Jose Costa (jose@tugboatlogic.com) is chief information security officer at Tugboat Logic.
Privacy professionals across the globe were shaking in their boots when the European Union General Data Protection Regulation (GDPR) came into effect back in May 2018. The GDPR is one of the strictest data protection laws in the world. As a result, businesses were overhauling processes and reworking procedures to become compliant from top to bottom.
The first of its kind, GDPR essentially forced anyone handling the data of European Union residents to implement privacy safeguards in their business, changing how they interact with customers, employees, and vendors.
Compliance of any kind is indeed an ongoing exercise, but if privacy is incorporated into every aspect of a business, can you create a culture of continuous compliance? This can be possible through privacy by design.
GDPR fine trends
In 2021 alone, GDPR fines exceeded €1.4 billion,[1] accounting for more than 80% of total GDPR fines.[2]
Some fines break the bank, like the €50 million imposed on Google in France for lack of transparency and consent or the €204,600,000 assessed against British Airways and €110,390,200 against Marriott International.[3] Others are smaller. For example, in November 2019, a hospital in Hungary was fined €90 for noncompliance with subject’s rights protection safeguards.[4] The hospital unlawfully charged the patient a copying fee violating their right to access data.
With no apparent loopholes in GDPR, it’s no surprise that the fines are rising. And considering that personal data is only becoming more valuable than ever,[5] complying with regulations like GDPR has never been more vital.
What is privacy by design
GDPR is often described as a checklist. But it’s much more complicated than a checkbox exercise. Privacy by design is when businesses or individuals investigate the possible privacy implications of business decisions. Companies that build privacy into every department, process, technology, and initiative will be successful. Because when it comes to subject data rights and protections specifically, privacy safeguards should be one of the most critical factors in determining any new kind of data processing or modification.
