
TalkTalk: Fine should be a wakeup call to businesses
by Anthony Daly - Cyber Security Consultant
TalkTalk’s fine of £400,000 from the Information Commissioner’s Office (ICO) has come as a surprise to no-one within the cyber security field.
The ICO report will be digested with some unease by TalkTalk due to the strong language that is contained within the report. Extracts including ‘TalkTalk’s failure to implement the most basic cyber security measures’ and ‘TalkTalk should and could have done more to safeguard its customer information’, do not do much to restore faith in an organisation that has suffered multiple high profile data breaches in the past few years.
However, it could have been a lot worse for TalkTalk. Under the proposed European Union General Data Protection Regulations (GDPR), which are due to come into force by May 2018, TalkTalk would not have been hit with a £400,000 fine. Under the GDPR, they would have been hit with a worst case scenario fine of 4% of annual turnover (or EUR 20 Million – whichever is greater). Working with their 2016 figures, and assuming that under GDPR an example would be made of them to deter others, they would have received a fine in the region of £73.5 million.
We are seeing ever-increasing data breaches (by both volume and seriousness) on a regular basis, and the EU GDPR will also allow for the fining of organisations that do not disclose breaches to the relevant parties within 72 hours.
The GDPR will be a two-tiered sanctions regime. As such, breaches that law makers have deemed to be most important for data protection could lead to fines of up to EUR 20 million or 4% of global annual turnover for the preceding financial year, whichever is the greater. For other breaches, the authorities could impose fines on companies of up to EUR 10 million or 2% of global annual turnover, whichever is greater.
Given the likely timescale of BREXIT, the United Kingdom will still be working under GDPR when it is introduced. GDPR will supersede the UK Data Protection Act and it is highly probable that an almost identical version of it will come into play post BREXIT. Crucially, it will still apply if your organisation does business within the European Union.
As an organisation, will you be able to afford to pay out 4% or even 2% of your annual turnover? Organisations will no longer be able to try and sweep breaches under the carpet.
However, there is no need to panic. There is plenty of advice available from the experts and it will be beneficial to your business to proactively tackle any potential problems now rather than leave it until it is too late and risk a significant fine.
Author: Anthony Daly - Cyber Security Consultant at PGI Cyber
Website: https://www.pgicyber.com/
Author

- Hakin9 is a monthly magazine dedicated to hacking and cybersecurity. In every edition, we try to focus on different approaches to show various techniques - defensive and offensive. This knowledge will help you understand how most popular attacks are performed and how to protect your data from them. Our tutorials, case studies and online courses will prepare you for the upcoming, potential threats in the cyber security world. We collaborate with many individuals and universities and public institutions, but also with companies such as Xento Systems, CATO Networks, EY, CIPHER Intelligence LAB, redBorder, TSG, and others.
Latest Articles
Blog2022.12.13What are the Common Security Weaknesses of Cloud Based Networks?
Blog2022.10.12Vulnerability management with Wazuh open source XDR
Blog2022.08.29Deception Technologies: Improving Incident Detection and Response by Alex Vakulov
Blog2022.08.25Exploring the Heightened Importance of Cybersecurity in Mobile App Development by Jeff Kalwerisky
Subscribe
0 Comments