"Fines for breaches of EU privacy law spike sevenfold to $1.2bn as Big Tech bears the brunt"

" \n Fines for breaches of EU privacy law spike sevenfold to $1.2bn as Big Tech bears the brunt \n \n\n \n Fines for violations of the European Union\u2019s landmark privacy law have soared nearly sevenfold in the past year, according to new research. \n \n\n \n EU data protection authorities have handed out a total of $1.25 billion in fines over breaches of the bloc\u2019s General Data Protection Regulation since Jan. 28, 2021, law firm DLA Piper said in a report published Tuesday. That\u2019s up from about $180 million a year earlier. \n \n\n \n Notifications of data breaches from firms to regulators climbed more modestly, by 8% to 356 a day on average. \n \n\n \n GDPR has been in force since 2018. The sweeping changes to EU\u2019s data rules are aimed at giving consumers in Europe more control over their information. \n \n\n \n Companies are required to demonstrate a clear legal basis to collect and process users\u2019 personal data. And firms must notify authorities about any data breach within 72 hours of first becoming aware of it. \n \n\n \n Failure to comply can result in potentially hefty fines \u2014 namely, up to 4% of a company\u2019s annual global revenues or 20 million euros ($22.8 million), whichever is the bigger amount. \n \n\n \n \u201cGDPR has certainly been effective in making everyone sit up and listen to data protection law and data protection enforcement,\u201d Ross McKean, chair of DLA Piper\u2019s U.K. data protection and security group, told CNBC. \n \n\n \n Read: Cryptocurrency: Ghana ranked 9th\u00a0country with highest rate of ownership \n \n\n \n \u201cPrior to GDPR, if you got hit with a fine and you were one of the bigger processors, it was a rounding error, it would barely pay for the Christmas party. Now, you\u2019ve got fines that are close to a billion euros.\u201d \n \n\n \n Record fines \n \n\n \n Last year saw EU regulators impose record fines under GDPR, with Big Tech taking the brunt of the penalties. \n \n\n \n Luxembourg\u2019s privacy watchdog fined Amazon 746 million euros ($850 million) while authorities in Ireland slapped Meta\u2019s WhatsApp with a 225 million euro penalty . Both firms are in the process of appealing the respective fines. \n \n\n \n It often \u201ctakes a while\u201d for regulators to impose large fines once they are introduced in new legislation, McKean said. \u201cThat\u2019s because investigations take a while. And the law is still full of lots of open legal questions.\u201d \n \n\n \n Among those open questions is the issue of cross-border data transfers between the EU and the U.S. \n \n\n \n In 2020, the European Court of Justice made a seismic ruling invalidating the use of the Privacy Shield framework , a legal framework for moving data across the Atlantic. The ruling was dubbed \u201cSchrems II,\u201d after Austrian privacy activist Max Schrems, who originally launched the case. \n \n\n \n While the Privacy Shield was invalidated, the ECJ maintained the validity of standard contractual clauses, another mechanism for ensuring EU-U.S. data flows are legally sound. However, firms are still scrambling to figure out the implications of the ruling. \n \n\n \n The main contention of the ruling is that the U.S. data protection regime is not equivalent with that of the EU. \n \n\n \n Legal uncertainty \n \n\n \n McKean says a major \u201cheadache\u201d for organizations going forward is legal uncertainty surrounding EU-U.S. data transfers. \n \n\n \n Standard contractual clauses (SCCs), by far the most popular method for legally processing such transfers, are on \u201clife support,\u201d McKean said, as officials in the EU and U.S. hash out plans for a new data pact to replace Privacy Shield . \n \n\n \n Facebook parent company Meta has been caught up in an intense dispute with the Irish Data Protection Commission over the matter. The DPC has ordered Meta to stop using SCCs to send user information from Europe to the U.S., as it investigates the company\u2019s data transfer practices. \n \n\n \n Meta secured a temporary freeze on the order, but it was dismissed by Ireland\u2019s High Court, which allowed the watchdog to proceed with its inquiry. \n \n\n \n In a notable case recently, Austria\u2019s data protection watchdog said the use of Google Analytics violates GDPR as it potentially exposes users\u2019 data to U.S. intelligence agencies. The decision targets a website publisher using Google\u2019s web analytics service, rather than Google itself. \n \n\n \n Like Meta and other large U.S. tech companies, Google relies on SCCs to process EU-U.S. data transfers. At the time, Google said firms using Google Analytics \u201ccontrol what data is collected with these tools, and how it is used,\u201d and that the company provides a \u201crange of safeguards, controls and resources for compliance.\u201d \n \n\n \n \u201cEvery organization \u2014 with some limited exceptions \u2014 has an international supply chain and international data transfers,\u201d McKean said, adding the Schrems II ruling has had a \u201cprofound\u201d impact on businesses of all shapes and sizes. \n \n\n \n In addition to increased legal uncertainty, McKean says he expects to see further appeals of GDPR fines emerge in 2022. \n "

"Fines for breaches of EU privacy law spike sevenfold to $1.2bn as Big Tech bears the brunt"

Tullow’s $307m Big Move: Gabon Exit Sets Stage for Ghana and Kenya PushAMP

Ghana’s GDP Growth Forecast Raised to 6.2% for 2025 on Strong Mining OutlookAMP

Sustainable Banking Principles to Guide ESG Integration and Risk Assessment in Construction Sector Financing – BoGAMP