George Scott, Director for KPMG’s Cyber & Privacy practice in Scotland, warns companies in the upstream energy sector of impending changes to EU data protection laws in the form of General Data Protection Regulations.
The European Union’s (EU’s) new General Data Protection Regulation (GDPR), which will supersede the 1998 Data Protection Act, heralds a new era for data privacy. GDPR is a recognition of the importance and sensitivity of data handling for the 21st century, particularly as we leave behind an unparalleled year for cyber breaches across sectors.
While the last five years have seen significant data loss incidents, with some commentators suggesting a laissez-faire attitude from consumer giants towards security, the oil and gas industry should take heed of these breaches and look at its own data handling practices before the new EU GDPR regulations come into effect next year [2018].
For those questioning their eligibility, given the UK’s decision to leave the EU, the UK regulator has confirmed their commitment to the GDPR and its underlying principles. Non-compliance with GDPR, could mean that oil and gas firms will immediately restrict themselves from trading with the EU.
Therefore, if by 25 May 2018, data handling policies are not up to industry standards, in addition to jeopardizing revenue streams, firms may face fines of up to €20 million, or, 4% of annual turnover (whichever is greater) – an unthinkable amount for any firm, and the last thing the sector needs.
GDPR will impact any business that stores personal data electronically – regardless of size and function. This includes the majority of operators, contractors and third party supply chain partners. Assume that if you hold any information falling within the scope of the Data Protection Act of 1998 e.g. HR records of staff, contractor lists, or contact details etc. then you need to comply.
Companies must also have the ability to register breaches with the relevant authorities within 72 hours. To do this comprehensively they need to have understood the complexities of the regulations, and have mapped out data collection and processing steps, right through the supply chain.
This will take time and board directors should recognize this as a problem for today. Failure to prepare and invest now, means paying the price tomorrow. The implementation of the EU GDPR requires comprehensive changes to business practices for companies that may not have ever implemented a comparable level of privacy before.
Simply put, there are exceptional financial, legal and reputational drivers for oil and gas businesses to ensure they are compliant with the new regulations, come May 2018.
Subscribe
