British Airways faces record £183m GDPR fine

British Airways (BA) is facing a record £183.4m (€204.8m) fine under the General Data Protection Regulation (GDPR), for “poor security arrangements” that allowed customer data to be harvested by cyberattackers. The fine is set to be imposed by UK regulator the Information Commissioner’s Office (ICO), which has been investigating the case as lead supervisory authority on behalf of other EU member state data protection authorities. It follows a cyberattack that was reported by BA in September 2018. But the ICO said the attack is thought to have begun in June of that year. This was just one month after tougher data protection rules came into force across Europe through the GDPR. Users of BA’s website were diverted to a fraudulent website, where about 500,000 customer details were collected by attackers. The ICO said compromised information included login data, payment card details and travel booking details, alongside names and postal addresses. BA is thought to have reported the discovery of the cyberattack in the first 24 hours, well within the 72-hour requirement under the GDPR. The company said it is “surprised and disappointed” by the fine, which under the GDPR process has been issued as an intention. BA is now invited to make representations before a final decision is made. Other concerned data protection authorities across Europe will also have the opportunity to comment on the punishment before it is handed out. BA chairman and chief executive Alex Cruz said: “British Airways responded quickly to a criminal act to steal customers' data. We have found no evidence of fraud/fraudulent activity on accounts linked to the theft.” Willie Walsh, chief executive of BA’s owner International Airlines Group, said the company would “defend the airline’s position vigorously” and make necessary appeals. The ICO said BA has since strengthened cybersecurity and cooperated with the investigation. The fine would be the highest across Europe since the GDPR took effect in May last year. It is the first time a substantial fine has been levied for data theft. At £183.4m, it accounts for 1.5% of BA’s worldwide turnover. French regulator CNIL previously topped the fines with a €50m levy against Google for processing data to personalise advertising without consent, although Google has appealed. UK information commissioner Elizabeth Denham said: “The law is clear – when you are entrusted with personal data you must look after it. Those that don’t will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights.” CRE reported in October that BA’s losses from the cyber breach – excluding regulatory fines but covering customer compensation claims – were expected to exceed £100m, with the company largely protected by cyber insurance. Experts have warned that GDPR fines are expected to be more prolific and larger in 2019, as regulators catch up with a backlog of reported breaches. Market watchers have been waiting for a fine of this magnitude to test the GDPR’s full force. In February 2019, CRE reported analysis from DLA Piper that showed 91 GDPR fines had been levied.

British Airways faces record £183m GDPR fine

Want to read this article?

Read Next

Australian and New Zealand insurers team up to build resilience

Asia Pacific Captive Forum 2026 launches in Singapore

Transactional claims on the rise, finds Aon study

Consilium launches complex commercial binding facility for UK brokers

Brokerslink adds Brazilian broker to international network

Australian and New Zealand insurers team up to build resilience

Asia Pacific Captive Forum 2026 launches in Singapore

Transactional claims on the rise, finds Aon study

Consilium launches complex commercial binding facility for UK brokers

Brokerslink adds Brazilian broker to international network

Want to read this article?

Read Next

Australian and New Zealand insurers team up to build resilience

Asia Pacific Captive Forum 2026 launches in Singapore

Transactional claims on the rise, finds Aon study

Consilium launches complex commercial binding facility for UK brokers

Brokerslink adds Brazilian broker to international network

Related Articles