Privacy & Information Security Law Blog

On July 6, 2021, it was reported that British Airways (“BA”), which is owned by International Consolidated Airlines Group, S.A, had settled a UK class action lawsuit relating to its 2018 data breach, in which approximately 430,000 data subjects were affected. The UK Information Commissioner’s Office (“ICO”) previously fined BA £20 million for the same breach, after finding that BA had failed to process the personal data of its customers in a manner that ensured appropriate security, as required under Article 5(1)(f) and Article 32 of the EU General Data Protection Regulation. This amount was significantly reduced from the ICO’s proposed fine of more than £183 million.

The settlement sum has not been disclosed and the settlement did not include any admission of liability by BA. The claim was the largest class action personal data claim so far in the UK, with more than 16,000 claimants.