< Back to latest news & events

News

British Airways’ fine reduced to £20 million

October 2020

Information Commissioner’s Office substantially reduces the intended fine following BA submissions and full consideration of the issues.

Back in September 2018 we wrote about BA experiencing a large scale data breach following a sophisticated criminal attack which involved the bad actor compromising BA’s systems by misusing legitimate credentials which BA had given a third party service provider’s staff member. In the aftermath of the breach, the ICO announced their intention to fine BA £183 million, however, following three rounds of submissions from BA the ICO have now issued a notice that they are fining BA £20 million (initially reduced down to £30 million then to £20 million including a £3 million COVID-19 deduction) for the data breach that affected more than 400,000 BA customers; and allowed unlawful access to over 100,000 credit card details.

While reducing the fine by over £160 million will be seen as a success by BA, given the wider challenges faced in the aviation industry, the fine is still unwelcome. That said, from an outsider’s perspective £20 million would seem like a much larger sanction and deterrent, had the ICO not initially indicated a much larger figure.

BA’s issues stem from having IT systems in place that did not provide an adequate degree of security, particularly given the volume and nature of the personal data being processed. Further, information was being retained which BA did not need (or even intend to retain). BA did not even discover the security breach itself, indicating inadequate network monitoring, but rather was informed of an anomaly by an observant third party which sparked their response efforts. There is always a challenge in preparing for and preventing all possible attacks from malicious actors, however BA’s approach was considered inadequate, which led to this fine. BA does have a right to appeal so this process may not be over yet.

To avoid ending up in a similar position, it is essential that businesses have the technical and organisational systems in place to protect the personal data they process and that they deploy automated monitoring tools scanning for system anomalies which may indicate a personal data breach is happening. Such measures should be proportionate to the nature (e.g. volume, risk, sensitivity) of the personal data being processed. Consideration should also be given to only retaining personal data for as long as necessary with appropriate operationalisation of data retention policies.

BA does get credit for its response to the breach once  discovered. Under GDPR, given the seriousness of the breach and the risks to customers, BA was obliged to notify promptly the ICO, which it did, suggesting its internal processes around data breach reporting were up to date. As mentioned in our previous article, data breach reporting (introduced by GDPR) has brought a new angle to how organisations respond to data breaches. Breaches do not necessarily need to be reported unless they are of a serious nature but where they are reportable there are tight timescales for action. Given the timescales required, the time it may take to identify the nature of a breach and whether it is reportable, having clear policies, procedures and reporting lines avoids confusion, enables reportable breaches to be correctly identified, and mitigates the publicity and regulatory fallout of a muddled or non-compliant approach. Organisations with mature data protection programs hold regular personal data breach simulations to rehearse their response times and effectiveness.

Being prepared to handle a breach involves identifying people within your organisation who have responsibility for data protection, ensuring employees know the importance of reporting a breach, setting out key criteria for decision making and keeping a record not just of reportable breaches but also of non-reportable breaches which includes your justification for not reporting.

Given that two and a half years have passed since the introduction of GDPR now might be a good time to consider reviewing your organisation’s policies and procedures around data protection and whether much has changed in the way you handle personal data since they were put in place. Sophisticated organisations increasingly engage “white hat” hackers to test their data security to identify weak spots before the bad actors do. Given the ongoing nature of working towards GDPR compliance, if your data breach response policies and procedures haven’t been looked at since they were put together, the reminder of the financial and publicity implication of failures in this area might prompt an overdue review!

This article was prepared by HGF Senior IP Solicitors James Talbot and Emily Nousios. If you would like further advice on this or any other matter, please contact James or Emily. Alternatively, you can contact your usual HGF representative or visit our Contact page to get in touch with your nearest HGF office.

Latest updates

Exam Success!

HGF are delighted to announce success for many of our colleagues in the recent exams on becoming qualified attorneys and would like to congratulate them on this fantastic achievement. Martyn …

Read article

In2ScienceUK continues to promote diversity and inclusion in STEM and IP with its award winning programme

HGF are proud sponsors of In2ScienceUK, a charity that gives young people from low-income backgrounds the opportunity to gain essential insights into science, technology, engineering, and mathematics (STEM) careers with …

Read article

Spotting innovation in digital health – and can you patent it?

Intellectual Property (IP) can add significant value to your business, providing a competitive edge over the market, as well as demonstrating sound business planning to help secure investment. There are …

Read article

Innovation at the heart of UK medtech strategy

The UK Department of Health and Social Care has recently published the government’s first ever medical technology strategy in an effort to accelerate access to innovative technologies. The strategy document …

Read article

How medtech start-ups can supercharge their IP for fundraising

Why is IP important for fundraising? Intellectual property (IP) rights underpin the value of most medtech start-up companies. IP rights include patents, design rights, trade marks, copyright and trade secrets …

Read article

What is EUDAMED and how will it affect your IP strategy?

The “European database on medical devices”, or “EUDAMED”, is the EU’s IT system created by the new Medical Devices Regulation (MDR) and In Vitro Diagnostics Medical Devices Regulation (IVDR). When …

Read article