Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //


// // //
08:05 AM
Simon Marshall
Simon Marshall
Simon Marshall

GDPR: The New Price We Pay for Data Privacy

When the EU's GDPR regulations come into effect in May, the rules around how companies and individuals regard data privacy will change forever. Even for those outside Europe, this could be an expensive journey to take.

May 25 sees the launch of the General Data Protection Regulation (GDPR) in the European Union. It's a complex task to secure every single piece of personal data that firms process or store from EU residents.

With deep implications for privacy and data protection for EU and US companies, how prepared are we?

GDPR compliance touches many critical business areas: the relationships firms have with their customers, the technology that supports data protection, internal data process leadership and process change, legal issues and of course the cost of initiating and maintaining individual company GDPR strategies.

(Source: GDJ via Pixabay)
(Source: GDJ via Pixabay)

"Some companies will approach EU GDPR opportunistically and see it as a way to get more value out of the data," Joe Carson, chief security scientists at Thycotic -- a US privileged account security firm -- told SecurityNow. "[But] some organizations will see this as a painful process... [and] are organizations that hate change and see EU GDPR as preventing them from doing business."

About 30% of firms worldwide report being ready for GDPR, according to new stats from Forrester. Interestingly more US companies report they're fully prepared than their counterparts in the EU An additional 35% of firms say they're partially compliant today, or will be compliant within six months. (See GDPR Readiness Goes Beyond Security Controls.)

"These numbers are encouraging," said Enza Ianopollo, a security and risk analyst at Forrester, "however, few firms are approaching GDPR compliance with a comprehensive program and a sound risk-based approach."

"I do think that companies, especially outside of Europe, are overconfident about their ability to meet the new requirements because they doubt that EU regulators' reach will go beyond the EU. I think that they are taking a huge risk," Ianopollo added.

The new cost of data privacy
Firms in regulated industries clearly have had a head-start with GDPR because they are accustomed to operating within a tight compliance framework. According to Forrester's report, companies in the financial sector are the most GDPR mature, but media and retail firms -- which hold and process vast amounts of customer data -- lag, and have only just started their GDPR journey. They need to get it right because failure to comply with GDPR's rule set comes with a stiff price tag.

Organizations in breach of GDPR can be fined up to a maximum of 4% of global turnover, or E20m, whichever is the greater, in a tiered penalty system covering relatively minor to major infractions. Observers say it's possible that the EU could make an example out of a big US firm that fails to comply, in order to send a signal to the market right from the outset.

"The EU has a long history of standing for user freedom and fair competition," said Ambuj Kumar, CEO and co-founder of Fortanix, a data protection firm. "It's likely that the EU could impose an exemplary fine on a high-profile, well-known consumer company."

Potential fines aside, the cost of compliance for firms is somewhat of an unknown quantity, since GDPR is such a wide-sweeping regulation without an easily comparable precedent. Every company will have their own unique cost to stomach. (See GDPR, Cloud Changing Security Pros' Priorities Report.)

"On the negative side, I see a drawback in the increase of short-term costs for companies to rearchitect their security architectures," said Dr. Salvatore Stolfo, CTO of Allure Security. "We might also see a high short-term cost in the redesign of their business processes." He adds that because penalties could be high, this could complicate the risk management and estimates for future corporate liabilities.

"While many US companies will feel a financial strain to comply, a positive outcome is that underfunded security budgets will be right-sized due to compliance requirements," said Misha Govshteyn, co-founder of Alert Logic, a cloud security provider.

Legal implications
There are many recent examples of firms that failed to take adequate consumer data security precautions, and who also appeared sluggish to publicly acknowledging a breach. A prime example is the Sonic Drive-In breach last October, but notable consumer poster children include UPS, Barnes & Noble and Uber. (See SONIC Quiet on Data Breach Details.)

GDPR specifies that breaches notified outside of 72 hours will require an additional written explanation, and if the breach places a data subject at high risk, the notification must be made without "undue delay," which already appears a challenge for some companies.

"Companies who are not regulated usually do nothing to protect the data they have been entrusted to secure," said Thycotic's Carson. "It wasn't until cyberattacks became more expensive for insurance companies that as a result those that failed to secure and protect sensitive data began risking major financial losses."

Next page: GDPR adds additional complexity

1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-10-06
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi.
PUBLISHED: 2022-10-06
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function.
PUBLISHED: 2022-10-06
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function.
PUBLISHED: 2022-10-06
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
PUBLISHED: 2022-10-06
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function.