ICO reduces BA fine amid COVID pandemic

To the surprise of many, the fine levied by the ICO on BA in 2019 for its breach of data protection laws has been reduced from £183m to £20m.

The fine related to the leak of 400,000 customer records that BA failed to detect for nearly two months. The ICO critiicsed the airline but the reduction in the fine appears to recognise not only the financial pressure that the virus has had on the industry but also the steps that BA took to address and deal with the breach once they became aware of it.

What can we learn?: whilst the initial fine levied by the ICO was "news" eye-watering, the reduction is still the largest fine the ICO has levied and reflects the current economic climate. The message from the ICO is clear but balanced - it now has the teeth to take appropriate action but it is prepared to work with and recognise efforts by businesses to address issues when they occur.

Businesses need to ensure that they have appropriate measures in place to detect, recognise and address data breaches at the earliest opportunity. Equally, it is as important to be able to demonstrate to the regulator that not only are you being proactive in dealing with a breach but that you are putting in place processes to reduce the chance of it happening again.