New survey of European data protection lawyers reveals that most businesses aim to keep a low profile with regulators

Posted: 14/05/2015

A new survey of European data protection lawyers carried out by Penningtons Manches LLP into the current trends and perceptions about data protection regulation across Europe indicates that businesses aim to stay under the radar of their regulators against a background of red tape and uncertainty about the forthcoming new legislation.

The three most significant issues currently affecting lawyers and their clients’ data protection practices are the restrictions placed on businesses by the plethora of rules and regulations; the challenge to keep up to date with the regulations; and the transfer of data outside the EEA.

The four industry sectors most heavily targeted by regulators over the past 12 months are perceived by the respondents to be health/social care and marketing/advertising/PR – cited by 53% of respondents – followed by accountancy/banking/finance (47%) and technology service providers (40%).

Other survey findings include:

• 80% of respondents believe that businesses regard the data protection law in their country as bureaucratic 
• 87% of respondents agree that their clients have become more aware of their obligations over the past year 
• Two thirds (66%) of respondents say that their clients are worried about “having appropriate data protection and security policies in place” 
• 60% are worried about “transferring personal data outside of the EEA” 
• A third of respondents believe that businesses are concerned about the restrictions on their direct marketing activity and the need to obtain consents for this activity 
• The most common breaches of data protection law identified by respondents are the failure to have required policies and contracts in place (47%) and the failure to identify personal data (40%) 
• More than half (53%) of respondents said that the data protection regulator in their country had not issued guidance on how it deals with complaints relating to the handling of “right to be forgotten” requests (in response to the Google Spain case) 
• Almost three quarters (73%) of respondents think that the data protection regulator in their country has sufficient powers to act against nuisance calls (i.e. unsolicited sales or marketing calls). 

Summing up the views of survey respondents from 13 European countries, one respondent said: “Legal uncertainty makes it virtually impossible for most businesses to live up to every word of the law which, in turn, leads to a laissez-faire attitude towards data protection. The main concern for companies seems to be to "stay under the radar".”

Commenting on the findings, Jo Vengadesan, a partner in the Penningtons Manches data protection and privacy team, said: “Although the survey findings indicate that businesses are trying to keep a low profile, data protection is now firmly on the public and political agenda. With the threat of huge fines for non-compliance with the impending EU Regulation, organisations cannot afford to ignore data protection compliance and it should be treated as a priority for all businesses that process personal data.

“Robust compliance with the current legal framework will put an organisation in good stead to deal with the anticipated new laws and will help to create a culture of privacy awareness and good practice that will be key to compliance.”

The full Penningtons Manches Data Protection Survey can be read here. Input to the survey was received from data protection practitioners within Multilaw firms in Austria, Bulgaria, Czech Republic, Denmark, Germany, Greece, Italy, Luxembourg, Malta, Netherlands, Portugal, Turkey and the UK.

Return to news headlines