This Week In Data/Cyber/Tech: Are Regulators Required To Enforce Following A Personal Data Breach?

There's rarely a quiet week in data protection — and this one was no exception. Below is the most interesting development from the past seven days that caught my eye.

What is the likelihood that we will face regulatory enforcement as a result of a personal data breach?

This is one of the questions that I never get tired of thinking about. It's both art and science, drawing on law, regulatory guidance and what you've seen and heard in the field. All of which makes for an endlessly fascinating mix.

Last week, the European Court of Justice held that that supervisory authorities are not obliged to exercise their corrective powers under the GDPR — including the imposition of fines — whenever an organisation suffers a personal data breach. In other words, regulators have the discretion to find that not all breaches should, and indeed will, result in enforcement action.