Everyone's Worried About GDPR, but It May Be the Y2K of Data Privacy
The message that lawyers have for companies nervous about GDPR compliance and heavy fines: For now, keep calm and carry on.
May 25, 2018 at 12:59 PM
5 minute read
Friday marks the beginning of a new era in cybersecurity and the treatment of personal data for companies in Europe and around the world processing European Union citizens' information. Collective angst is in the air over zero hour for the EU's General Data Protection Regulation, but is there any reason, in the near term, to be afraid?
Attorneys who work on data and privacy matters told Corporate Counsel that it's unlikely most companies need to worry about multimillion-dollar fines and close probes by regulators just yet.
One attorney, Michael R. Cohen, compared the hype over GDPR to the unsubstantiated panic over Y2K.
“As lawyers, we love to put the fear of God into people,” said Cohen, a data protection attorney and principal at Gray Plant Mooty in Minneapolis. “Sure enough the year 2000 came around and we're all still here.”
Cohen said that his clients, in preparing for GDPR, are rushing out of panic when they should be moving at a more measured pace, with a focus on making sure they are hitting each step of the compliance process adequately.
“I'm getting a lot of clients that think they need to get everything in order by [May 25]. It is more important to get it right,” Cohen said.
GDPR Enforcement
The GDPR was passed by the EU in 2016 and contains numerous requirements that will be enforced by 28 data protection authorities across Europe. Provisions include new standards around consent to use data and around data breach notifications, as well as a right to be forgotten. Many companies will also need to appoint a data protection officer.
GDPR violators face high fines equal to €20 million or 4 percent of the offending company's worldwide revenue, whichever is higher.
While the fines seem daunting and the standards of compliance may seem complex, there will likely not be a flurry of multimillion-dollar fines in the first week, attorneys said. In fact, a report by Reuters earlier this month indicated 17 of 24 regulatory authorities that responded to a survey either did not yet have the funding or would initially lack the power to enforce the GDPR.
Miriam Wugmeister, a partner at Morrison & Foerster in New York, said in an email that there will not be any “dawn raids” taking place.
“Several of the data protection authorities have said that they are interested in helping companies comply rather than being punitive. While the potential maximum fines have gone up, the data protection authorities are interested in getting companies to comply rather than punishing them,” Wugmeister said in an email.
Cohen said that he is telling his clients to “take a breath.” Low-profile companies do not appear to be on the radar for GDPR enforcement authorities, he said. Those authorities, despite having minimal funding, have set their sights on larger, high-profile companies, though it's unclear what enforcement will ultimately look like, Cohen explained.
Kim Roberts, counsel in the London office of King & Spalding, said that in Ireland, GDPR regulators have indicated there would be less leeway because companies have had two years to become compliant with the regulation. However, a short way across the ocean in Britain, regulators have indicated they would be more willing to forgive companies not fully compliant.
Despite these inconsistencies, no one should expect to see multimillion-Euro fines on Friday or even the week after, according to Roberts.
Compliance Confusion
Perhaps companies need not panic over GDPR yet, but that doesn't mean they don't have some compliance pain points that need to be addressed in the coming weeks and months.
Laura Jehl, a partner at Baker & Hostetler and former general counsel of Anthem Health, said that she is seeing confusion over what is required in terms of data processing addendums that companies are supposed to send to third-party vendors.
She also said that U.S. companies are missing the mark on consent requirements.
“The U.S. companies are used to opt out scenarios,” Jehl explained. “The GDPR requires opt -in consent. You have to consent to specific activities.”
The GDPR has created some consent confusion, as companies must get “freely given, specific, informed and unambiguous” consent under the rules to collect an individual's data, though there are some exceptions.
Roberts said that she is seeing confusion on who in a company would make an appropriate data protection officer.
“There is a lot of concern around the data protection officer and whether or not one needs to be appointed,” Roberts said. “Who is the right person to do that? Is it someone in IT; is it a privacy specialist?”
Some major companies have already made their DPOs' identities public. Facebook Inc. named Stephen Deadman, who was previously the company's global deputy chief privacy officer, as DPO on Wednesday. In March, Microsoft named Steve May, a software engineer and privacy program manager as its DPO.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllAI Disclosures Under the Spotlight: SEC Expectations for Year-End Filings
5 minute readA Blueprint for Targeted Enhancements to Corporate Compliance Programs
7 minute readThree Legal Technology Trends That Can Maximize Legal Team Efficiency and Productivity
Trending Stories
- 1The New Rules of AI: Part 2—Designing and Implementing Governance Programs
- 2Plaintiffs Attorneys Awarded $113K on $1 Judgment in Noise Ordinance Dispute
- 3As Litigation Finance Industry Matures, Links With Insurance Tighten
- 4The Gold Standard: Remembering Judge Jeffrey Alker Meyer
- 5NJ Supreme Court Clarifies Affidavit of Merit Requirement for Doctor With Dual Specialties
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250