TalkTalk Fine should be a wakeup call to businesses


05 Oct 2016

TalkTalk Fine should be a wakeup call to businesses

By Anthony Daly - Cyber Security Consultant

TalkTalk’s fine of £400,000 from the Information Commissioner’s Office (ICO) has come as a surprise to no-one within the cyber security field.

The ICO report will be digested with some unease by TalkTalk due to the strong language that is contained within the report. Extracts including ‘TalkTalk’s failure to implement the most basic cyber security measures’ and ‘TalkTalk should and could have done more to safeguard its customer information’, do not do much to restore faith in an organisation that has suffered multiple high profile data breaches in the past few years.

However, it could have been a lot worse for TalkTalk. Under the proposed European Union General Data Protection Regulations (GDPR), which are due to come into force by May 2018, TalkTalk would not have been hit with a £400,000 fine. Under the GDPR, they would have been hit with a worst case scenario fine of 4% of annual turnover (or EUR 20 Million – whichever is greater). Working with their 2016 figures, and assuming that under GDPR an example would be made of them to deter others, they would have received a fine in the region of £73.5 million.

We are seeing ever-increasing data breaches (by both volume and seriousness) on a regular basis, and the EU GDPR will also allow for the fining of organisations that do not disclose breaches to the relevant parties within 72 hours.

The GDPR will be a two-tiered sanctions regime. As such, breaches which law makers have deemed to be most important for data protection, could lead to fines of up to EUR 20 million or 4% of global annual turnover for the preceding financial year, whichever is the greater. For other breaches, the authorities could impose fines on companies of up to EUR 10 million or 2% of global annual turnover, whichever is greater.

Given the likely timescale of BREXIT, the United Kingdom will still be working under GDPR when it is introduced. GDPR will supersede the UK Data Protection Act and it is highly probable that an almost identical version of it will come into play post BREXIT. Crucially, it will still apply if your organisation does business within the European Union.

As an organisation, will you be able to afford to pay out 4% or even 2% of your annual turnover? Organisations will no longer be able to try and sweep breaches under the carpet.

However, there is no need to panic. There is plenty of advice available from the experts and it will be beneficial to your business to proactively tackle any potential problems now rather than leave it until it is too late and risk a significant fine.

Have you suffered a cyber security breach and need advice? Contact our FREE cyber surgery. For more details click - http://bit.ly/2cdS7r7

For the latest PGI updates like our pages on LinkedIn – PGI,  PGICyber   Facebook– PGI,  PGI Cyber  and  Twitter

Share this article

Contact us

Call us now to discuss your requirements with one of our consultants.

Contact us today

Related News

CISMP, CISSP and CISM - what's in an acronym?

20 Mar 2017

There is a wide range of different security courses available, and a mind-boggling array of certific...

Watch Video

International Womens Day - Pioneering Women in Tec...

08 Mar 2017

Pioneering Women in Technology – Katherine JohnsonThe Oscar season has been and gone. The...

Watch Video

Law Firms and why they need cyber security

06 Mar 2017

Suffering a data breach can be devastating for any company but for law firms the impacts can be part...

Watch Video
Back to the News Hub

Follow us

+44 (0)207 887 2699
©2017 PGI - Protection Group International Ltd. All rights reserved.
PGI - Protection Group International Ltd is registered in England & Wales, reg. no. 07967865
Registered address: Cascades 1, 1190 Park Avenue, Aztec W, Almondsbury, Bristol BS32 4FP