British Airways faces £190 million GDPR fine for 2018 data breach

On Monday (8th) The UK’s Information Commissioner's Office revealed its plan to hit British Airways with a £190 million fine over their 2018 data breach, one of the ICO's largest fines since new GDRP rules came into effect on May 2016.

BA disclosed the breach in September, which saw people visiting its website being diverted to a fraudulent site, where private details including name, billing address, email address and payment information were gathered by unscrupulous hackers.

Initially, BA indicated the breach occurred between August and September, affecting some 380,000 card payments. Later the airline suggested that another 185,000 people who had made bookings between April and July may have also been affected by the scam.

Elizabeth Denham, Information Commissioner, said when it comes to people’s personal data "the law is clear"

"When you are entrusted with personal data you must look after it," she added. "Those that don't will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights."

The fine represents 1.5% of BA's global turnover for the year. Under GDPR, companies can be fined the equivalent of £17 million or 4% of their total annual worldwide revenue in the preceding financial year, whichever is greater.

"We are surprised and disappointed in this initial finding from the ICO. British Airways responded quickly to a criminal act to steal customers' data," Alex Cruz, BA chief executive said. "We have found no evidence of fraud/fraudulent activity on accounts linked to the theft. We apologise to our customers for any inconvenience this event caused."
Willie Walsh, chief executive of the International Airlines Group, stated that the company plans to appeal the fine.