British Airways faces record £183m ICO GDPR fine

The penalty represents 1.5% of the firm’s annual turnover for hacks that affected 500,000 people

A BA plane in transit

The UK data regulator has issued British Airways (BA) with a notice of its intent to fine the company 183 million after hackers compromised the personal data of half a million customers.

Following an investigation under the EU's General Data Protection Regulation (GDPR), the Information Commissioner's Office (ICO) has issued the airline with a notice of its intention to fine it 183.39 million.

The UK airline revealed last year that cyber criminals had attacked the company and stole personal data belonging to 380,000 people over a two-week period between late August and early September. This included payment information from those using the BA website and mobile app to make bookings.

BA then disclosed a second cyber security incident a month later, affecting a further 185,000 customers who had made bookings using the Avios reward currency between late April and late July.

The hacks were part of a wider malicious campaign said to be orchestrated by the Magecart group, an organisation that also attacked Ticketmaster and Newegg in similar data breach incidents over 2018.

"People's personal data is just that - personal," said the Information Commissioner Elizabeth Denham. "When an organisation fails to protect it from loss, damage or theft it is more than an inconvenience.

"That's why the law is clear - when you are entrusted with personal data you must look after it. Those that don't will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights."

Under GDPR, organisations that violate the data protection laws are exposed to financial penalties totalling 20 million, or 4% of global annual turnover. For scale, a figure of 183 million represents 1.5% of BA's revenue for 2017.

A notice of intent is not a fine in itself; rather a reliable estimate for the region in which the final decision will lie, with the 183 million figure subject to change.

The ICO said its decisions are based on the incident's severity, including how many people were affected, the data involved, any failings by the organisation, and measures it took to co-operate, as well as mitigate any damage.

BA will have 28 days to argue against the penalty and any points the ICO has raised before the data regulator consults with its European counterparts and comes to a final decision. The ICO says this process can take up to 16 weeks in total.

"We are surprised and disappointed in this initial finding from the ICO," said BA's chairman and chief executive Alex Cruz.

"British Airways responded quickly to a criminal act to steal customers' data. We have found no evidence of fraud/fraudulent activity on accounts linked to the theft. We apologise to our customers for any inconvenience this event caused."

BA's parent company the International Airlines Group (IAG) also confirmed the company will make representations to the ICO within the 28-day window, and will "take all appropriate steps to defend the airline's position vigorously".

"The industry needs to understand not only how to prevent, but how to react to large breaches if it is to avoid major action," said CEO of the Chartered Institute of Information Security Professionals Amanda Finch.

"Businesses need not only the technical skills that help make the organisation secure, but the "soft" interpersonal skills that help create a security-minded culture across the company.

"IT security is in the middle of a long-overdue period of professionalisation - standardising approaches and skills to ensure best practice at all times. Events like these show that it can't happen quickly enough."

If the 183 million fine is issued in its entirety, it will represent the largest GDPR fine an organisation has been given since the regulations came into force more than a year ago.

Moreover, this will be more than three times as large as the sum regulators have accrued through GDPR fines across the continent, 50 million up to February 2019.

The prospective penalty also dwarves the 45 million fine the French data protection authorities slapped Google with at the start of 2019.

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Recommended

8 of the most secure web browsers
web browser

8 of the most secure web browsers

25 Sep 2020
Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
The Xbox Series X shows how far the cloud still has to go
Cloud

The Xbox Series X shows how far the cloud still has to go

25 Sep 2020