In the US, Capital One has been fined $80m for failing to implement effective risk assessment processes.
Capital One’s failure to implement effective risk assessment processes occurred before the company migrated significant information technology operations to a public cloud environment. It was also criticised for not correcting the deficiencies in a timely manner.
The fine follows the data breach suffered by Capital One in March 2019, which involved the compromise of personal data belonging to existing credit card customers and applicants for credit card products.
A data protection risk assessment, known as a DPIA (Data Protection Impact Assessment), is required by the GDPR as a way of helping organisations to identify and minimise the data protection risks of a project.
Organisations must conduct a DPIA when processing data that, if disclosed, could represent a high risk to individuals. Something Captial One failed to do.
Insight
Although this is not a fine issued as a result of contravening the GDPR, the amount of the fine reflects the need for effective risk assessment practices to be undertaken to ensure appropriate security measures are put in place – which is also a key requirement of the GDPR.
Norm’s lawyer-led data protection team are always on hand to help identify when a DPIA would be appropriate. If this is something your organisation would find useful find out more about norm’s Data Protection offerings.