When GDPR first came into enforcement the unofficial message from the ICO seemed to be show a positive intent to comply and there would be some sympathy. This message was reinforced, to business at least, with modest fines issued to Equifax and Uber. \u00a0In total those breaches exposed 20 million UK citizens and totaled \u00a31.3M in fines. However, last week the ICO issued fines to BA and Marriott total \u00a3300m for failing to project 500k customers data. It\u2019s fair to say the message has changed.<\/p>\n
The ICO statement is even more powerful when you look into BA and Marriott\u2019s cases. Just like Uber and Equifax, BA and Marriott exposed personal data as a result of cyber-attacks. Both followed the ICO guidelines with regards to notifying customers and the ICO within 72 hours.\u00a0 But, unlike Equifax and Uber there was very little sympathy from the ICO.<\/p>\n
BA was hacked by group called Magecart who also hacked Ticketmaster UK and several other websites in 2018. BA took steps to notify their customers with 72 hours as required by law, offering customers a two years subscription to myID, an Experian service to protect from online fraud. And yet, the ICO still found that BA had \u2018poor security arrangements’ that led to 500k customers\u2019 passport and credit card details being accessed by criminals.<\/p>\n
Marriott’s fine is even harsher in that the violation had nothing to do with Marriott rather a company Marriott acquired in September 2016 – Starwood Hotels and Resorts Worldwide \u2013 who were compromised as far back as 2014. When Marriott learnt of the issue in November 2018, they notified the ICO as required. The ICO investigation found that Marriott had not undertaken adequate due diligence when it bought Starwood, raising the question – did the M&A folks in the US where both Marriott and Starwood are based, even know to look for this?<\/p>\n
Another debate to be had is what exactly the ICO deem to be \u201csubstandard security\u201d when processing and storing personal data? While the ICO has not issued a full report yet, following on from this hike in fines, there will be an element of fear for anyone raising the phone to report a data breach. From an outside viewpoint, it does seem a little unfair that Uber and Equifax fines equate to \u00a30.65 a person while for BA and Marriott its \u00a3600 a person given the both leaked similar datasets.<\/p>\n
Parking these questions for now, we can safely say that the ICO has made it clear that in their view business is not showing clear intent to comply with GDPR and they are correct.\u00a0 Like most regulations, rather than taking the view of understanding why the regulation exists, it seems that most businesses have fallen into the trap of viewing it as a check box exercise.<\/p>\n
GDPR is there to ensure customers trust brands with their data and they will take every step in their power to prevent exposing them to fraud. There can be little doubt that lots of high profile brands have done a lot of damage to establishing and sustaining that trust and brands are running out of 2nd<\/sup> chances. The ICO\u2019s step-up in stringency should serve to bring this into focus that if they don\u2019t take this seriously they won\u2019t get any customer information which will make the internet a difficult place to do business which is arguably even more damaging than a 9-figure penalty.<\/p>\n The regulation is incredibly important for building consumer trust in brands. Brands that do it well, will gain loyal followers. Those that don\u2019t\u2026<\/p>\n This shift in severity of fines encourages an important and more philosophical question for brands to answer \u2013 just because you can, should you? From a media perspective, first party data is considered the pinnacle but is it worth the risk?<\/p>\n At Hearts, we encourage our clients to think very carefully about the value and potential risks of holding first party data. Whilst it is a great asset if used and processed correctly, we don\u2019t believe it is the be all and end all. These regulations will only get tighter and more heavily policed so clients shouldn\u2019t be spending all of their energy on deterministic modelling. Instead the future is more sustainable approaches like real-time probabilistic measures. Something we currently do for a number of our clients.<\/p>\n The story for BA and Marriott is certainly not over with both companies mounting legal challenges to their fines. We suspect we will see a softening of the penalties over the coming months but the message is loud and clear from the ICO. First party data handling and breaches are serious, and the punishment will be hefty \u2013 and that\u2019s before consumers have their say.<\/p>\n James Londal, Chief Data Officer, Hearts & Science UK<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":" Is now the time for brands to completely rethink their approach to first party data? When GDPR first came into enforcement the unofficial message from the ICO seemed to be show a positive intent to comply and there would be some sympathy. This message was reinforced, to business at least, with modest fines issued to […]<\/p>\n","protected":false},"author":31,"featured_media":22237,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[27],"tags":[],"class_list":["post-22236","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-insights"],"acf":[],"yoast_head":"\n