British Airways reports theft of payment data in 380,000 transactions

British Airways said on 6 September 2018 that it was investigating, as a matter of urgency, the theft of customer data from its website and mobile app. The airline, which is part of the IAG group together with Iberia, Vueling and Aer Lingus, said the theft took place between 22:58 (British time) on 21 August and 21:45 on 5 September, and that it affected about 380,000 transactions.

What is known

According to the company, the data compromised are the names, email addresses, billing addresses and payment card details of customers who made bookings or changes in that period. British Airways stated that travel and passport details were not affected. It also said the problem had been resolved, that it had contacted those affected and that it advised them to get in touch with their bank or card provider.

Chief executive Alex Cruz apologised and said the company will compensate customers for any financial hardship they have suffered. The UK’s National Cyber Security Centre, part of GCHQ, advised recent customers of the airline to consider changing the passwords on their bank accounts and to watch for suspicious transactions.

The airline reported the incident to the UK Information Commissioner’s Office (ICO), the British data protection authority. The office of the Commissioner, Elizabeth Denham, said British Airways had made them aware of the incident and that they were making enquiries. The theft took place when the General Data Protection Regulation (GDPR) was already applicable, from 25 May 2018.

What the GDPR requires after a breach

Article 33 requires the controller to notify a personal data breach to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to people’s rights and freedoms. If notification is made after 72 hours, the reasons for the delay must be given. The notice must describe the nature of the breach, the categories and approximate number of people and records affected, the likely consequences and the measures taken or proposed, and may be provided in phases if not all the information is available. Every breach must be documented.

Article 34 adds that, where the breach is likely to result in a high risk to people’s rights and freedoms, those affected must also be told, without undue delay and in clear and plain language. This is not necessary if the data were protected, for example encrypted, if measures have been taken that remove the high risk, or if it would involve disproportionate effort, in which case a public communication is used instead. If the breach is detected by a supplier that processes the data on the company’s behalf, it must tell the company without undue delay.

Infringements of these obligations can be penalised with fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher; those of the basic principles of processing, up to €20 million or 4%. To set the fine, the authority weighs, among other factors, the nature and gravity of the infringement, the measures taken to mitigate the damage and the manner in which it became aware of the infringement, in particular whether the controller notified it.

What to review

A company can check in advance whether it has an incident response plan that says who decides, who notifies and how it is documented, whether it knows from when the deadline runs and whether its contracts with suppliers that process data on its behalf oblige them to tell it without delay. In Spain, the competent authority is the Spanish Data Protection Agency. If it affects you, ask your adviser how to apply it.

The 72-hour clock starts when the company becomes aware of the breach; that is why it is worth having the protocol ready before it happens.