The Irish Data Protection Commission fines WhatsApp €225m (£193m). The fine stems from an ongoing investigation to ascertain whether WhatsApp has been transparent with how they process the data sets of users in their possession.
Even after several policy updates, WhatsApp consistently fails to meet the European General Data Protection Regulation demands. The big question, therefore, is how do they get out of this debacle?
A spokesperson from WhatsApp argues that they are “committed to providing a secure and private service.” When one breaks down this phrase into granular levels, you’d find out that words in data and information security and management don’t mean anything. Two weeks ago, I spoke about “trusting but verifying” in information and data privacy management. Stakeholders in companies must understand the importance of checking out procedures, policies, and business functions especially whether it meets regulatory requirements.
Interestingly, WhatsApp disagrees with the fines and would be making an appeal against the fine. What’s more, their spokesperson added that the penalties are “entirely disproportionate” because of the said amount and the articles violated.
Now, the current fines in Europe for GDPR violation sits at over a billion euros. And the numbers keep increasing. In August 2021 alone, there has been seven hundred and sixty-two fines.
In Spain last week, a business owner was fined for not having enough data subject access request methodologies or technical organisation to comply with the regulation. The owner claims which included “ignorance” and “lack of technical facilities” were poohed-poohed by Spanish Data Protection Authority.
In Europe and some part of the Americas, data privacy and information security feeds into business functions and business procedures. It informs how a lot of new procedures and projects are strategically achieved. By doing this, the consideration of humans and the considerations of how business functions can affect the lives and economy on the grand scheme of things.
In Africa, there is a little of bit of progress. In South Africa, they implemented the Cybercrimes and Cybersecurity Act which was recently signed into law. The act ensures that all communications done electronically by service providers and financial institutions must be done in a technical and organisational manner. Non-compliance with the act is a criminal offense and can lead to massive fines.
The Protection of Personal Information Act (POPIA) has similar articles with the GDPR. It basically promotes the protection of personal information processed by institutions. Lawful processing, transparency, and accountability.
In Ghana, Nigeria, Kenya, these laws are in place and yet, there are companies that violate these data privacy laws copiously. It is either regulations in Africa hold no water or maybe the Data Protection Authorities are failing in their respective duties to lean heavily on the processes of these companies and to check if their procedures meet acceptable data protection standards. The inability of data protection authorities to shake companies up and make them do the right thing with regards data privacy and information security management would only set the continent backward.
There are implications that companies will rely heavily on personal data usage. And, as such, countries are ensuring that regulations are in place to keep companies under checks and balances. Stakeholders must begin factor in data privacy into their functions and processes to avoid fines and countries that want to play on a globally competitive field need to start working-out ways to ensure that companies within their territories begin to meet these global privacy demands.
Contact us here, let’s have a chat on your company’s data privacy issues.