But looking forward, in light of the public interest issues these cases generate, the new EU General Data Protection Regulation (GDPR) and Payment Services Directive (PSD2) from 2018, and the recent Equifax breach (see below), we can expect
significantly heavier penalties to become the norm for both firms and their senior managers / directors under the senior managers» regime.