Blog » HOW TO HANDLE A DATA THEFT? SOME THOUGHTS ABOUT THE BRITISH AIRWAYS’ DATA BREACH
HOW TO HANDLE A DATA THEFT? SOME THOUGHTS ABOUT THE BRITISH AIRWAYS’ DATA BREACH
24 September 2018
You may have heard that British Airways suffered a serious data breach some weeks ago. As they reported the data of 380.000 passengers have been compromised during a 16 days period. The case was widely reflected in media and some press-organs talked about the possibility of a record GDPR fine and class-action against BA. Given that the breach is still under investigation, I do not wish to speculate on the fines but rather summarize how I see British Airways (BA) handled the data breach and what you can learn from it.
As it appears from the dates of the events the data breach affected the period from 21th August until 5th September.
On 6th September BA has already announced the data theft on press and according to the British Data Protection Authority they already received the notification about the data breach incident on 7th September.
The above timeline of the events shows that BA acted very quickly which is crucial when handling a data breach. An immediate action can prevent further harm and mitigate the risks of the data breach.
Obviously, BA thoroughly investigated the breach and identified what was the affected period, what data and which customers could be compromised and how the breach could happen.
At the early stage of the inspection BA discovered that the payments made on BA’s website and mobile app in the 16-days-perdiod were affected and basically financial details (bank card and credit card data) were stolen but not travel or passport details.
After BA reported the data breach, they continued the examination and found out that the data was taken via a script designed to steal financial information by 'skimming' the payment page before it was submitted.
Reporting to the authority
It is out of question that a data breach which could affect 380.000 customers and their bank card details is a major breach which shall be reported to competent supervisory authority.
As you know, the deadline of the notification is 72 hours after the controller has become aware of the data breach.
It took BA just one day to report the data breach to the Information Commissioner’s Office, the supervisory authority in the UK.
I do not think it needs further explanation that a data breach affecting bank card and credit card details can cause serious harm to the customers, thus they shall be informed about it.
BA, of course, recognized it and took immediate actions to provide information to its customers starting with their press release and publishing a detailed information package on BA’s website. Further, BA promised to contact all affected customers directly which is in line with the recommendations of the European Data Protection Board who interprets the GDPR.
What I really liked about BA’s notification on their webpage is that it was structured in a Q&A format, provided clear information and advised the customers what they should do, eg. contacting their bank or credit card providers.
In my opinion, BA handled the data breach in exemplary fashion, to put it simply, they have made all actions that the GDPR provides in due time.
It is another question if their security measures were sufficient, and whether the data breach could have been prevented or not.
Hopefully you will never experience such a harmful data breach but if you would, I recommend you to remember to the BA’s action plan as a good practice.
CAN YOUR DEBTOR ESCAPE LIQUIDATION BY SETTING OFF CLAIMS IN HUNGARY?
The initiation of a liquidation procedure is an effective debt collection method, since the debtor may only avoid being liquidated by paying the claim if the conditions specified in the Act on Bankruptcy Proceedings and Liquidation (Bankruptcy Act) are met. For this reason, in the case of liquidation, one of the most common defences of the debtor is the reference to offsetting. But can the debtor refer to offsetting without limitation during liquidation? In our short article we answer this question.Read more »
SZIGET FESTIVAL FINED RECORD HUF 30 MILLION FOR GDPR BREACHES – WHAT WENT WRONG?
A few days prior to the first anniversary of the entry into force of the GDPR the Hungarian Data Protection Authority imposed the biggest data protection fine in Hungary so far. The target was the biggest Hungarian festival organizer company thanks to whom the public may enjoy the SZIGET, the VOLT or the Balaton Sound Festival. The Data Protection Authority reviewed the check-in system of the festival and the data processing in relation with the check-in. In our short article we summarize the mistakes the Authority identified.Read more »
CONSTRUCTION TRUSTEESHIP IN HUNGARY - GETTING PAID IN CONSTRUCTION PROJECTS AS SUBCONTRACTOR
Construction trusteeship, as mandatory collateral management of major private construction projects in Hungary, strives for protecting subcontractors against non-paying general contractor, by allowing direct payments from employer under certain conditions. How does it work in practice and what are the limits of subcontractor protection? We address these issues in this article.Read more »