Blog » HOW TO HANDLE A DATA THEFT? SOME THOUGHTS ABOUT THE BRITISH AIRWAYS’ DATA BREACH
HOW TO HANDLE A DATA THEFT? SOME THOUGHTS ABOUT THE BRITISH AIRWAYS’ DATA BREACH
24 September 2018
You may have heard that British Airways suffered a serious data breach some weeks ago. As they reported the data of 380.000 passengers have been compromised during a 16 days period. The case was widely reflected in media and some press-organs talked about the possibility of a record GDPR fine and class-action against BA. Given that the breach is still under investigation, I do not wish to speculate on the fines but rather summarize how I see British Airways (BA) handled the data breach and what you can learn from it.
As it appears from the dates of the events the data breach affected the period from 21th August until 5th September.
On 6th September BA has already announced the data theft on press and according to the British Data Protection Authority they already received the notification about the data breach incident on 7th September.
The above timeline of the events shows that BA acted very quickly which is crucial when handling a data breach. An immediate action can prevent further harm and mitigate the risks of the data breach.
Obviously, BA thoroughly investigated the breach and identified what was the affected period, what data and which customers could be compromised and how the breach could happen.
At the early stage of the inspection BA discovered that the payments made on BA’s website and mobile app in the 16-days-perdiod were affected and basically financial details (bank card and credit card data) were stolen but not travel or passport details.
After BA reported the data breach, they continued the examination and found out that the data was taken via a script designed to steal financial information by 'skimming' the payment page before it was submitted.
Reporting to the authority
It is out of question that a data breach which could affect 380.000 customers and their bank card details is a major breach which shall be reported to competent supervisory authority.
As you know, the deadline of the notification is 72 hours after the controller has become aware of the data breach.
It took BA just one day to report the data breach to the Information Commissioner’s Office, the supervisory authority in the UK.
I do not think it needs further explanation that a data breach affecting bank card and credit card details can cause serious harm to the customers, thus they shall be informed about it.
BA, of course, recognized it and took immediate actions to provide information to its customers starting with their press release and publishing a detailed information package on BA’s website. Further, BA promised to contact all affected customers directly which is in line with the recommendations of the European Data Protection Board who interprets the GDPR.
What I really liked about BA’s notification on their webpage is that it was structured in a Q&A format, provided clear information and advised the customers what they should do, eg. contacting their bank or credit card providers.
In my opinion, BA handled the data breach in exemplary fashion, to put it simply, they have made all actions that the GDPR provides in due time.
It is another question if their security measures were sufficient, and whether the data breach could have been prevented or not.
Hopefully you will never experience such a harmful data breach but if you would, I recommend you to remember to the BA’s action plan as a good practice.
CAN YOUR DEBTOR BE PUT IN PRISON FOR HIS DEBT IN HUNGARY?
You can hear a lot of stories where the debtor “escaped with the money”, the construction contractor “disappeared” or the debtor company’s assets have been hidden. Essentially, failure to pay is a breach of contract, which is subject to civil action, eg. litigation. However, if a transaction is suspected to be a scam, criminal proceedings may be brought against the defaulting debtor, for example, for fraud, which we examine in this article.Read more »
EU COURT RULED - STRENGHTENED CONSUMER PROTECTION IN CROSS BORDER DEBT RECOVERY
Can the unfairness of cross-border claim be reviewed ex officio in case of consumer contracts in such a simplified procedure, like the European order for payment procedure? In our article, we analyse the recent judgement of the Court of Justice of the European Union in the Bondora case and its possible effects on cross-border debt recovery, covering also the Hungarian legal regulations.Read more »
LAWFUL DISMISSAL IN HUNGARY - PART IV: TERMIANTION BASED ON EMPLOYER’S OPERATIONS
In the previous articles on the lawful dismissal, we explained dismissal for employee-related reasons. However, that is only half of the whole picture, because in many cases the employer dismisses employees for reasons of reorganization or redundancy. Justification must meet strict rules to be lawful in this case as well, the details of which we explore in this article based on case law of Hungarian labour courts.Read more »