British Airways Faces Record £183m Fine

The airline British Airways is targeted by the UK’s data watchdog which plans to fine the company £183 million over last year’s data breach.

According to the Information Commissioner’s Office (ICO) “poor security arrangements” at the company lead to violation of credit card information, names, addresses, and logins of approximately 500,000 customers. This fine would be the largest ever issued by the ICO, according to BBC News reports. The company can appeal the ruling within 28 days before it is made final.

Elizabeth Denham, the Information Commissioner stated that the loss of personal data is “more than an inconvenience”, and believes that British Airways should take full responsibility “to protect fundamental privacy rights.”
“People’s personal data is just that – personal. When an organization fails to protect it from loss, damage or theft it is more than an inconvenience. That’s why the law is clear – when you are entrusted with personal data you must look after it. Those that don’t will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights.”

This case of private data violation comes within a year after the regulator fined Facebook just £500,000 for the Cambridge Analytica scandal in which 87 million users were involved. Keep in mind that Facebook’s fine was the maximum legal amount allowed under the UK’s previous data privacy regulation, the 1998 Data Protection Act. Under the new GDPR rules, the fine would have been significantly higher.
GDPR allows a company to be fined a maximum of 4% of its worldwide turnover and the airline’s fine consist of 1.5 percent of its 2017 revenue.

As a response, the British Airways’ chairman and chief executive Alex Cruz stated that the company was “surprised and disappointed” by the ICO’s decision, mentioning that British Airways has found no evidence of fraudulent activity on accounts linked to the breach.

The ICO said that the company cooperated with its investigation, and has adopted security improvements since the infringement.