Fines for data protection breaches to increase – VdA

Courts imposing lower fines on companies with compliance programmes

Data protection is currently one of the biggest issues facing companies in Portugal, as well as one of the hottest topics in the EU legislative panorama. The European Union is currently discussing new regulations that are likely to mean that companies that breach data protection regulations are to face financial sanctions equivalent to five percent of their worldwide turnover or €100m – whichever is greater. “Companies are currently preparing for this regulation,” says Magda Cocco, partner at VdA.
When implemented, these new regulations will replace existing laws in Portugal (as well as in other European countries), which impose different fines on different industry sectors – for example, banks face penalties of up to €30,000, while companies in the telecoms industry face fines of up to €5 million. Because of the proposed regulations, companies are implementing privacy and cyber security compliance programmes. “Companies are getting up to speed with these possible obligations and are asking for advice on establishing data protection compliance programmes in order to stay not just on trend, but also on point, with regard to data protection and privacy compliance,” Cocco says.
“This process involves, inter alia, checking their current procedures and providing training for employees.”
Cocco says that data protection legislation is evolving in a direction that is not completely aligned with the business flow and interests of the market. Companies benefit from flexibility in the way they process information regarding their costumers or potential customers – this helps business innovation and market competitiveness and enables a fluid, easily manageable customer relationship. However, the European legislator and data protection authorities in most European countries are moving towards a legal/regulatory framework with rigid boundaries.
Sofia Ribeiro Branco, a partner in VdA´s litigation department, says: “In some recent cases – relating to telecommunication and banking – the courts punished companies with lower fines when they provided evidence of having compliance programmes in place.”