, looks at what we’ve learnt and what major scandals, if any, have come to light.
This time last year, GDPR was the hot topic of conversation as its introduction promised to impact nearly every organisation across Europe.
The regulation was introduced to strengthen personal data privacy laws in light of technological advancements and put all European organisations on an equal footing in terms of compliance requirements. In a heavily data-driven world, GDPR was an attempt to update the law in response to the volume, variety and speed of personal data production and its global circulation.
Now that the dust has settled, we can begin looking at how the regulation is really working in practice.
Overall, it appears that significant enforcement activity is minimal, but that’s not to say investigations aren’t taking place behind the scenes. There have been more than 50,000 data breach notifications across Europe since GDPR came into force and here in the UK, the Information Commissioner’s Office (ICO) have received more than 8,000 notifications of data breaches since the end of May 2018.
The largest GDPR fine issued to date has been the €50 million against Google by the French data privacy regulator for lack of transparency, inadequate information, and lack of valid consent in relation to its use of personal data for the purposes of personalising advertisements.
Remember that a maximum fine of up to €20 million or 4% of annual worldwide turnover – whichever figure is greater – can be imposed on businesses which do not conform with the updated regulation.
The use of data subject rights is becoming another business issue; GDPR grants individuals more extensive rights regarding their personal data which has generated a culture of individuals making repeated and extensive subject access requests (i.e. requesting emails going back many years), often simply to cause annoyance, waste time and incur costs for the data controller.
Immediately following 25 May 2018, there was a surge in erasure requests as individuals sought to clean up their online privacy and security. This seems to have slowed down in recent months – perhaps due to the realisation that the right to request erasure is subject to business requirements, rather than an absolute right to have all information deleted.
Finally, the last emerging data protection trend and a potentially concerning development is the increase in class action-style litigation and so-called “data protection ambulance chasers”. Some claimant law firms are attempting to build business off the back of data breaches – even if the breach gives rise to little risk of damage.
In order to avoid business impact and interruption our advice continues to be for organisations to review and update data privacy documents, implement GDPR training, and assess all data flow and transfers. We also recommend reviewing contracts with third parties and putting a process in place to deal with DSARs, other requests and potential breach scenarios.
Industry: Unified commuication news
- Contract SailPoint Programme Manager - UK 12 month+ project
- United Kingdom
Programme manager with SailPoint IdentityIQ IAM experience is needed for a 12 month rolling contract. To engage and manage a enterprise client programme of work focused around SailPoint. This is a hybrid role, some limited travel to London / Reading maybe required. You must have enterprise level programme management, a focused and recent history within Identity and Sailpoint project experience. Exclusive project, interview immediately.
- Outside IR 35 contract- Threat & vulnerability analyst - SC CLEARED UK REMOTE
6 month rolling contract Outside IR35- immediate start. Threat and Vulnerability Analyst. Tenable.sc experience needed. The ability to deploy agent, configure environments, run active and passive scans, produce reports and prioritise remediation activities based on output Current and ACTIVE clearance is required
- Chief Information Security Officer- CISO. London
Chief Information Security Officer (CISO) is needed to join a senior leadership team that is driving change across a London based FTSE business. You will have responsibility and accountability to define and execute an information & Cyber Security strategy. To be successful you should have the following experience; Experience defining, presenting and executing against your information AND cyber security strategy. Experience delivering / managing functions across information security GRC / Audit and technical Cyber Security capabilities. Senior stakeholder management to the executive committee. Embedding Info / cyber security within a Cloud focused environment. Further develop, expand and mature the information / cyber security function | team. Be able to regularly commute to London Financial services experience is desirable. If this sounds like an opportunity you are interested in then please use the below form to schedule a call. This is an exclusive project to DCL Search. All conversations are kept in confidence.
- IAM Business Analyst- ForgeRock
- European Union
- £500 per day
IAM Business Analyst with ForgeRock experience is need for a 12 months contract The client is in the middle of a large scale ForgeRock deployment and the BA will sit between the technical teams and the business helping to ensure the project is a success You will need to be a strong business communicator and have experience of mapping business needs against ForgeRock features This will be a remote project dealing with teams in different geographies, you must have strong English communications skills and be happy working remotely and able to be proactive to ensure your side of the project is a success