Panic Over GDPR Noncompliance Fines: Is It Overblown?
At the 2018 NetDiligence Cyber Risk Summit in Philadelphia, experts said that companies don't need to worry as much as they are about General Data Protection Regulation fines.
June 14, 2018 at 12:28 PM
3 minute read
Companies panicking about the high fines associated with the European Union's recently implemented General Data Protection Regulation may want to think twice.
At least, that's according to a group of business and technology experts that gathered in Philadelphia on Wednesday for the 2018 NetDiligence Cyber Risk Summit. These experts seemed fairly sure that there has been too much of a focus on the fines behind GDPR.
The GDPR took effect on May 25 and carries penalties for noncompliance that can be as high as 4 percent of the offending company's revenue from the previous year or 20 million euros—whichever is higher.
The regulation requires companies to beef up the security of their networks that process the personal information of EU citizens and requires covered companies to notify the public of a breach within 72 hours of discovering it, among other obligations.
“I think that there will be some headline-grabbing fines, but I think they'll be the outlier,” said Oliver Brew, the head of client services at CyberCube.
Jason Glasgow, the vice president of the E&O division at Allied World, said he hopes and believes that the regulators will not be doling out multimillion euro fines on a regular basis.
“I don't think it will be a frequency issue,” Glasgow said.
Glasgow said he hopes that the regulators find ways to guide companies into staying compliant rather than hitting every company with a big fine—but said that it'll be hard to know how the EU data protection authorities will enforce the law until more actions have been taken.
Michael Bruemmer, the vice president of consumer protection at Experian Consumer Services, said he wouldn't expect to see major fines announced every week because the data protection authorities are short-staffed and underfunded.
According to the results of a Reuters survey released just weeks before the May 25 deadline, a majority of the GDPR regulators indicated that they themselves would not be ready for GDPR.
“The DPAs are understaffed. They don't have enough people to even do the basic stuff like investigations,” Bruemmer said.
Citing the Dixons Carphone data breach, which was announced on Tuesday evening, Bruemmer said companies should not be worried about alerting the public about the data breach within the required 72 hours.
“The way the GDPR is set up in terms of just breach notifications, it's much easier to notify people very quickly following the 72-hour announcement to the data protection authority,” Bruemmer said.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllMarriott's $52M Data Breach Settlement Points to Emerging Trend
2024 Ransomware Payments Poised to Shatter Record, as Gangs Target 'Big Game'
2 minute readCleared in HP Fraud Trial, British Tech Tycoon Mike Lynch Now Missing at Sea
FTC Probing Use of Browser Histories, Other Personal Info to Individualize Product Prices
4 minute readTrending Stories
- 1Judicial Ethics Opinion 24-70
- 2Decision of the Day: Judge Denies Standing for Plaintiffs in Copyright Suit Over AI Training of ChatGPT
- 3LA Judge Anne Hwang Confirmed to the Federal Bench
- 4NY Court Leaders Ask for 10% Judiciary Budget Increase
- 5ClaimClam Wanted to Boost Class Action Claims Rates. But Judges and Attorneys Fought Back
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250