An article came into my timeline about BA being fined £183m and Marriot being fined £100m, how are these fines calculated?

 

Also, do staff or members of the public get rewarded if they report or notice a data breach before it becomes widespread?

 

Fin

GDPR non-compliance fines are levied on a per-case basis, but with no real guidelines short of “effective, proportionate and dissuasive”. That's why everyone's looking at these big fines since GDPR came in as guidance really. Legislation gives two tiers of punishment - up to 10m Euros / 2% of annual turnover or up to 20m Euros / 4% of annual turnover, dependant on the severity of the breach, but how they choose an actual number is pretty much guesswork at this stage.

 

The amount of effort a company has put into adhering to the GDPR is likely to help reduce the fine, but I don't think there's any kind of math used against a criteria or anything.

 

Staff have a duty to report any breaches to their DPO, and an organisation should notify the ICO of any severe breach within 72 hours anyway, so I doubt there'd be any reward unless your employer is super happy you've just saved their arse from it turning from a small breach that no one's noticed into a severe problem that could cost the company millions without your action.

Companies / Corporations that have their own breaches but whistle blow on Companies / Corporations that they partner with, maybe even ones they knew were breaching along with might well be getting a good deal on any penalty they have imposed on them.