Blog
Blog » HOW TO HANDLE A DATA THEFT? SOME THOUGHTS ABOUT THE BRITISH AIRWAYS’ DATA BREACH
HOW TO HANDLE A DATA THEFT? SOME THOUGHTS ABOUT THE BRITISH AIRWAYS’ DATA BREACH
24 September 2018
You may have heard that British Airways suffered a serious data breach some weeks ago. As they reported the data of 380.000 passengers have been compromised during a 16 days period. The case was widely reflected in media and some press-organs talked about the possibility of a record GDPR fine and class-action against BA. Given that the breach is still under investigation, I do not wish to speculate on the fines but rather summarize how I see British Airways (BA) handled the data breach and what you can learn from it.
Fast action
As it appears from the dates of the events the data breach affected the period from 21th August until 5th September.
On 6th September BA has already announced the data theft on press and according to the British Data Protection Authority they already received the notification about the data breach incident on 7th September.
The above timeline of the events shows that BA acted very quickly which is crucial when handling a data breach. An immediate action can prevent further harm and mitigate the risks of the data breach.
Thorough investigation
Obviously, BA thoroughly investigated the breach and identified what was the affected period, what data and which customers could be compromised and how the breach could happen.
At the early stage of the inspection BA discovered that the payments made on BA’s website and mobile app in the 16-days-perdiod were affected and basically financial details (bank card and credit card data) were stolen but not travel or passport details.
After BA reported the data breach, they continued the examination and found out that the data was taken via a script designed to steal financial information by 'skimming' the payment page before it was submitted.
Reporting to the authority
It is out of question that a data breach which could affect 380.000 customers and their bank card details is a major breach which shall be reported to competent supervisory authority.
As you know, the deadline of the notification is 72 hours after the controller has become aware of the data breach.
It took BA just one day to report the data breach to the Information Commissioner’s Office, the supervisory authority in the UK.
Notifying customers
I do not think it needs further explanation that a data breach affecting bank card and credit card details can cause serious harm to the customers, thus they shall be informed about it.
BA, of course, recognized it and took immediate actions to provide information to its customers starting with their press release and publishing a detailed information package on BA’s website. Further, BA promised to contact all affected customers directly which is in line with the recommendations of the European Data Protection Board who interprets the GDPR.
What I really liked about BA’s notification on their webpage is that it was structured in a Q&A format, provided clear information and advised the customers what they should do, eg. contacting their bank or credit card providers.
Summary
In my opinion, BA handled the data breach in exemplary fashion, to put it simply, they have made all actions that the GDPR provides in due time.
It is another question if their security measures were sufficient, and whether the data breach could have been prevented or not.
Hopefully you will never experience such a harmful data breach but if you would, I recommend you to remember to the BA’s action plan as a good practice.
-
When should employers pay the consideration for non-compete obligation in Hungary?
The Hungarian Labour Code does not specify the due date of the consideration for non-compete obligation, which resulted in legal uncertainty. Based on the recent case law, the judiciary filled this gap with legal interpretation. In our article we summarize this recent development in Hungarian labour law practice.
Read more » -
ARBITRATION PROCEEDINGS IN HUNGARY
The Hungarian arbitration procedure, compared to the Hungarian state court procedure, is much simpler, less formal. However, it is still necessary to know these simpler procedural rules, to conclude the dispute successfully. Consequently, we summarize below the most important procedural principles and rules based on the Hungarian Arbitration Act and on the Rules of Procedure.
Read more » -
Can Parties Choose a Foreign Court in a Purely Domestic Transaction in the EU?
Can the parties domiciled in the same EU Member State conclude a choice-of-court agreement conferring jurisdiction on the court of another EU Member State in a purely domestic transaction? Should the choice of a foreign court be considered as a sufficient international element, in itself, to trigger the application of the Brussels Ibis Regulation? The CJEU decided this long-standing debate between subjectivist and objectivist approaches to “internationality” in a recent judgment.
Read more »