{"id":4399,"date":"2020-05-26T11:30:01","date_gmt":"2020-05-26T10:30:01","guid":{"rendered":"https:\/\/www.dataleaklawyers.co.uk\/blog\/?p=4399"},"modified":"2025-11-25T15:11:08","modified_gmt":"2025-11-25T15:11:08","slug":"anniversary-of-the-gdpr-two-years-on","status":"publish","type":"post","link":"https:\/\/www.dataleaklawyers.co.uk\/blog\/anniversary-of-the-gdpr-two-years-on","title":{"rendered":"Anniversary of the GDPR: two years on"},"content":{"rendered":"

As we mark the passing of the second anniversary of the GDPR, we take a brief look at what has changed and what needs to happen to make sure that this key piece of legislation is effective.<\/p>\n

In terms of what has happened, the General Data Protection Regulation has put a greater onus on information processors to act more responsibly. It has also given the UK\u2019s data watchdog, the Information Commissioner\u2019s Office (ICO), far greater powers to impose more substantial penalties that could amount to 4% of an organisation\u2019s global annual turnover. It triggered many organisations over-reporting, perhaps in worry over failing to adhere to the law. The system may have struggled to cope as a result of this.<\/p>\n

But its introduction has been far from perfect in terms of it being a catalyst for change. Although we would always expect it to take time before such an important piece of legislation takes effect, a huge number of avoidable breaches have still taken place.<\/p>\n

<\/p>\n

Two-year anniversary of the GDPR: what needs to change<\/strong><\/h3>\n

As we mark the two-year anniversary of the GDPR, have we seen the impact that we expected to see given the weight of the new regulation?<\/p>\n

So far, the ICO has not ben able to finalise as many fines as we would have expected to have seen. The two big intentions to fine British Airways and Marriott at \u00a3183m and \u00a399m respectively are in no way final amounts and are subject to appeals. Had those cases have been resolved by now, we might have seen a clear message that data breach offenders will be held to account with significant fines. Instead, the delays have perhaps diluted the message that could have been sent.<\/p>\n

What we think needs to happen is for enforcement of punishments to be executed swiftly; no ifs, and no buts. The GDPR itself ought to have been a catalyst for change, but when you look at the number and the nature of the breaches that have occurred since 2018, it hasn\u2019t had the desired effect yet.<\/p>\n

The list includes:<\/p>\n