Source : Information Commissioner’s Office

Article 4(11) of the UK GDPR sets out the essential ingredients of valid consent. ‘Consent’ is valid which is-

• freely given
• specific
• informed and unambiguous indication of the data subject’s wishes expressly given
• and signifies or communicates agreement to the processing of personal data relating to him or her.

None of these parameters were met by Digivo Media Ltd which led to the contravention of PECR and GDPR laws. Amid the increasing need to be on top of the game, the interpretation of laws must be accurate and it must strictly conform to the usage of language in the provisions of the acts.

For the industry at large, the fine serves as a stark reminder of the consequences of non-compliance. It serves as a warning and a deterrence, indicating the ICO’s attentiveness and willingness to enforce rules. This punitive step probably has a cascading effect, making other businesses examine and improve their data protection protocols.

Broader Industry Implications

As industries handle sensitive personal and financial information, the imperative to safeguard data is paramount. The increasing sophistication of cyber threats and the global nature of business have further magnified the need for strong data protection measures to be in place.

Recent trends in enforcement reveal a clear trajectory: regulatory bodies worldwide are intensifying their scrutiny and are more willing to impose substantial fines for non-compliance. This shift reflects a broader recognition of data privacy as a fundamental right.

The enforcement actions, such as the fine against Digivo Media Limited, serve as clear indicators of this trend and act as catalysts, compelling industries to elevate their data protection standards. Companies are now investing more in secure data infrastructure, comprehensive privacy policies, and employee training, recognizing that in the digital age, the protection of customer data is not just a legal obligation but a core aspect of business ethics and sustainability.

Common Privacy Compliance Mistakes and How to Avoid Them

Common privacy compliance mistakes include:

• Inadequate understanding of regulations
• Poor data management practices
• Insufficient employee training

Companies often underestimate the scope of data protection laws of their country like the GDPR, and PECR of Europe or even the DPDP Act of India, leading to non-compliance in areas like obtaining consent or data processing. Poor data management practices, such as inadequate data security measures or failure to maintain accurate records of consent, further compound these issues.

To avoid these pitfalls, companies should

• Invest in comprehensive training programs, ensuring that all employees understand the importance of data protection and their role in maintaining compliance
• Regularly updating privacy policies and consent forms in line with evolving regulations is crucial
• Implementing robust data security measures, conducting frequent audits, and maintaining clear, accessible records of data processing activities are also vital
• Engaging with data protection experts or legal counsel can provide valuable insights and guidance, helping companies navigate the complex landscape of data protection compliance effectively.

Lessons and Future Prospects For India

India can learn several important lessons from the fines imposed under the Privacy and Electronic Communications Regulations (PECR) and the General Data Protection Regulation (GDPR), particularly in the context of companies like Digivo Media Ltd. Companies in India will have to adapt to a new way of working in compliance with the Digital Personal Data Protection Act (DPDPA) which should come into operation once the 25 rules accompanying the act are out. One thing is amply clear and it is that despite taking huge steps towards compliance, even a small oversight can land a company in huge losses and a reputation change. Therefore, 100% compliance is essential at all times.

From the Digivo Media case, it is evident that the fines imposed by the empowered bodies in protection of data are huge. The fine incurred in this case was £50,000, which amounts to INR 52,41,966 in India. Moreover, the more the inconsistencies in compliance arise, the more the fines. As the saying goes, “Precaution is better than cure” and so companies in India will have to adhere to strict DPDPA regulations to steer away from non-compliance.