Organisations can use GDPR ambiguity to contest fines in court, experts say

Companies can use the ambiguity of the General Data Protection Regulation (GDPR) to their advantage if they are accused of being non-compliant, experts say.

Paul Holland, information security lead at insurance firm Hiscox, told delegates at Cloud Expo Europe in London on 21 March 2018 that the uncertainty over the wording used in GDPR could prove problematic for organisations when it comes into force on 25 May 2018.

Holland said the laws are “very vague in a lot of statements” and expects to see many years of contests between the Information Commissioner’s Office (ICO) and organisations in court as a result.

“There’s not a lot of detail [in the regulation] as to what we [the companies] need to do,” he said. “A lot of it is down to interpretation. I can see us having probably 10, maybe 15 years of mitigation going on as companies start to challenge the regulation in the courts when they are starting to look at being fined.”

However, fellow panellist Gboyega Ayoade, GDPR project manager and data privacy lead at tobacco company Philip Morris International, said if organisations have a GDPR plan, the vagueness of the wording could work in their favour.

“What this lets a business do is argue that they interpreted the rules in a particular way, and if that turns out to be incorrect, the ICO can explain why,” he said.

“So what really matters is how you plan your GDPR project and how you plan to implement all those areas where there is no clarity.”

He said businesses can do this because they have a right to try to be successful through their operations, just like people have the right to protect their data.

“Whether the plan is 100% accurate, in this case, does not matter because [with GDPR] the ICO itself does not have a regulation that is 100% clear,” he said.

“The plan is to satisfy the requirements of the regulations, and when it comes to the areas that are unclear, a business can ask the ICO ‘What exactly were you expecting?’”

“If their interpretation of the rules is different to the business that is being challenged, a business can then make it clear they have a responsibility to their customers, shareholders and staff to continue to operate,” said Ayoade.

Holland said organisations looking to do this will need to demonstrate they have considered what data they have and any risks associated with it.

“The plan is certainly the key piece for businesses, ensuring they’ve got that plan in place anywhere that might be slightly off from what the regulation might be saying.”