The head of the UK’s data protection watchdog has described the recent events surrounding Facebook and Cambridge Analytica as “a game-changer.”

Addressing the Data Protection Practitioners’ Conference in April 2018, Information Commissioner Elizabeth Denham commented:

“The investigation [into this matter] is ongoing and it would not be appropriate for me to make further comment, other to acknowledge that I welcome the focus on data rights for citizens and consumers in the centre of public discussion and debate.

“One thing is certain. The dramatic revelations of the last few weeks are a game changer in data protection.

“Suddenly everyone is paying attention. The media, the public, parliament, the whole darn planet it seems.”

Facebook has admitted that as many as 87 million users of the social media site – one million of whom are based in the UK – could have had their data improperly shared with Cambridge Analytica.

Even before the Cambridge Analytica scandal, a number of people within the industry had suggested that firms could expect more complaints about the way their data had been handled.

Financial Ombudsman Service chief ombudsman Caroline Wayman appeared before Parliament’s Treasury Select Committee in January 2018, where she said:

“There are quite a few areas of our work where you see the convenience versus security as a real inherent tension.

“It is great, mostly, that you can take out a loan very quickly through a few clicks on your phone but there is also with that greater convenience there is also the flip side of that, when things go wrong and the need to protect against things going wrong and how people use their data.

“I think that is a really interesting area. Not just big data, but in general. I think that is an area to watch.”

Rob Walton, chief operating officer at Intelliflo, a provider of financial services software, recently referred to Article 82 of the new General Data Protection Regulation (GDPR) as “the ambulance chasing article”. Mr Walton clarified his remarks by saying:

“Article 82 makes it possible for data subjects to sue firms for any breach of their rights under the GDPR, even if it does not cause a material loss. We could be about to see the next ‘no win, no fee’ industry.”

Many industry commentators have offered their own opinions as to what might be ‘the new PPI’, i.e. what area consumers and claims management companies might turn their attentions to once the PPI saga has ended. So, could complaints about the use of consumers’ data become ‘the new PPI’? There has certainly been a lot of publicity about GDPR, and about the Cambridge Analytica affair, and the issue will be uppermost in many people’s minds. Furthermore, whilst by no means every financial services firm got involved with PPI, every single firm in the financial industry, and elsewhere, needs to observe data protection laws. There is therefore the potential for every firm in the country to receive more data protection-related complaints if they do not have sufficiently robust procedures for the processing of personal data with which they are entrusted.

Ms Denham’s conference speech also tried to calm fears that GDPR will see a raft of huge fines imposed on firms, simply because they inadvertently breached the new legislation in a small way. The Commissioner said:

“Hefty fines will be reserved for those organisations that persistently, deliberately or negligently flout the law. Those organisations that self-report, engage with us to resolve issues and can demonstrate effective accountability arrangements can expect this to be a factor when we consider any regulatory action.”

She also reminded her audience that the Information Commissioner’s Office does not always impose fines when it finds evidence of wrongdoing, and that other enforcement tools available to the regulator include “compulsory data protection audits, warnings, reprimands, and enforcement notices.”

The information shown in this article was correct at the time of publication. Articles are not routinely reviewed and as such are not updated. Please be aware the facts, circumstances or legal position may change after publication of the article.