< Back to latest news & events

News

British Airways’ fine reduced to £20 million

October 2020

Information Commissioner’s Office substantially reduces the intended fine following BA submissions and full consideration of the issues.

Back in September 2018 we wrote about BA experiencing a large scale data breach following a sophisticated criminal attack which involved the bad actor compromising BA’s systems by misusing legitimate credentials which BA had given a third party service provider’s staff member. In the aftermath of the breach, the ICO announced their intention to fine BA £183 million, however, following three rounds of submissions from BA the ICO have now issued a notice that they are fining BA £20 million (initially reduced down to £30 million then to £20 million including a £3 million COVID-19 deduction) for the data breach that affected more than 400,000 BA customers; and allowed unlawful access to over 100,000 credit card details.

While reducing the fine by over £160 million will be seen as a success by BA, given the wider challenges faced in the aviation industry, the fine is still unwelcome. That said, from an outsider’s perspective £20 million would seem like a much larger sanction and deterrent, had the ICO not initially indicated a much larger figure.

BA’s issues stem from having IT systems in place that did not provide an adequate degree of security, particularly given the volume and nature of the personal data being processed. Further, information was being retained which BA did not need (or even intend to retain). BA did not even discover the security breach itself, indicating inadequate network monitoring, but rather was informed of an anomaly by an observant third party which sparked their response efforts. There is always a challenge in preparing for and preventing all possible attacks from malicious actors, however BA’s approach was considered inadequate, which led to this fine. BA does have a right to appeal so this process may not be over yet.

To avoid ending up in a similar position, it is essential that businesses have the technical and organisational systems in place to protect the personal data they process and that they deploy automated monitoring tools scanning for system anomalies which may indicate a personal data breach is happening. Such measures should be proportionate to the nature (e.g. volume, risk, sensitivity) of the personal data being processed. Consideration should also be given to only retaining personal data for as long as necessary with appropriate operationalisation of data retention policies.

BA does get credit for its response to the breach once  discovered. Under GDPR, given the seriousness of the breach and the risks to customers, BA was obliged to notify promptly the ICO, which it did, suggesting its internal processes around data breach reporting were up to date. As mentioned in our previous article, data breach reporting (introduced by GDPR) has brought a new angle to how organisations respond to data breaches. Breaches do not necessarily need to be reported unless they are of a serious nature but where they are reportable there are tight timescales for action. Given the timescales required, the time it may take to identify the nature of a breach and whether it is reportable, having clear policies, procedures and reporting lines avoids confusion, enables reportable breaches to be correctly identified, and mitigates the publicity and regulatory fallout of a muddled or non-compliant approach. Organisations with mature data protection programs hold regular personal data breach simulations to rehearse their response times and effectiveness.

Being prepared to handle a breach involves identifying people within your organisation who have responsibility for data protection, ensuring employees know the importance of reporting a breach, setting out key criteria for decision making and keeping a record not just of reportable breaches but also of non-reportable breaches which includes your justification for not reporting.

Given that two and a half years have passed since the introduction of GDPR now might be a good time to consider reviewing your organisation’s policies and procedures around data protection and whether much has changed in the way you handle personal data since they were put in place. Sophisticated organisations increasingly engage “white hat” hackers to test their data security to identify weak spots before the bad actors do. Given the ongoing nature of working towards GDPR compliance, if your data breach response policies and procedures haven’t been looked at since they were put together, the reminder of the financial and publicity implication of failures in this area might prompt an overdue review!

This article was prepared by HGF Senior IP Solicitors James Talbot and Emily Nousios. If you would like further advice on this or any other matter, please contact James or Emily. Alternatively, you can contact your usual HGF representative or visit our Contact page to get in touch with your nearest HGF office.

Latest updates

IP Ingredients, Part 15: How and when to use trade secrets to protect your food or drink innovations

Some of the food and drink industry’s most successful products are protected as trade secrets: the recipes for Coca Cola, Heinz ketchup and Krispy Kreme donuts to name just a …

Read article
Event - 11th June 2024

HGF are proud sponsors of the Quantum Investors Network: LtW Summit.

The Quantum Investors Network: LtW Summit will be held in London on 11th June 2024, where Matt Cassie will be speaking on the panel ‘Talent, IP, Standards: moats – past …

Event details

IAM Patent 1000 2024

The IAM Patent 1000 World Leading Patent Professionals 2024 has been published and we have received another fantastic result with 31 of our attorneys being recognised as world-class individuals. As …

Read article

Romania will become 18th country to participate in the UPC and UP - EPO announce possibility to delay the registration of unitary effect

From 1 September 2024 Romania will become the 18th country to participate in the UPC following ratification of the UPC Agreement. This means that any Unitary Patents registered on or …

Read article

WTR Global Leaders 2024

The sixth edition of WTR Global Leaders has been published and we are proud to have four of our attorneys recognised and listed. The guide brings together the world’s foremost …

Read article

Managing Intellectual Property firm rankings - IP Stars 2024

We are pleased to announce that HGF has been prominently featured in the Managing IP Stars European rankings for 2024. Our firm’s continued excellence in the field of intellectual property …

Read article