< Back to latest news & events

News

British Airways’ fine reduced to £20 million

October 2020

Information Commissioner’s Office substantially reduces the intended fine following BA submissions and full consideration of the issues.

Back in September 2018 we wrote about BA experiencing a large scale data breach following a sophisticated criminal attack which involved the bad actor compromising BA’s systems by misusing legitimate credentials which BA had given a third party service provider’s staff member. In the aftermath of the breach, the ICO announced their intention to fine BA £183 million, however, following three rounds of submissions from BA the ICO have now issued a notice that they are fining BA £20 million (initially reduced down to £30 million then to £20 million including a £3 million COVID-19 deduction) for the data breach that affected more than 400,000 BA customers; and allowed unlawful access to over 100,000 credit card details.

While reducing the fine by over £160 million will be seen as a success by BA, given the wider challenges faced in the aviation industry, the fine is still unwelcome. That said, from an outsider’s perspective £20 million would seem like a much larger sanction and deterrent, had the ICO not initially indicated a much larger figure.

BA’s issues stem from having IT systems in place that did not provide an adequate degree of security, particularly given the volume and nature of the personal data being processed. Further, information was being retained which BA did not need (or even intend to retain). BA did not even discover the security breach itself, indicating inadequate network monitoring, but rather was informed of an anomaly by an observant third party which sparked their response efforts. There is always a challenge in preparing for and preventing all possible attacks from malicious actors, however BA’s approach was considered inadequate, which led to this fine. BA does have a right to appeal so this process may not be over yet.

To avoid ending up in a similar position, it is essential that businesses have the technical and organisational systems in place to protect the personal data they process and that they deploy automated monitoring tools scanning for system anomalies which may indicate a personal data breach is happening. Such measures should be proportionate to the nature (e.g. volume, risk, sensitivity) of the personal data being processed. Consideration should also be given to only retaining personal data for as long as necessary with appropriate operationalisation of data retention policies.

BA does get credit for its response to the breach once  discovered. Under GDPR, given the seriousness of the breach and the risks to customers, BA was obliged to notify promptly the ICO, which it did, suggesting its internal processes around data breach reporting were up to date. As mentioned in our previous article, data breach reporting (introduced by GDPR) has brought a new angle to how organisations respond to data breaches. Breaches do not necessarily need to be reported unless they are of a serious nature but where they are reportable there are tight timescales for action. Given the timescales required, the time it may take to identify the nature of a breach and whether it is reportable, having clear policies, procedures and reporting lines avoids confusion, enables reportable breaches to be correctly identified, and mitigates the publicity and regulatory fallout of a muddled or non-compliant approach. Organisations with mature data protection programs hold regular personal data breach simulations to rehearse their response times and effectiveness.

Being prepared to handle a breach involves identifying people within your organisation who have responsibility for data protection, ensuring employees know the importance of reporting a breach, setting out key criteria for decision making and keeping a record not just of reportable breaches but also of non-reportable breaches which includes your justification for not reporting.

Given that two and a half years have passed since the introduction of GDPR now might be a good time to consider reviewing your organisation’s policies and procedures around data protection and whether much has changed in the way you handle personal data since they were put in place. Sophisticated organisations increasingly engage “white hat” hackers to test their data security to identify weak spots before the bad actors do. Given the ongoing nature of working towards GDPR compliance, if your data breach response policies and procedures haven’t been looked at since they were put together, the reminder of the financial and publicity implication of failures in this area might prompt an overdue review!

This article was prepared by HGF Senior IP Solicitors James Talbot and Emily Nousios. If you would like further advice on this or any other matter, please contact James or Emily. Alternatively, you can contact your usual HGF representative or visit our Contact page to get in touch with your nearest HGF office.

Latest updates

The EPO Board of Appeal comments on the scope of the morality exclusion from patentability

The recent decision, T1553/22 of the Board of Appeal required the Board to consider the scope of the exclusions from patentability under Article 53(a) EPC. The invention in this case …

Read article

WIPR Diversity Top 100 2025

HGF’s European Patent Attorney Alexandra Wood has been listed in World IP Review’s (WIPR) Diversity Top 100 2025 World IP Review’s Diversity in IP listings 2025 recognises and celebrates people …

Read article

INTA 2025 Annual Meeting Live

The HGF European team will be attending the INTA Annual Meeting Live, which will take place on 17th-21st May in San Diego, US. The conference will connect some of the …

Read article

HGF wins big at the Managing IP EMEA Awards Ceremony 2025

The Annual Managing IP Awards: EMEA Awards 2025 were announced last night, and HGF are proud to have won 7 awards. The Managing IP Awards are highly recognised and respected …

Read article

Plant Patent Infringement in the US Relies on Evidence of Asexual Reproduction

A recent case in the US District Court for the Northern District of Texas (Dallas Division) once again highlights how important the initial pleadings and evidence in patent infringement cases …

Read article

Exam Success at HGF!

HGF is pleased to announce that several of our attorneys have passed their UK Advanced Patent exams! In no specific order, we would like to say well done and a …

Read article

IP Ingredients: How food companies are using IP to stay ahead of the GLP-1 curve

The impact of GLP-1 on the food and beverage sector GLP-1 agonists, best-known under the brand names Ozempic® and Wegovy®, are medicines used to treat type 2 diabetes and obesity. …

Read article