TalkTalk: Fine should be a wakeup call to businesses | by Anthony Daly

TalkTalk: Fine should be a wakeup call to businesses

by Anthony Daly - Cyber Security Consultant

TalkTalk’s fine of £400,000 from the Information Commissioner’s Office (ICO) has come as a surprise to no-one within the cyber security field.

The ICO report will be digested with some unease by TalkTalk due to the strong language that is contained within the report. Extracts including ‘TalkTalk’s failure to implement the most basic cyber security measures’ and ‘TalkTalk should and could have done more to safeguard its customer information’, do not do much to restore faith in an organisation that has suffered multiple high profile data breaches in the past few years.

However, it could have been a lot worse for TalkTalk. Under the proposed European Union General Data Protection Regulations (GDPR), which are due to come into force by May 2018, TalkTalk would not have been hit with a £400,000 fine. Under the GDPR, they would have been hit with a worst case scenario fine of 4% of annual turnover (or EUR 20 Million – whichever is greater). Working with their 2016 figures, and assuming that under GDPR an example would be made of them to deter others, they would have received a fine in the region of £73.5 million.

We are seeing ever-increasing data breaches (by both volume and seriousness) on a regular basis, and the EU GDPR will also allow for the fining of organisations that do not disclose breaches to the relevant parties within 72 hours.

The GDPR will be a two-tiered sanctions regime. As such, breaches that law makers have deemed to be most important for data protection could lead to fines of up to EUR 20 million or 4% of global annual turnover for the preceding financial year, whichever is the greater. For other breaches, the authorities could impose fines on companies of up to EUR 10 million or 2% of global annual turnover, whichever is greater.

Given the likely timescale of BREXIT, the United Kingdom will still be working under GDPR when it is introduced. GDPR will supersede the UK Data Protection Act and it is highly probable that an almost identical version of it will come into play post BREXIT. Crucially, it will still apply if your organisation does business within the European Union.

As an organisation, will you be able to afford to pay out 4% or even 2% of your annual turnover? Organisations will no longer be able to try and sweep breaches under the carpet.

However, there is no need to panic. There is plenty of advice available from the experts and it will be beneficial to your business to proactively tackle any potential problems now rather than leave it until it is too late and risk a significant fine. 

Author:  Anthony Daly - Cyber Security Consultant at PGI Cyber

Website: https://www.pgicyber.com/