GDPR and Bankruptcy

« Death by Database The Surprises of A/B Testing »

Summary

If you have EU customers and you're uncertain how GDPR impacts you, stop reading this and hire a lawyer. Now.

Disclaimer

This is not legal advice. If you have EU-resident customers, hire a lawyer. Now.

Background

I work for All Around The World, a consulting firm based in France. Not only have we been impacted by the General Data Protection Regulation (GDPR) law, our clients have as well. What we have seen is that there's often a lack of understanding of the consequences of GDPR and companies with EU customers face bankruptcy if they fall afoul of this legislation. The GDPR essentially forces companies to take security, privacy, and record keeping seriously. GDPR fines for non-compliance are designed to be severely punitive, up to and including driving companies into bankruptcy.

You do not need to suffer a data breach to be hit with these fines; if you regularly handle data on EU customers and you're found to not be complying with GDPR regulations, you may be sanctioned. What's worse is that local laws, such as the US CLOUD Act, are sometimes in conflict with the GDPR, meaning that you can be caught between contradictory legal requirements. You need a lawyer.

The EU worked for years on the law, finally adopting it on April 14th, 2016. It become enforceable on May 25, 2018. Companies had two years to get ready, so non-compliance is not tolerated. The Cambridge Analytica scandal has made the situation even worse. Though Facebook was fined £500,000 for misusing customer data, there's anger that this paltry amount was the maximum fine that could be levied at the time. Had GDPR been in effect at the time, Facebook could have been fined up to $1.8 billion. While "good faith" efforts to comply with the law will be taken into account, if the EU desires to make an example of a company (and they will), a US company taking money out of the EU will be a much more desirable target than bankrupting an EU company keeping money in the EU. You need a lawyer.

The Legal Situation

There is a strict requirement that you make a "good faith" effort to achieve GDPR compliance. Before anything else, you must realize that GDPR-compliance is a legal issue, not a technical one. If you simply instruct your IT staff to make it easy to report and purge personal data, you're well on your way to bankruptcy. This is not a good faith effort because it demonstrates a lack of knowledge of GDPR regulations.

If you are found to be non-compliant, there are two levels of fines:

Up to the greater of 4% of global annual turnover or €20 million for the most serious failures, such as insufficient customer consent.
Up to the greater of 2% of global annual turnover or €10 million for the other failures, such as not having a Data Protection Office (if required), failure to report breaches, or not conducting an impact assessment.

In other words, you face bankruptcy if you get this wrong. This is serious enough that many US-based Web sites are no longer available here in Europe. Complying with GDPR can be costly if your IT staff are inexperienced. Not to put too fine a point on it: the strong worldwide demand for software developers has led many companies to hire inexperienced developers. Even expert developers often build poor systems when faced with significant budget or time constraints. Companies rush build software to solve problems now with little thought to the long-term consequences of poorly-built software. GDPR isn't going to improve this situation, but it's going to severely punish companies who get this wrong.

Basic GDPR Compliance

In order to achieve GDPR compliance, you need to, at minimum, do the following, keeping in mind that there are major caveats to each of these:

Request consent from your customers to track their data.
Appoint a Data Protection Officer, if required.
Create a Data Protection Impact Assessment (DPIA).
Maintain records of all personal data processing activities.
Notify EU authories of data breaches with 72 hours.
Understand the "right to be forgotten."
Provide customers with information on how you use their data.

How these issues are applied will vary company to company. However, keep in mind that you generally do not have the right to deny services to customers if they fail to give consent to having their data tracked. There are exceptions to consent, such as the processing of personal data for reasons of public interest, such as in the health sector. And yes, this also applies to your EU-resident employees, not just customers.

Data Protection Officers

In short: if you handle personal information on a large scale or regularly monitor data subjects, you need a Data Protection Officer (DPO). Keep in mind that Recital 30 of the GDPR clarifies that IP addresses are personal information. Examples of companies requiring a DPO include:

Any government body (except courts) or public authority
E-commerce companies tracking customer purchases
Hospitals and clinics
Advertising firms targeting personal data
Telephone or internet providers
Virtually any company offering financial or insurance services
Geo-location services used for statistical purposes
Recruiters who store candidate information
Security firms monitoring public spaces

Small scale tracking of personal data, such as a individual doctors or lawyers, generally do not need a DPO.

Of course, the above list is not exhaustive. If you're not sure, consult a lawyer.

If you require a DPO, the following conditions apply:

They must not have a conflict of interesting (controllers, IT directors, CEOs, etc.)
They must have sufficient budget and personnel to perform their task
They report directly to top management and must not have a supervisor
They may be an outside consultant or firm, but they must not have a short or fixed-term contract
Their term must be between two to five years, but may be extended up to ten years
They must be knowledgeable in both GDPR-compliance and your internal systems (it's understood that the latter will take time)
To protect against retaliatory dismissal, they can only be dismissed with the consent of the European Data Protection Supervisor (EDPS)
They must have full power to investigate and correct GDPR compliance within the organization
They must notify the EDPS of any data processing activity that is likely to present significant risk "to the rights and freedoms of data subjects".

The above list, of course, is not exhaustive.

IT Considerations

Now, and only now, do we begin to touch on the IT considerations. The above was merely to give you a sense of the scale of the GDPR directives. This section is intentionally left short because it should not be viewed as a checklist to becoming GDPR-compliant. If in doubt, consult a lawyer.

The legal implications must be addressed first. One you have a DPO (if needed), and have drafted a comprehensive plan to protect your customer's data, you can start work on how to implement this. Implementing GDPR requirements without fully understanding them risks wasting money and time developing systems that are not fit for purpose. Once you have a strong understanding, however, you can begin to address the following:

Asking for consent in a clear, intelligible manner that gives consumer full control over how their data is managed
Develop reporting to track usage of all personal data
Respond to consumer requests for your usage of their personal information
Respond to consumer requests for the "right to be forgotten"
Ensure that disaster recovery and data backups do not restore "forgotten" information
Restrict internal access to sensitive data
Hire a reputable, external company to do a security audit and have developers fix discovered issues

The security assessment is critical: all the "good faith" in the world isn't going to protect you if you have a Experian-style data breach. The EU wants to show that the GDPR has real teeth and you don't want to be the example.

Please leave a comment below!

If you'd like top-notch consulting or training, email me and let's discuss how I can help you. Read my hire me page to learn more about my background.