By Anthony Daly - Cyber Security Consultant
TalkTalk’s fine of £400,000 from the Information Commissioner’s Office (ICO) has come as a surprise to no-one within the cyber security field.
The ICO report will be digested with some unease by TalkTalk due to the strong language that is contained within the report. Extracts including ‘TalkTalk’s failure to implement the most basic cyber security measures’ and ‘TalkTalk should and could have done more to safeguard its customer information’, do not do much to restore faith in an organisation that has suffered multiple high profile data breaches in the past few years.
However, it could have been a lot worse for TalkTalk. Under the proposed European Union General Data Protection Regulations (GDPR), which are due to come into force by May 2018, TalkTalk would not have been hit with a £400,000 fine. Under the GDPR, they would have been hit with a worst case scenario fine of 4% of annual turnover (or EUR 20 Million – whichever is greater). Working with their 2016 figures, and assuming that under GDPR an example would be made of them to deter others, they would have received a fine in the region of £73.5 million.
We are seeing ever-increasing data breaches (by both volume and seriousness) on a regular basis, and the EU GDPR will also allow for the fining of organisations that do not disclose breaches to the relevant parties within 72 hours.
The GDPR will be a two-tiered sanctions regime. As such, breaches which law makers have deemed to be most important for data protection, could lead to fines of up to EUR 20 million or 4% of global annual turnover for the preceding financial year, whichever is the greater. For other breaches, the authorities could impose fines on companies of up to EUR 10 million or 2% of global annual turnover, whichever is greater.
Given the likely timescale of BREXIT, the United Kingdom will still be working under GDPR when it is introduced. GDPR will supersede the UK Data Protection Act and it is highly probable that an almost identical version of it will come into play post BREXIT. Crucially, it will still apply if your organisation does business within the European Union.
As an organisation, will you be able to afford to pay out 4% or even 2% of your annual turnover? Organisations will no longer be able to try and sweep breaches under the carpet.
However, there is no need to panic. There is plenty of advice available from the experts and it will be beneficial to your business to proactively tackle any potential problems now rather than leave it until it is too late and risk a significant fine.
Have you suffered a cyber security breach and need advice? Contact our FREE cyber surgery. For more details click - http://bit.ly/2cdS7r7
Your free Global Geopolitical Dashboard
PGI’s Risk Portal tool provides daily intelligence feeds, country threat assessments and analytical insights, enabling clients to track, understand and navigate geopolitical threats.
The Risk Portal gives users up-to-date information and analysis on global affairs.
The Risk Portal allows users to visualise information in a unique and instantly understandable way. Mapping filters enable the visualisation of incidents by threat category, time period, perpetrator and target type.
Risk Portal users can upgrade their accounts to include the Report Builder and Country Profile Generator features. The Report Builder allows users to select information, data and images from the Risk Portal and create bespoke reports and emails.
Subscribers to PGI’s Bespoke services receive tailored analysis on specific sectors and geographies of interest, delivered at a frequency they determine.
Subscribe to our Cyber Bytes Newsletter
Keep yourself in the loop with PGI by signing up to our Weekly Cyber Bytes email. You will receive updates, tips and narrative around what has been happening in the world of information security.