This article was published in 2019. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
A major data breach at British Airways, in which a large amount of personal data was stolen.
The British privacy regulator ICO intends to impose a fine of approximately 200 million euros on British Airways for a data breach in which the payment details of more than 500,000 customers were stolen via the website.
The Information Commissioner’s Office (ICO), the British government body that investigates privacy and digital security breaches, considers that British Airways has breached the privacy legislation. The fine corresponds to 1.5% of the turnover British Airways recorded in 2017 (£12.2 billion). The British ICO is clear about the law:
“People’s personal data is just that: personal. When an organisation fails to protect it from loss, damage or theft it is more than an inconvenience. That’s why the law is clear: when you are entrusted with personal data you must look after it. Those that don’t will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights.” said Information Commissioner Elizabeth Denham.
The ICO’s investigation shows that, due to poor security arrangements at the company, payment card, travel and address details could be stolen. Following the investigation, British Airways has implemented various security improvements.
Legal proceedings British Airways has 28 days to lodge an appeal. The British company has told the BBC that it will indeed appeal. The 2018 annual report of the listed IAG (the parent company of British Airways) also shows that British law firms have started legal proceedings on behalf of those affected by the data breach. Proceedings are also under way in the United States.