With the European Union’s General Data Protection Regulation (GDPR) coming up to its first anniversary in May, there is evidence that it’s already having an impact, with organisations and customers reporting breaches more regularly.
But will this really make for a safer environment? Perhaps more importantly, are authorities ready and equipped to deal with increased levels of reporting?
The answers to these questions are important, not only in the EU, but also in South Africa, where the Protection of Personal Information Act (Popi) is making progress on its path to implementation. Assessing the impact of GDPR will give us a clearer idea of how effective Popi might be.
In the immediate aftermath of GDPR coming into force, there was a dramatic uptick in the number of data breach complaints received by authorities across Europe. That’s hardly surprising, especially given the attention GDPR was receiving at the time.
In the UK alone, there were 19 000 complaints from members of the public about privacy breaches in the six months after GDPR came into effect, versus just 9 000 in the same six months the previous year. In that same six months, more than 8 000 data breaches were reported.
In Ireland, meanwhile, the number of data-breach reports received on a daily basis more than doubled, with similarly dramatic increases in Germany and France.
Although this increase in reporting certainly gives authorities a clearer idea of how many data breaches occur on a daily basis, as well as how proactively organisations look after their customers’ data, is it making any tangible difference?
Positive impact
While GDPR can’t prevent cybercriminals from trying to access organisational data, it is likely that it will have a positive impact in the long term.
If organisations are serious about being compliant, they’ll ensure that they have the required checks and balances in place, as well as invest in better security and better data governance.
The uptick in privacy breach complaints also suggests that ordinary people are becoming more aware of how their data is being used. As a consequence, there may be increased awareness around the value of data, and further improvements to accountability driven by consumer demand and activism.
That will only be the case, however, if authorities in the individual EU countries are stringent in ensuring that organisations are GDPR compliant and respond with material consequences on those who aren’t.
If early indicators are anything to go by, those looking to flout the regulations may feel emboldened.
By late December, just three nations had issued public fines under the new regulations. The UK’s first enforcement under the new regime, meanwhile, fell flat, after the Canadian business involved successfully appealed the order.
That said, authorities across the EU indicated that they would tread softly at first, so we may only see the big sticks come out through the course of 2019.
In South Africa, Popi will face similar challenges when it finally comes into effect.
After little activity last year, the Information Regulator in South Africa published the final Popi regulations on 14 December.
Although the regulations include very few extra compliance requirements (there will likely be even fewer for companies which are already GDPR compliant), organisations will still have to ensure that they put in the necessary effort by the Popi commencement date.
If the Information Regulator fails to properly enforce Popi, however, it won’t create the more secure, more accountable environment it’s meant to.
Given that the regulator is only expected to be fully operational this year (nearly three years after being formed), and is still staffing up, it may be some time before it has the necessary teeth to take on anyone flouting the act.
Year’s grace period
Organisations will also a have a year’s grace period to get their houses in order once Popi comes into effect. That means we’ll probably only have an accurate idea of Popi’s efficacy sometime after 2020.
Finally, it’s important to note that compliance does not always equal security. While being Popi and GDPR compliant can help improve security, organisations need to set their security postures higher than the regulatory requirements if we are to create a safer digital environment.
Cybercriminals haven’t stopped trying to get their hands on organisational data because of GDPR and they won’t because of the South African legislation.
Organisations therefore need to go beyond what is required for compliance and do everything possible to prevent breaches from happening, as well as manage them effectively when they do.
- Alison Treadaway is chief marketing officer at Striata
