Many French firms ill-prepared for jump in privacy liability under GDPR

Incoming EU data protection laws will significantly increase privacy exposure for French companies and represent a significant challenge for their risk managers, according to brokers and insurers. When the EU General Data Protection Regulations (GDPR) is implemented in May, it will introduce a harmonised data protection regime across the EU. In France, as across Europe, the GDPR will mean increased rights for consumers and a new requirement to notify a data breach, as well as potentially higher fines for companies that fall foul of the rules. The introduction of breach notification requirements and increased rights for data owners under the GDPR represent a big change for French companies, according to Jean Bayon de La Tour, Paris-based cyber development leader in continental Europe for Marsh. “The GDPR is a big organisational project for French companies. They will need to map how they currently use personal data – including how they gather client data and use Big Data – against the GDPR,” he said. Companies that suffer a breach of personal identifiable data will need to notify the regulator, and, in some cases, the affected individuals. A data breach, or failure to comply with the GDPR, could result in hefty sanctions under the new regime. In the run up to the GDPR, the French data protection authority – CNIL – has gained increased powers. On 13 December 13, 2017, the French Ministry of Justice published a draft law on the implementation of the GDPR in France, giving the regulator powers to prescribe additional security measures and carry out more probing investigations. CNIL already gained the ability to levy higher fines under the French Digital Republic Act, which came into effect on 7 October 2016. This saw maximum fines raised from €150,000 to €3m. Car hire firm Hertz was fined €40,000 in August for exposing personal data, becoming the first company to be penalised under the new legislation. Under the GDPR, maximum fines will rise to €20m or 4% of a company’s global annual turnover, whichever is higher. Almost three quarters of French companies surveyed by cyber security firm Varonis said that potential fines under the GDPR could be crippling. However, just over half believe the GDPR will lack regulatory enforcement. The highest fines under the GDPR are intended for companies that repeatedly flout the rules and fail to respond to regulatory requests, explained Mr Bayon de la Tour. Although the French privacy regulator is likely to initially look to help companies with compliance, he added. Higher fines and mandatory notification requirements under the GDPR are clearly set to result in much higher costs for data breaches from May. According to the Ponemon Institute, the global average total cost of a data breach in 2017 was $3.62m, or $141 per record. In France, the average cost was €3.26m, or €136 per lost or stolen record. With some recent breaches affecting millions of individuals, large financial losses under the GDPR are envisaged. The GDPR could also increase third-party liabilities, making it easier for data owners to claim compensation and take legal action following a data breach. The regulations increase the rights of consumers and introduce a broad definition of damages. With their increased rights, individuals that suffer loss of personal data may be able to join collective actions. Passed in 2016, France’s “Law on the Modernisation of 21st Century Justice” allows collective actions in certain cases, including for breaches of data protection. “We are clearly moving in the direction of class actions for data breaches. Companies should expect to see increased third-party liability and higher notification costs under the GDPR,” said Mr Bayon de la Tour. The combination of the GDPR and potential for collective actions for data breaches could increase exposure for companies over time, according to Laure Zicry, head of cyber for western Europe at Gras Savoye Willis Towers Watson. While class actions for data breaches are allowable under French law, they have failed to gain traction to date. Collective actions are not widely used in France, and although they can be used to stop an organisation collecting or using data, courts are currently unable to award damages in data breach class actions. However, under the GDPR the French government is expected to modify the law and allow consumers to seek damages for data breaches via collective actions, said Ms Zicry. Implementing the GDPR is far from straight forward, requiring companies to identify and understand the context of personal data they already hold, as well as put in place procedures to manage data going forward. Compliance is proving challenging and many companies will fail to comply by May. A survey conducted by Marsh in 2017 found that only 8% of firms in Europe were fully compliant, while 57% were developing a plan for compliance and 11% had yet to start. A recent survey from Varonis Systems found that almost half of French companies face serious challenges with GDPR compliance. Only 53% of French companies had assessed what personal information they hold, although 69% have re-evaluated procedures for detecting, reporting and investigating a breach. Sergio Pierro, senior underwriter of financial lines in France at XL Catlin, believes that as few as 10% of French companies will be fully compliant with the GDPR by May. “When we talk to clients, they say they are working towards compliance with the GDPR, but many admit that full compliance by May will be hard,” he said. “Compliance is complex and takes money, time, investment and knowledge. Companies need to establish a dedicated GDPR compliance team, know what data they hold and what needs to be done. Such assessments take time,” said Mr Pierro. The GDPR is a significant challenge for French companies, especially smaller organisations that may not have the resources to comply, agreed Philippe Cotelle, head of insurance risk management at Airbus Defence and Space, as well as vice-president of AMRAE’s cyber commission. “The GDPR requires significant investment and not all companies will be able to afford it,” he said. Mr Cotelle agrees that GDPR compliance levels of just 10% to 20% are feasible in France, but said it will be higher among larger companies. Most large French companies have started their GDPR compliance and have set up GDPR working groups, he said. Risk managers are increasingly finding a role in GDPR compliance, and are typically involved in GDPR working groups, according to Mr Cotelle. “This is a new element of risk for risk managers to comply with,” he said. Risk managers are becoming more involved in preparing for the GDPR, as well as privacy and cyber risk in general, according to Mr Pierro. “The boards of companies are calling for the involvement of risk management in the consequences of a cyberattack,” he said. While risk managers’ involvement in the GDPR has increased, many companies have yet to carry out a GDPR impact study, with attention mainly focussed on compliance rather than the potential financial repercussions, according to Ms Zicry. “Many companies have yet to carry out an assessment of a data breach and many do not understand the impact of a breach under the GDPR. It can be challenging to put a value to data and quantify the consequences of its loss,” she said. Ms Zicry encourages insurance buyers to work through GDPR loss scenarios and test policy wordings. To help in this effort, Willis has created a tool to help clients run different loss scenarios, calculate the probability of loss and quantify losses under the GDPR.

Many French firms ill-prepared for jump in privacy liability under GDPR

Want to read this article?

Read Next

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

Risk managers urged to include climate change impact on workforce health

New Africa-focused syndicate launched at Lloyd’s

WTW and Riskonnect partner on risk diagnostic tool

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

Risk managers urged to include climate change impact on workforce health

New Africa-focused syndicate launched at Lloyd’s

WTW and Riskonnect partner on risk diagnostic tool

Want to read this article?

Read Next

CSDDD a ‘milestone for responsible business conduct’

Shifting climate litigation against corporates and D&Os ripe for growth

Risk managers urged to include climate change impact on workforce health

New Africa-focused syndicate launched at Lloyd’s

WTW and Riskonnect partner on risk diagnostic tool

Related Articles