Tell them to look no further for a solution than Europe's GDPR. The GDPR gives individuals the right to the privacy and security of their personal data. Compa

Tell them to look no further for a solution than Europe's GDPR. The GDPR gives individuals the right to the privacy and security of their personal data. Companies that collect this data do so at their own risk, and have an obligation to secure and not proliferate that data. This legislation has huge, sharp teeth. It comes into full-effect in May 2018, and every single multinational is running around in a "pants-of-fire" panic trying to figure out how to comply. If Equifax had to pay 4% of their global annual turnover per day of non-compliance, would they act? Yes, of course. --- > How is the fine calculated? > Article 58 of the GDPR provides the supervisory authority with the power to impose administrative fines under Article 83 based on several factors, including: > The nature, gravity and duration of the infringement (e.g., how many people were affected and how much damage was suffered by them) > Whether the infringement was intentional or negligent > Whether the controller or processor took any steps to mitigate the damage > Technical and organizational measures that had been implemented by the controller or processor > Prior infringements by the controller or processor > The degree of cooperation with the regulator > The types of personal data involved > The way the regulator found out about the infringement > The greater of €10 million or 2% of global annual turnover > If it is determined that non-compliance was related to technical measures such as impact assessments, breach notifications and certifications, then the fine may be up to an amount that is the GREATER of €10 million or 2% of global annual turnover (revenue) from the prior year. > The greater of €20 million or 4% of global annual turnover > In the case of non-compliance with key provisions of the GDPR, regulators have the authority to levy a fine in an amount that is up to the GREATER of €20 million or 4% of global annual turnover in the prior year. Examples that fall under this category are non-adherence to the core principles of processing personal data, infringement of the rights of data subjects and the transfer of personal data to third countries or international organizations that do not ensure an adequate level of data protection.