GDPR 2 years on - key takeaways and lessons learnt

Lesson One: Deadline apathy

We saw that a great number of UK organisations didn't do anything in the period from 2016 when GDPR was adopted, to 2018 (the implementation deadline). As the deadline loomed on 25th May 2018, I’m sure we all remember emails flooding our inbox from companies desperately wanting to still be able to market to us. There were articles and comments galore on the subject of GDPR, theories of instant enormous fines, and then... nothing happened. The clock ticked-over to May 26th, and too many companies thought "oh it's over now, I'll just carry on".

The lack of media coverage combined with the lack of high-profile ICO action over the last two years has only encouraged this attitude, and we see a lot of companies say "it doesn't matter, the ICO won't fine us”. As a result, GDPR gets pushed further down the corporate agenda and the risks (as outlined in the first paragraph) continue to grow.

The solution to this is education, education, education. The ICO themselves ran a lot of awareness campaigns in the run-up to GDPR, but it was aimed at data subjects and their rights, rather than aimed at businesses and their obligations. The result of this is that the public are much more aware of their rights and are more sensitive to privacy implications, meaning companies are much more likely to get challenged (and reported) on their dodgy data use by data subjects. But educated data subjects has come at the cost of clarity for businesses.

To fill this knowledge gap, the open market has had to step in to drive up the standard of corporate awareness. This is something we at Bulletproof work hard to promote. For example, in our webinar we share insights into why companies fail to meet the requirements of GDPR, as well as how they can rectify it.

Lesson Two: The ICO and regulatory pressure

The past two years have seen many high-profile data breaches. If I say BA, Marriott and (more recently) easyJet, you’ll know what I mean. But despite the high-profile fines associated with these events (BA was fined £183m), the ICO isn’t very active. The headline grabbing £18 billion loss that easyJet are facing is from a class-action lawsuit, not a regulatory fine.

In fact, compared to other Supervisory Authorities, ICO barely registers. In a list of most recent fines, the ICO isn’t even in the top 50, with the likes of Italy, Greece, Spain, Bulgaria, Hungary, Iceland, Denmark (and many more) all issuing multiple fines in the same period. But it’s important to note that this inactivity isn’t a result of policy – it’s a result of under-resourcing.

The Information Commissioner herself, Elizabeth Denham, was warning of a critically under-resourced ICO as early as 2017. The ICO simply doesn’t have the capacity to investigate and take action on all the cases they want to (in case you’re wondering, the fines levied by the ICO go directly to the Treasury). This further proliferates the idea, especially in the smaller end of SMEs, that “the ICO won’t fine me”. Which is a bit like poking a sleeping dragon with a stick. It’s fine, until it wakes up. As the rights of data subjects become increasingly on the political agenda and data subjects themselves feel empowered to report your business, the ICO dragon will awaken. And then it’s coming for your business.

Indeed, this perceived inactivity is no reason to ignore GDPR. To illustrate this point, look at the case of the ICO’s first ever GDPR fine. A pharmacy in North London was fined £275,0000 for carelessly storing documents containing patient data. So it’s clear to see that ICO action is real, and so are the fines.

Whilst we’re on the subject, ignoring the financial risk is also ignoring the non-financial risks to your business. The reputational damage caused by a data breach could destroy your business quicker than a large fine. The solution for both these issues is the same: act now. The best time to start your GDPR project is 2 years ago. The second-best time is right now. Don’t forget that GDPR isn’t some exotic foreign legislation – it’s enshrined in UK law as the Data Protection Act 2018. Directors don’t ignore a company’s other legal obligations like tax, or employee entitlement to work checks (and so on), so why ignore GDPR? Our advice is to take all your legal obligations seriously and become GDPR compliant before it’s too late.

Lesson Three: Management buy-in & resource

Moving away from regulatory matters, let’s dive into organisations. Much like ISO 27001, GDPR needs senior management buy-in to succeed. Bulletproof has repeatedly seen that without senior management buy-in, a company’s GDPR efforts fail. Without an example being set, no-one else in the company will bother. GDPR needs to be seen as a core corporate priority that spans all layers of the business.

That’s not the biggest problem with not having management buy-in, however. The biggest hurdle is resourcing. Without top-down support, even a well-managed GDPR project will struggle with budget and resource for external help, internal training, and giving staff time to do the work required. Building internal teams to take on GDPR responsibility only adds to the resource cost, which is why many organisations gain senior management buy-in with cost-effective outsourcing models that deliver expert GDPR knowledge for much less cost, and much less hassle.