Privacy Business Risks on the Rise: Privacy Concerns can Lead to Significant Loss in Market Value

Recession arrow, Graph showing business decline on led screen

Business risks resulting from consumer privacy concerns are on the rise. Last week, Facebook and Twitter reported second quarter results which revealed that both companies lost a significant number of active users due to privacy and data protection concerns. Their stock price plummeted by approximately 20 per cent each, resulting in a combined loss in market value of approximately $125 billion ($119 billion for Facebook and $6 billion for Twitter). This new type of business risk was, up until now, relatively hypothetical, despite the rise of other privacy compliance and legal risks over the last few years.

Companies have to consider that they may be faced with a class action lawsuit following a security incident or the media reporting a privacy intrusive business practice. They may also be subject to fines of up to $100,000 in Canada starting November 1, 2018 if they contravene the security breach reporting, notification and record-keeping obligations under PIPEDA. The GDPR has raised the bar for the rest of the world with stringent requirements and rigorous enforcement measures, including fines which may amount to the higher of €20 million or 4 per cent of the organization’s total worldwide revenues. The Government of Canada recently expressed its support for aligning PIPEDA with specific provisions of the GDPR. It is therefore reasonable to expect that PIPEDA will be amended in the relatively short term to grant the OPC stronger enforcement powers, such as the power to make orders and impose fines for non-compliance and broad audit powers.

An emerging risk which businesses now have to consider is a loss in market value resulting from privacy concerns and a loss of consumer confidence in how a company is handling their personal information. This risk, which was until recently only hypothetical, is becoming a reality as demonstrated by the recent loss in market capitalization value for some social media giants. Businesses must be alert to privacy concerns and loss of consumer confidence when assessing their business models and associated risks. In terms of risk management, the days where the worst-case scenario resulting from a privacy complaint was an unresolved finding from the OPC naming the organization are behind us.

This content has been updated on May 2, 2024 at 14 h 02 min.