This is a guest post from Patrick O’Kane, lawyer (UK barrister), Data Protection Officer for a US Fortune 500 company, and author of GDPR: fix it fast – How to apply GDPR to your company in ten simple steps.
“It’s too early to say!” quipped the Chinese Premier in 1972 when he was asked about the effects of the French Revolution in 1789.
It may be too early to say how hard regulators across the EU will penalize ordinary companies for breaching the EU General Data Protection Regulation (‘GDPR’)., but last week we saw the first shot across the bow. The French CNIL fined Google 50 million Euros, which finally broke the dam. The fine was levied under GDPR for "lack of transparency, inadequate information and lack of valid consent regarding ads personalization".
GDPR came into effect on 25th May 2018. It is a data regulation nonpareil - arguably the most-hyped compliance regulation for a generation.
Regardless, some of the GDPR hype has died down.
At the pinnacle of the hype, GDPR was more of a phenomenon than a compliance regulation. At one stage it was reported that it had outranked Beyonce on Google Search.
Consumers received emails from needy companies asking them to consent to marketing. GDPR ‘consultants’ of all shapes and sizes filled the marketplace. London lawyers promised to salve our GDPR anxiety if only we retained their services
And then…. nothing. By July 2018, it seemed to have slipped off may board agendas.
The Other GDPR fines
As you know, the maximum fine under GDPR is €20 million or 4% of a company’s global turnover (whichever is greater).
Some of the GDPR fines levied by Regulators have been tame. Before the Google action, post GDPR-fines have been scarce, and they have not been headline-grabbing. For example:
A German social media company was fined €20,000. The company had been hacked and 808,000 email addresses were compromised.
An Austrian retail company was fined €4,800 fine after its CCTV captured too much of the public sidewalk.
A Portuguese hospital was fined €400,000 after hospital staff illegally accessed patient records.
The Google fine – 3 takeaways …
Read More