1. Comment
October 20, 2017

The UK’s Data Protection Bill goes a long way, but businesses must solve the security crisis themselves

By Matt Ellard

The unanimous support with which the Government’s Data Protection Bill passed through its second reading in parliament last week is promising news for cyber security in the UK.

The Bill enshrines much of the EU’s General Data Protection Regulation onto the statute books, and represents the largest modernisation of data legislation in two decades.

If all goes according to plan, it will make the UK’s personal data regulations fit for the digital age, and will ensure that cyber security is taken seriously by organisations across the country.

That’s why a smooth and speedy transition through parliament is in the national interest.

Strong data protection and cyber security legislation plays a central role in improving public trust in online business and the digital economy.

However, government action can only go so far in this respect.

As the Lords debating the Bill recognised: if we are to solve the modern security crisis, businesses themselves must take charge of the security and safety of customer data. Before the Bill comes into force, businesses must embed basic security protections, or face being hacked by and fined by the State.

The last decade has seen an explosion of growth within the UK’s digital economy. The internet has connected thousands of businesses with millions of consumers.

The channels for profit have widened enormously. The economic and social benefits to society have been great.

But as we spend more time online and increasingly fill our working lives with tablets, smartphones and other connected devices, our attractiveness as a target for cyber crime increases. Right now, the threat level is at an all time high.

A poor grasp of basic skills, outdated software and a sometimes wilful ignorance is leaving organisations open to both sophisticated nation-state attacks and primitive bedroom hackers.

For business, a personal data breach can destroy consumer trust and subsequently hammer profits and company value.

For example, $300m was wiped off the value of Yahoo in February this year, after the company disclosed several enormous breaches between 2013 and 2016.

The introduction of the Data Protection Bill also ratchets up the legal consequences of a cyber attack. By vastly increasing the maximum fines for breaches from £500,000 to £17m (or four percent of global turnover, whichever is greater) the financial penalties of a cyber attack alone are impossible for organisations to ignore.

Recent government initiatives like the National Cyber Security Centre and record funding included within the National Cyber Security Strategy have gone some way to improving data protection practices in the UK.

Once it has cleared the remaining hurdles in Parliament, the Bill will also push cyber security higher up the public and business agenda.

However, before the Bill becomes law, businesses have an opportunity to embed positive cyber security practices within their organisations, and mitigate the risks themselves. Even the most basic of measures can dramatically reduce the chance of a breach or attack.

Simple steps can make a world of difference. For example, by training every member of staff (not just the IT team) about the risks online, naming an individual at board level responsible for data protection, and ditching legacy software that prevents the completion of basic security and system administration tasks.

These are elementary moves, but ones which can vastly reduce an organisation’s risk profile

We can’t rely solely on Government and the Data Protection Bill to make the cyber world safe.

Business needs to take this opportunity to embed strong security protections across their network. Not just because large fines loom, but because they have a responsibility to their customers, staff and society to keep our data secure.

Topics in this article: