Photo: Shutterstock.com
A fuller picture of data breach activity is beginning to develop in the European Union, where authorities have logged more than 59,000 reports of personal data breaches since the General Data Protection Regulation took effect about eight months ago, according to a DLA Piper survey.
The report found that 65 percent of the breach notifications made between May 25, 2018 and Jan. 28 originated from the Netherlands, Germany and the U.K.—the three countries that had the highest number of reported breaches with 15,400, 12,600 and 10,600, respectively.
“One of the reasons, we think, is that because of the GDPR legal system ... you typically notify in the country where you’ve got your European HQ,” Patrick Van Eecke, a DLA Piper partner in Brussels, said Monday in a phone interview.
Patrick Van Eecke, DLA Piper partner.
He added the Netherlands is a popular headquarters location for data-focused companies, which could further explain why the country had so many breach reports. Also, the Netherlands was the only country in the EU that had a pre-GDPR data breach notification requirement, according to Van Eecke.
While data regulators in the Netherlands and a few other countries have experience processing and investigating breach notifications, many others have been struggling with their new responsibilities, according to Van Eecke. In helping to compile the survey, he found that data regulators throughout the EU are swamped in backlogs of breach reports.
Many companies are inundating authorities with reports because they’re erring on the side of caution and reporting relatively minor incidents, including lost thumb drives, to avoid potential sanctions for violating GDPR notification requirements, Van Eecke said.
The GDPR requires companies and other data collectors to notify regulators whenever they experience a breach that has a likely risk of harming users. Notification must typically occur within 72 hours of a company becoming aware of an incident.
Failure to comply with the GDPR notification requirements can lead to maximum fines of 10 million euros, equivalent to more than $11.2 million, or up to 2 percent of a company’s total worldwide revenue from the previous financial year, whichever is greater.
While a few countries have published breach notification reports, the majority of EU countries have yet to make the data publicly available or easily accessible.
“That was the main reason we wanted to come up with a survey,” Van Eecke said. “For at least 60 percent of the countries, we couldn’t find any publicly available numbers. We really had to call them and push them.”
He stressed that the countries in question “don’t want to hide” their breach reports and are simply dealing with a steep learning curve. Several of the countries contacted as part of the survey said they planned to release breach reports, but needed more time to do so.