TalkTalk: Fine should be a wakeup call to businesses | by Anthony Daly


TalkTalk: Fine should be a wakeup call to businesses

by Anthony Daly - Cyber Security Consultant


TalkTalk’s fine of £400,000 from the Information Commissioner’s Office (ICO) has come as a surprise to no-one within the cyber security field.

The ICO report will be digested with some unease by TalkTalk due to the strong language that is contained within the report. Extracts including ‘TalkTalk’s failure to implement the most basic cyber security measures’ and ‘TalkTalk should and could have done more to safeguard its customer information’, do not do much to restore faith in an organisation that has suffered multiple high profile data breaches in the past few years.

However, it could have been a lot worse for TalkTalk. Under the proposed European Union General Data Protection Regulations (GDPR), which are due to come into force by May 2018, TalkTalk would not have been hit with a £400,000 fine. Under the GDPR, they would have been hit with a worst case scenario fine of 4% of annual turnover (or EUR 20 Million – whichever is greater). Working with their 2016 figures, and assuming that under GDPR an example would be made of them to deter others, they would have received a fine in the region of £73.5 million.

We are seeing ever-increasing data breaches (by both volume and seriousness) on a regular basis, and the EU GDPR will also allow for the fining of organisations that do not disclose breaches to the relevant parties within 72 hours.

The GDPR will be a two-tiered sanctions regime. As such, breaches that law makers have deemed to be most important for data protection could lead to fines of up to EUR 20 million or 4% of global annual turnover for the preceding financial year, whichever is the greater. For other breaches, the authorities could impose fines on companies of up to EUR 10 million or 2% of global annual turnover, whichever is greater.

Given the likely timescale of BREXIT, the United Kingdom will still be working under GDPR when it is introduced. GDPR will supersede the UK Data Protection Act and it is highly probable that an almost identical version of it will come into play post BREXIT. Crucially, it will still apply if your organisation does business within the European Union.

As an organisation, will you be able to afford to pay out 4% or even 2% of your annual turnover? Organisations will no longer be able to try and sweep breaches under the carpet.

However, there is no need to panic. There is plenty of advice available from the experts and it will be beneficial to your business to proactively tackle any potential problems now rather than leave it until it is too late and risk a significant fine. 

Author:  Anthony Daly - Cyber Security Consultant at PGI Cyber


October 12, 2016


Hakin9 TEAM
Hakin9 is a monthly magazine dedicated to hacking and cybersecurity. In every edition, we try to focus on different approaches to show various techniques - defensive and offensive. This knowledge will help you understand how most popular attacks are performed and how to protect your data from them. Our tutorials, case studies and online courses will prepare you for the upcoming, potential threats in the cyber security world. We collaborate with many individuals and universities and public institutions, but also with companies such as Xento Systems, CATO Networks, EY, CIPHER Intelligence LAB, redBorder, TSG, and others.
Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Inline Feedbacks
View all comments
© HAKIN9 MEDIA SP. Z O.O. SP. K. 2023