British Airways settles group action personal data claim

A group action claim brought against British Airways (BA), following a data breach in 2018, has now settled.

Group Action 

The claim followed a major data breach by BA in 2018, where hackers diverted user traffic from BA’s website and mobile app to a fraudulent site. The breach affected over 429,000 customers. 

In 2020, the ICO fined BA £20million for failing to adopt appropriate security measures to safeguard its data, resulting in the data breach. The original notice of intent had been for £183.39 million. 

Following the fine, around 16,000 claimants brought a group claim. 

The Settlement 

The claim has now been settled, according to the lead firm in the action. The terms of settlement, including the number of claimants who will receive compensation and the levels of compensation, are confidential. It is understood the settlement was reached through mediation. The overall value of the deal remains confidential but is reported to include an apology from the airline. With the significant number of claimants, the overall compensation could be substantial.

Comment

This settlement, while confidential, emphasises the potential cost of poor security practices. A fine by the ICO under the UK GDPR may only be the start of the matter. We are seeing more group actions against data controllers for data breaches. 

One of the lead UK cases in this area, Lloyd v Google was appealed to the Supreme Court, with the hearing held on 28 and 29 April 2021. Judgment is awaited. The Supreme Court is considering the Court of Appeal’s ruling that a court can award individuals damages for loss of control of their personal data even if they suffer no financial loss or distress as a result. We await with interest the Supreme Court’s findings.