Talk Talk data breach fine a taste of things to come?

This article was produced by Nabarro LLP, which joined CMS on 1 May 2017.

Talk Talk has been fined £400,000 by the Information Commissioner’s Office (ICO) following the cyber attack in October 2015 which resulted in 157,000 customer records being compromised. Whilst it is the largest monetary penalty notice levied by the ICO to date, Talk Talk is perhaps fortunate that the incident took place before the implementation of the General Data Protection Regulation (GDPR) which will give the data protection authorities the ability to render fines of up to 4% of a business’s global turnover.

The potential imposition of a hefty penalty for a data protection breach is in part a response to the growing threat of data breaches resulting from cyber attacks and should encourage all organisations which control or process data relating to individuals (be they customers or employees) to ensure that they take adequate steps to safeguard the security of that data. As the Information Commissioner, Elizabeth Denham, stated the fine “acts as a warning to others that cyber security is not an IT issue, it is a boardroom issue”.

Whilst the GDPR sets a limit on the fines which can be levied following a breach, the level of fine actually implemented will depend on the circumstances giving rise to the incident and the steps which the victim of the attack took to minimise the risk of a cyber attack, including the approach to employee training and awareness, the policies and procedures in place and, of course, the level of IT security. However, there is no doubt that fines will increase, and it is generally accepted that whilst the GDPR may not have direct effect in the UK following departure from the EU, the UK’s data protection legislation will be largely aligned with the provisions set out in the GDPR.

All organisations can take steps to minimise the risk of a cyber attack, which will not only minimise the likelihood of a significant fine but also the risk of reputational damage and other negative impacts of a data security breach. Guidance is widely available, including the Government’s Ten Steps to Cyber Security publication.

If you would like additional guidance on your cyber security strategy please let us know. We will be happy to help.