ICO issues record breaking fine

British Airways data breach

Cyber security may be about to become more than AOB for organisational boards across the country. British Airways has been struck with a record-breaking £183-million fine as a result of its data breach last year in which around 500,000 customers had their data stolen, including credit card and CVV numbers. This is perhaps the first example of the ICO really flexing their fining muscles post-GDPR, which allows for a maximum fine of up to €20-million or 4% of annual turnover (whichever is greater) for non-compliance.

We spoke briefly about BA’s data breach when it happened. The crux of our article was that compliance does not equate to security and our stance has not changed. Whether it’s PCI DSS, ISO 27001 or Cyber Essentials, compliance isn’t a magic shield that wards off hackers. Of course, they help, but businesses need to be continually reviewing and testing their security strategy throughout the year regardless. If they don’t, they’ll get breached no matter how many signed certificates they have.

ICO bares its teeth

Contrary to what you might think, regulatory bodies don’t tend to go for the scarily large numbers just because they can. BA’s £183 million might seem a touch steep if you compare it to Facebook’s relatively paltry fine of £500,000 for its role in the Cambridge Analytica scandal. Considering the social media giant racked up $40 billion in revenue in 2017, they probably didn’t notice a casual half a million slip away to the ICO. However, it’s worth noting that this case had to be reviewed under the Data Protection Act, not GDPR. £500,000 was the maximum fine back then in the careless heyday of a pre-GDPR world. Had the whole thing occurred just a short while later, things could have been a lot worse for Zuckerberg and crew.

The BA data breach occurred after that fateful day of May 25th 2018 and, therefore, was subject to the full wrath the legislation allowed. It should be noted that the airline plans to dispute the decision, which is legal speak for spluttering “how much?” However, the ICO have been quoted as saying British Airways had “poor security arrangements” where customer information was concerned. Seeing as customers were unwittingly being diverted to a fraudulent website, it seems hard to argue with this statement. Best practices were probably not being followed.

Whilst BA has cooperated fully with the ICO, they were still responsible for the protection of their customers’ personal data. If there were indeed “poor security arrangements” in place, then they did not take this responsibility seriously enough. Article 32 of GDPR stipulates that the “appropriate technical and organisational measures” should be in place to ensure the security of personal data. At this point in time, it doesn’t seem like this was the case for BA. That is one possible reason for the large fine.