Professor Suzanne Rab comments on how British Airways faces a record £183 million fine for last year's data breach of their security system. See below for Suzanne's comments. 

"The Information Commissioner’s Office (ICO) has announced plans to impose a record £183 million fine on British Airways (BA) after a data breach last year that affected around 500,000 customers. The ICO cited “poor security arrangements” that led to the breach of logins, credit card information and other personal data. The fine would mark the largest that the ICO has issued, eclipsing the £500,000 fine against Facebook for the Cambridge Analytica incident that affected 87 million users. The fine imposed on Facebook was the maximum permitted under the Data Protection 1998; the legislation in force at the time. The General Data Protection Regulation (GDPR) came into force on 25 May 2018 and allows the regulator to fine a company up to 4 per cent of its worldwide turnover. The fine in BA’s case represents close to 1.5 per cent of its 2017 revenues. BA now has 28 days to object to the ruling before it is final. The ICO lists the factors in Article 83 GDPR as the criteria she will consider when deciding whether and how to respond to breaches of information rights. The policy is at a relatively high level of generality. The huge rise in data breaches has led the ICO to focus attention on the most important and sensitive cases."

For more information on the case, please click here.