Legal Frameworks
How to instruct us
Working at Bevan Brittan
Starting your career in law
Contact 0370 194 1000
ICO announces intention to fine British Airways £183.39m
share Twitter LinkedIn Email
The ICO has today announced its intention to fine British Airways £183.39 million in the first flexing of its new penalty powers under the GDPR.
This is the first fine the ICO has announced under the GDPR and significantly bigger than its previous largest penalty under the UK data protection regime. Under the Data Protection Act 1998, the ICO could only impose a maximum fine of £500,000, which it levied against Facebook following the Cambridge Analytica data scandal. The ICO acknowledged at the time that "the fine would inevitably have been significantly higher under the GDPR". The new legislation allows the ICO to impose much larger fines, up to a maximum of £17 million or 4% of global turnover. The fine it's intending to impose on BA amounts to 1.5% of its worldwide turnover in 2017.
The ICO's notice of intention to fine BA follows an extensive investigation carried out relating to a cyber-incident which began in June 2018, whereby user traffic to the BA website was diverted to a fraudulent site, where fraudsters harvested details of approximately 500,000 customers. The ICO's investigation found that a variety of information was compromised by poor security arrangements, including names, email addresses and payment card details.
BA now has an opportunity to make representations to the ICO before the ICO makes a final decision in relation to the fine. Whatever the final outcome, the message is clear - the ICO will not be shying away from imposing significant fines on data controllers that fail to safeguard people's personal data. Once the final decision has been handed down, understanding how the ICO has arrived at this level of fine will hopefully provide guidance to all data controllers as to how a breach can be quantified.
Lauren Danks
I am a solicitor in the Litigation, Advisory and Regulatory ...
James Cassidy
I am a Partner in the Litigation, Advisory and Regulatory ...
Have you checked your data retention policies?
Bevan Brittan and One HealthTech Bristol form strategic partnership
GDPR: One Year On
Independent Health
Central Government & Agencies
Housing & Regeneration
Keep up to date with Bevan Brittan
Local government legal developments (Local Authority View) Employment law hot topics (Employment Eye) Health and social care legal updates (H&SC Updates) Quarterly review and comments on trending legal topics for the healthcare industry (Healthline) Procurement regulations and good practices (Procurement Update) Municipal waste management (Waste Watch) Mental Capacity, Mental Health and Court of Protection Essentials
You can view our privacy policy here
Twitter @BevanBrittanLLP
The information on this website is of general interest about current legal issues and is not intended to apply to specific circumstances. It should not, therefore, be regarded as constituting legal advice.
Terms & Conditions Key Information Modern Slavery Dataroom login Contact Us
Our website uses cookies to improve your user experience, and help us to understand how our website is used. By using this website, you consent to this. More information about the cookies we use, and how you can block them is available in our Cookie Policy