Photo: Shutterstock

Just shy of one year into the European Union's General Data Protection Regulation, companies and their legal departments should double-check they are keeping up with the law or face fines and other punishments, according to experts.

The GDPR was implemented May 25, 2018, and in the first year fines were not as large as anticipated.

Todd Marlin, a principal and forensic data analytics and data science leader at Ernst & Young, said the average fine has been approximately 70,000 euros. He would also expect the fines to grow in size as time goes on.

"The largest fine has been 50 million euros, which is pretty small considering the regulation's standards," Marlin said.

The smaller fines are a result of an unofficial grace period from European regulators, said Odia Kagan, a partner a Fox Rothschild in Philadelphia and chair of the firm's GDPR compliance and international privacy practice.

Kagan said larger fines and other punishments are coming.

"The regulators that were interviewed prior to the implementation of GDPR have said they're not going to enforce the new obligations right away," Kagan said.

Kagan said, however, bigger fines are coming. She said it takes time to go through the process of finalizing those large fines. In January, Google was slapped with a $57 million fine from the French regulator. It took some time for the regulator to investigate the complaint and issue a fine considering the complaint against Google was among the first made when the GDPR was implemented.

The fines are not the worst kind of punishment European regulators can enforce on a company. Kagan said if regulators are notified about a breach and find companies did not do enough to protect the data, they can tell a company it has 90 days to remedy the situation or the company faces not being able to use the data that it collects.

"Companies can just pay the fine because they make more money than the fine," Kagan said. "If they're told they can't use the data; that is big."

Going forward, European regulators will want to see continued compliance rather than just having boxes checked, Kagan said.

One of the ongoing challenges is that corporations will have to remain compliant with the GDPR while focusing on new privacy regulations from different jurisdictions.

Marlin said companies have to decide how to proceed. Whether they want to remain compliant with just the GDPR may make sense in the immediate future, but is not a good long-term plan. Data protection, Marlin said, has become more than just a legal issue.

"It is an ongoing business process. Data never sleeps," Marlin said. "More and more jurisdictions are coming out with privacy statutes."