Enforcement · Information Commissioner (ICO) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

British Airways: Insufficient technical and organisational measures to ensure information security

€22,046,000 Fine
British Airways
UNITED KINGDOM
Art. 5 GDPR Art. 32 GDPR
Security Human Resources Personal Data
Oct 16, 2020 Source

How it connects

Related across sources

Case Law NSS - 1 As 183/2023-62 Supreme Administrative Court Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review Case Law GC - T-318/24 Gereral Court Guidance Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria EDPB Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB News ICO: How can privacy-enhancing technologies contribute to compliance with data protection legislation? ICO

Full text

In July 2019, the ICO issued a notice of its intention to fine British Airways £183.39M for GDPR infringements which likely involve a breach of Art. 32 GDPR. The proposed fine relates to a cyber incident notified to the ICO by British Airways in September 2018. This incident in part involved user traffic to the British Airways website being diverted to a fraudulent site. Through this false site, customer details were harvested by the attackers. Personal data of approximately 500,000 customers were compromised in this incident, which is believed to have begun in June 2018. The ICO’s investigation has found that a variety of information was compromised by poor security arrangements at the company, including log in, payment card, and travel booking details as well name and address information. In the meantime, the final fine imposed on the airline has been set at £20 million (approximately EUR 22,046,000). The ICO emphasized that when setting the amount of the fine, it also took into account the economic impact of the COVID-19 ('Coronavirus') pandemic on the airline industry.

Industry: Transportation and Energy

Original document at the source ico.org.uk

Similar Content