British Airways facing a record fine of $230 million under EU's GDPR Regulations

Personal details of an estimated 500,000 customers were compromised after a website failure in British Airway, potentially leading to a $230 million fine which would be the largest penalty yet for a violation of the General Data Protection Regulation, a privacy rule which came into action in the European Union last year.

According to the UK Information Commissioner’s Office user traffic was being redirected from the British Airways site to a fraudulent page due to weak security since June 2018. Private customer details like payment cards, booking details and log ins were able to be acquired by attackers, however the regulator said there will be a chance for the company to challenge the fine. The incident was disclosed in September 2018 by British Airways.

Roughly 1.5% of British Airways’ annual revenue is what the $230 million fine represents – a penalty the carrier said will be fought.

“We are surprised and disappointed in this initial finding,” British Airways CEO Alex Cruz said, adding that “British Airways responded quickly to a criminal act to steal customers’ data. We have found no evidence of fraud [or] fraudulent activity on accounts linked to the theft.”

Every company in the European Union is subject to the GDPR – a law meant to make sure the collection, processing and storing of people’s data is safe. Fines for companies that fail to keep the privacy law can face fines up to 4% of their annual revenue.

“People’s personal data is just that – personal. When an organization fails to protect it from loss, damage or theft it is more than an inconvenience. That’s why the law is clear – when you are entrusted with personal data you must look after it,” taken from a statement made by Information Commissioner Elizabeth Denham.