Court gives go-ahead to compensation claim by British Airways customers affected by data breach
On 4th October 2019, the High Court granted a Group Litigation Order paving the way for mass legal action by British Airways customers affected by the huge data breach suffered by the airline during 2018.
Posted on 07 October 2019
This follows British Airways‘ initial announcement in September 2018 that the personal and financial details of customers making bookings on its website and app between 21st August 2018 and 5th September 2018 had been hacked. The hacked information included customers’ names, email addresses and credit card details (including the credit card number, expiration date and the three digit [CVV] code on the back of the credit card). It reported that this included the details of approximately 380,000 payment cards. Following this announcement, British Airways confirmed that it was contacting affected customers directly.
Following its investigation, the Information Commissioner’s Office (ICO), the UK’s data protection watchdog responsible for upholding the public’s information rights, announced in July 2019 that the customer information had been compromised by British Airways’ poor security arrangements and that the hack included diverting user traffic from the British Airways website to a fraudulent site, where customer details were harvested by hackers.
The ICO also found that that the data breach was more extensive than previously reported, affecting approximately 500,000 customers and had begun in June 2018. The ICO announced its intention to fine British Airways £183.39 million for a breach of the General Data Protection Regulation (GDPR) in relation to the serious data hack. British Airways are appealing against the level of this fine.
Sean Humber, a leading data protection lawyer at Leigh Day who acts for victims of cybercrime said:
"Completely separate from any fine levied by the ICO, British Airways customers affected by the data breach are likely to be entitled to compensation for the loss of control of their personal information, the distress and inconvenience caused as well as any financial losses suffered. The issue of a Group Litigation Order by the Court is an important first step in recovering compensation.”