I'm curious: Do you know of any cases of the scenario you described actually happening?
Paying a ransom with the intent of attempting to hide the breach is very risky, since that's strictly illegal and hard to accomplish as it's hard to ensure that everyone involved, up to the lowest level of IT helpdesk technicians who might have noticed it, will forever keep secret the fact that the breach occured.
The GDPR has been here for two years already; the hypothetical scenario you describe has discussed but has not shown itself in practice.
Would we actually know if it had happened though? Or are you assuming that it would simply be infeasible to keep under wraps?
If criminals compromise your systems and steal data that you are legitimately storing in a reasonable manner, then the breach by itself is not a justification for any major fines under GDPR - but not reporting a data breach definitely is punishable.
Here's a recent example of a data breach in a telecom company- https://www.timelex.eu/en/blog/belgian-data-protection-autho... - "the data breach was correctly reported and that the company had taken appropriate organisational and technical measures. A data breach therefore does not necessarily give rise to a fine."
The only scenario where this threat might be real is if the breach would expose some previous wrongdoings, e.g. if the company was collecting the data in an illegal manner and had kept that fact hidden until the breach, if then, sure, that could be a valid basis for blackmail because the breach would suddenly expose the fact that you deserved some regulatory action long ago. Of course, any disgruntled employee also could try the same blackmail. However, if you're a legitimate company doing everything as required per law (including proper notification of data breaches), then the consequences of publishing that data would involve reputation costs and perhaps some civil claims for damages, but not any GDPR fines.
There's a potential for fines if breach happened because of your gross negligence, there's some precedent for that - for example, the Mariott data breach case. But again, the fines and their amount aren't automatic (the law just sets a ceiling), administrative proceedings take into account the circumstances and intent, all the largest fines assigned so far are significantly below the maximum. However, we should expect that the scenario of intentionally paying a ransom to hide the breach and "avoid the fines" would actually result in more severe penalties (because it checks pretty much all the boxes for aggravating circumstances) while properly handling a breach would result in reduced fines even if serious negligence was involved.
Can you cite any examples where The threat of GDPR has contributed to the payment of fines
I don't have any idea regarding the scale of the impact laws like GDPR have had on cybercrime; I'm just pointing out that there's clearly an interaction (and I'm not the first person to say this by any means), and that I would be interested to know whether the California privacy laws had any impact on UC's decision.
I'm a big supporter of GDPR by the way; this isn't an "anti-GDPR fantasy", just my observation on a potential interaction between GDPR and cyber crime.
The ransomware threat is usually to destroy the data. That is obviously a problem but it's not a privacy problem.
There is no such thing as "estimated fine amount" to base you ransom on. It depends on how important the company treated its security and how obvious the data leak is.
Indeed. Which allows an attacker who is familiar with previous regulatory action to estimate the fine based on the specific circumstances involved in their attack.
But in any case that is not the problem of the regulations.
a) Release stolen data;
b) Anonymously supply the regulator with full details of the leak
unless a ransom was paid, I imagine that the threat of an audit and potential regulatory action would be enough to persuade the company to pay the ransom if it believed the cost of the ransom to be lower than the cost of an investigation by the regulator.
Or they could pay the ransom, which they deem to be less expensive than dealing with the regulator, and improve their data security to ensure they don't get caught out again.
I fully understand (and support) the reasoning behind GDPR; I just think that in this case there is a path which is easily open to abuse by attackers.
One might as well ask
> Why does anyone stay in business in CA?
since (I believe) Californian state law has similar reporting requirements (and fines/civil liability) for breaches.
Nor the US where, for example, Target paid millions in a settlement for getting hacked.
In theory however, even if the organisation recovers the data by paying the ransom, they should still report this as a data breach, and would probably be fined by the regulator even though the data was recovered, since the breach still occurred in the first place.
I'd be very interested to know the impact the new California state laws on privacy have had on UC's decision to (seemingly) pay the ransom; I'm not based in the US, nor am I familiar with the jurisdiction, but I imagine that this will have been taken into account and might explain why UC acted differently to MSU here.