You are contacting
Patrick Wheeler
Partner - Head of IP & Data Protection
- Home
- About us
- People
- What we do
- Business
- Dispute resolution
- Individuals & families
- Real estate
- Business
- Updates
- Insights
- News
- Events
- Videos and Podcasts
- Publications
- Insights
Hybrid working
Show moreFamily & Divorce
Show more
Business Life cycle
Show moreArt Work: CB support for the arts
Show more
Videos
Show more
Financial Services Winter update 2021
Podcasts
Show more
Data Subject Access Requests (DSARs) and how employers should respond
Shorter Reads
Show more
AI regulation in financial services and how the UK diverges from EU rules
Longer Reads
Show more
Domestic CCTV: are you compliant?
British Airways is today facing a record fine of £183m for a data breach in June 2018, one month after the GDPR came into force.
The fine represents 1.5% of its 2017 worldwide turnover, and whilst below the maximin possible 4% fines represents the largest single fine handed down by the Information Commissioner’s Office (ICO).
Patrick Wheeler, Partner and Head of Intellectual Property and Data Protection at Collyer Bristow said: “The first anniversary of the GDPR passed on 25 May and we are only now seeing the ICO beginning to issue fines on breaches they have been investigating for several months. If businesses were feeling complacent about their GDPR obligations, thinking that nothing was going to happen, this record fine should serve as a wake-up call.
“We were expecting the ICO to hand down some pretty hefty fines to coincide with the first GDPR anniversary and it has now started to do so. The ICO has shown that it takes its regulatory responsibilities protecting the interests of data subjects very seriously and also that it wants businesses to work hard to comply.
“The fine imposed on British Airways may be the first, but it will not be the last: several large commercial and public sector entities will all be in the ICO’s spotlight.”
Businesses faced with a data breach are reminded that they must:
- Investigate to establish whether a breach has occurred and its likely impact.
- Breaches affecting the rights and freedoms of individuals need to be addressed immediately.
- If such a breach is confirmed it must be reported to the ICO within 72 hours.
- Your data protection team must then take all necessary steps to stop it continuing and:
- Establish how the breach occurred
- Investigate the extent of the information breached
- Determine the consequences of breach
- Outline measures to prevent further breaches
- Determine then whether specialist legal and crisis management advice is needed
- Review your current data and cyber security arrangements.
- If appropriate, disclose the data breach to those affected and wider stakeholder. Full disclosure and reassurance about the corrective steps being taken is often the best policy.
- Do not forget to notify ICO within 72 hours.
Patrick Wheeler is available for interview. He can be reached by email: Patrick.wheeler@collyerbristow.com.
8 July 2019
Related content
Subscribe
Please add your details and your areas of interest below
Article contributor
Patrick
WheelerPartner - Head of IP & Data Protection
Specialising in Data protection, Intellectual property and Intellectual property disputes
FINDING OUR ARTICLES OF INTEREST? SUBSCRIBE TO RECEIVE THE LATEST CONTENT DIRECT TO YOUR INBOX
Subscribe now