The European General Data Protection Regulation, due to be discussed again by the EU Commission, European Parliament and the Council of the EU on June 24, is predicted to be ratified in the next 12 months and in place during 2017. Huge fines, up to 100m Euros or five per cent of global turnover, will be issued to companies deliberately or negligently breaching the Regulation. There will also be requirements for businesses to report a data breach quickly estimated to be in the region of 72 hours. But The Crown Records Management/Censuswide Survey of IT decision makers at UK companies with more than 200 employees, undertaken in April 2015, revealed that a fifth of IT decision makers across all sectors were totally unaware of the changes while half of those who knew about the Regulation still were not reviewing policies.
Legal is better prepared
However it seems the legal profession is better prepared, perhaps in part due to the challenges already being faced by companies such as Google in the 'right to erasure' debate. This follows a European Court ruling on the right of European citizens to ask for outdated personal information to be removed from internet searches - a principle which could be extended under the new Regulation. The results saw just 8.7 per cent of respondents unaware of the EU General Data Protection Regulation and the changes ahead. In the pharmaceutical and insurance sectors this figure was almost 30 per cent. Not a single IT decision maker in the industry said they were ‘not concerned at all’ by the implications of the Regulation. In the pharmaceutical industry 16 per cent were unconcerned - in the public sector the figure was 10 per cent.
Different sectors taking varying approaches
Meanwhile 70 per cent of those in the legal sector reported being concerned about the new Regulation, by far the biggest figure across all sectors. In insurance only 25 per cent were concerned. The survey also revealed vast differences in the way different sectors are preparing for the new Regulation. Almost half, 48 per cent, of IT decision makers in the legal sector reported their company was set to review policies ahead of the new regulation compared with the insurance sector at 60 per cent.
'Dangerously late'
John Culkin, Director of Information Management at Crown Records Management said: 'Overall these results shows UK businesses are leaving it dangerously late to prepare for the EU General Data Protection Regulation and are worryingly informed. It is encouraging to see the legal sector is in some areas an exception; and perhaps this should be expected given the impact of the ‘right to erasure’ debate which has seen Google, following a court case in Spain, forced to delete out-dated or inaccurate information in its searches when requested to so by European citizens. But the important question is not just whether people are worried or not, but whether they are being proactive and taking early action to prepare. In this area the legal sector still has work to do. Our advice is that waiting too long could be a very dangerous game.'
Email your news and story ideas to: [email protected]
