UK slaps $25 million fine on British Airways for 2018 data security failure

The Information Commissioner’s Office on Friday said that the airline was processing personal data without adequate security measures and failed to detect a 2018 cyber attack for two months.

Britain’s information commissioner has fined British Airways 20 million pounds ($25 million) for failing to protect personal data for some 400,000 customers, the largest fine the agency has ever issued.

A cyclist passes a passenger aircraft, operated by British Airways, a unit of International Consolidated Airlines Group SA (IAG) grounded at London Heathrow Airport in London, U.K., on Monday, June 8, 2020. (Photo: Bloomberg)

The ICO said in a statement on Friday that the airline was processing personal data without adequate security measures. It also noted that it did not detect a 2018 cyber attack for two months.

Information Commissioner Elizabeth Denham said, “BA’s failure to act was unacceptable and affected hundreds of thousands of people, which may have caused some anxiety and distress as a result.’’

Under the European Union’s General Data Protection Rules imposed in 2018, organizations face fines of up to 20 million euros ($23 million) or 4% of annual global turnover — whichever is greater — for the most serious violations.