British Airways facing record GDPR fine

British Airways is today facing a record fine of £183m for a data breach in June 2018, one month after the GDPR came into force. 

The fine represents 1.5% of its 2017 worldwide turnover, and whilst below the maximin possible 4% fines represents the largest single fine handed down by the Information Commissioner’s Office (ICO). 

Patrick Wheeler, Partner and Head of Intellectual Property and Data Protection at the law firm Collyer Bristow said: “The first anniversary of the GDPR passed on 25 May and we are only now seeing the ICO beginning to issue fines on breaches they have been investigating for several months.  If businesses were feeling complacent about their GDPR obligations, thinking that nothing was going to happen, this record fine should serve as a wake-up call.

“We were expecting the ICO to hand down some pretty hefty fines to coincide with the first GDPR anniversary and it has now started to do so.  The ICO has shown that it takes its regulatory responsibilities protecting the interests of data subjects very seriously and also that it wants businesses to work hard to comply. 

“The fine imposed on British Airways may be the first, but it will not be the last: several large commercial and public sector entities will all be in the ICO’s spotlight.”

Collyer Bristow reminds businesses faced with a data breach of the steps they must now take:

• Investigate to establish whether a breach has occurred and its likely impact.

• Breaches affecting the rights and freedoms of individuals need to be addressed immediately.

• If such a breach is confirmed it must be reported to the ICO within 72 hours.

• Your data protection team must then take all necessary steps to stop it continuing and:

  • Establish how the breach occurred

  • Investigate the extent of the information breached

  • Determine the consequences of breach

  • Outline measures to prevent further breaches

• Determine then whether specialist legal and crisis management advice is needed.

• Review your current data and cyber security arrangements

• If appropriate, disclose the data breach to those affected and wider stakeholders. Full disclosure and reassurance about the corrective steps being taken is often the best policy.

• And do not forget to notify ICO within 72 hours.