British Airways has been fined £20-million (R426-million) by the UK data protection watchdog over a breach that compromised the personal and financial details of more than 400 000 customers, a cut to a much heftier fine initially planed by the regulator.
The UK Information Commissioners’ Office on Friday said its investigation into a 2018 cyberattack at the company found that “the airline was processing a significant amount of personal data without adequate security measures in place”, exposing people’s data unnecessarily. The fine is the ICO’s biggest so far.
“Their failure to act was unacceptable and affected hundreds of thousands of people, which may have caused some anxiety and distress,” UK data protection chief Elizabeth Denham said in the statement. “When organisations take poor decisions around people’s personal data, that can have a real impact on people’s lives.”
The final penalty is a fraction of the £183.4-million the ICO had initially announced it planned to levy last year. BA said its systems were compromised from 21 August to 5 September 2018 and that about 380 000 transactions had been affected, advising people to contact credit card providers. It said the stolen data didn’t include travel or passport details.
In July, BA set aside €22-million as a provision for the incident.
‘Fully co-operated’
“The ICO recognises that we have made considerable improvements to the security of our systems since the attack and that we fully co-operated with its investigation,” a BA spokeswoman said Friday in an e-mail.
The ICO probe was done under European Union data protection rules that took effect in May 2018 and gave regulators for the first time the powers to slap companies with fines of as high as 4% of their global annual sales. The biggest fine levied under the rules so far remains a €50-million penalty by France’s privacy regulator against Google. — Reported by Stephanie Bodoni, (c) 2020 Bloomberg LP