British Airways was fined £20 million ($26m) by the UK data protection watchdog over a breach that compromised the personal and financial details of more than 400,000 customers, a cut to a much heftier fine initially planned by the regulator.
The UK Information Commissioners’ Office on Friday said its investigation into a 2018 cyber attack at the company found that “the airline was processing a significant amount of personal data without adequate security measures in place,” exposing people’s data unnecessarily. The fine is the ICO’s biggest so far.
“Their failure to act was unacceptable and affected hundreds of thousands of people, which may have caused some anxiety and distress,” UK data protection chief Elizabeth Denham said in the statement. “When organisations take poor decisions around people’s personal data, that can have a real impact on people’s lives.”
The final penalty is a fraction of the £183.4 million the ICO had initially announced it planned to levy last year. BA said its systems were compromised from August 21 through September 5, 2018 and that about 380,000 transactions had been affected, advising people to contact credit-card providers. It said the stolen data didn’t include travel or passport details.
In July, BA set aside €22 million ($26m) as a provision for the incident.
“The ICO recognises that we have made considerable improvements to the security of our systems since the attack and that we fully co-operated with its investigation,” a BA spokeswoman said Friday in an email.
The ICO probe was done under European Union data protection rules that took effect in May 2018 and gave regulators for the first time the powers to slap companies with fines of as high as 4 per cent of their global annual sales. The biggest fine levied under the rules so far remains a €50m penalty by France’s privacy regulator against Google, but that was a national probe.
The BA probe was different because it was an EU-wide effort led by the ICO. The Irish data protection watchdog is also investigating at least 20 cases with an EU scope, concerning companies such as Apple and Facebook. Its most advanced probe into Twitter has been delayed due to challenges from other national data regulators to its draft findings.
Regulators are obliged under the EU’s General Data Protection Regulation to seek feedback from all data protection watchdogs in probes with an EU-wide reach. The ICO said it also sought the green light from other data authorities before adopting a final decision.
