Fines for Failure to Report Data Breaches

The Personal Data Protection Act remains in effect in the Netherlands until May 25, 2018. Until then, the fines that the Dutch Data Protection Authority is authorized to impose are already substantial: the maximum fine is 820,000 euros for violations of privacy laws. Failure to report a data breach can result in a fine of 900,000 euros.

Soon, starting May 25, 2018, the laws governing the mandatory reporting of data breaches will change when the European privacy legislation takes effect. This General Data Protection Regulation allows for higher fines, of up to four percent of annual revenue per violation or 20 million euros.

To prevent data breaches, organizations implement technical and organizational measures. However, no matter how much you do, there is always a risk of a data breach. A serious data breach does not automatically result in a fine. The Dutch Data Protection Authority will assess the breach, taking into account the actions the organization has taken to protect personal data. The fine will be lower—or may not be imposed at all—if organizations can demonstrate that sufficient measures have been taken to minimize the risks.

Of course, as an organization, you want to minimize the risk of a data breach. That’s why it’s necessary to implement both technical and organizational measures. Technical measures might include, for example, encryption and robust data security solutions. In addition, it’s just as important to focus on the organizational side. Consider, for example, employees who leave USB drives lying around, properly mapping data flows, and appointing a data protection officer.