SHORTER READ

Data Protection

British Airways facing record GDPR fine

SHORTER READ

British Airways is today facing a record fine of £183m for a data breach in June 2018, one month after the GDPR came into force.

1 minute read

8 July 2019

SHARE

Authors

Patrick Wheeler

Partner - Head of IP & Data Protection

Talk to Patrick about Intellectual property disputes & Data protection & Intellectual property

The fine represents 1.5% of its 2017 worldwide turnover, and whilst below the maximin possible 4% fines represents the largest single fine handed down by the Information Commissioner’s Office (ICO).

Patrick Wheeler, Partner and Head of Intellectual Property and Data Protection at Collyer Bristow said: “The first anniversary of the GDPR passed on 25 May and we are only now seeing the ICO beginning to issue fines on breaches they have been investigating for several months.  If businesses were feeling complacent about their GDPR obligations, thinking that nothing was going to happen, this record fine should serve as a wake-up call.

“We were expecting the ICO to hand down some pretty hefty fines to coincide with the first GDPR anniversary and it has now started to do so.  The ICO has shown that it takes its regulatory responsibilities protecting the interests of data subjects very seriously and also that it wants businesses to work hard to comply.

“The fine imposed on British Airways may be the first, but it will not be the last: several large commercial and public sector entities will all be in the ICO’s spotlight.”

Businesses faced with a data breach are reminded that they must:

  • Investigate to establish whether a breach has occurred and its likely impact.
  • Breaches affecting the rights and freedoms of individuals need to be addressed immediately.
  • If such a breach is confirmed it must be reported to the ICO within 72 hours.
  • Your data protection team must then take all necessary steps to stop it continuing and:
    • Establish how the breach occurred
    • Investigate the extent of the information breached
    • Determine the consequences of breach
    • Outline measures to prevent further breaches
  • Determine then whether specialist legal and crisis management advice is needed
  • Review your current data and cyber security arrangements.
  • If appropriate, disclose the data breach to those affected and wider stakeholder. Full disclosure and reassurance about the corrective steps being taken is often the best policy.
  • Do not forget to notify ICO within 72 hours.

Patrick Wheeler is available for interview.  He can be reached by email: Patrick.wheeler@collyerbristow.com.

8 July 2019

Authors

Patrick Wheeler

Partner - Head of IP & Data Protection

View profile

SHARE

Related content

Latestfromtheteam

View all

MoreofPatrick'sInsights

View all

You are contacting

Patrick Wheeler

Partner - Head of IP & Data Protection

patrick.wheeler@collyerbristow.com



    Subscribe

    Please add your details and your areas of interest below

    Specialist sectors:

    Legal services:

    Other information:

    Jurisdictions of interest to you (other than UK):

    Article contributor

    FINDING OUR ARTICLES OF INTEREST? SUBSCRIBE TO RECEIVE THE LATEST CONTENT DIRECT TO YOUR INBOX

    Subscribe now
    Get In Touch Print this page
    Collyer Bristow
    < back to Updates
    < Back to What we do
    < Back to What we do
    < Back to What we do
    < Back to What we do
    ExpandNeed some help?Toggle

    < Back to menu

    I have an issue and need your help

    Scroll to see our A-Z list of expertise

    Get in touch

    Get in touch using our form below.