Analysis reveals two key reasons behind 65% of GDPR fines

Unsecured and over-retained data was responsible for 26% of fines totalling £123,663,350, from high-profile organisations such as Marriott, as well as Deutsche Wohnen and 1&1 Telecom. 

Unlawful use of personally identifiable information (PII) and failure to comply with Data Subject Access Requests (DSAR), such as in the case of Vodafone and Google, was responsible for 19% of fines totalling £92,055,300. The remaining 16% totalled £77,135,050 and comprised a range of issues, such as Uber’s failure to report a breach fast enough, Unicredit’s incorrect sharing of data and H&M’s massive £32m fine this month for unlawful use of employee data.

Exonar’s CEO, Danny Reeves, said: “Nearly 65% of GDPR fines were caused because of insufficient security and storing unsecured data. Securing your data first can play a vital role in not only meeting GDPR standards but also help mitigate the risk of the insufficient security - as it will be harder for hackers to access any data in the event of a breach.”

Reeves continued: “Many organisations simply don’t know what data they’ve got, or how much over-retained data they hold because it is no longer visible. Dark data like this is a point of weakness in any organisation – and in order to fully secure the data, organisations need to first get a clear understanding of what data they hold.”