British Airways plc

ICO (United Kingdom) case ba-2020-10, decided 2020-10-16. EUR 23,000,000.

What the regulator decided

Between 22 June and 5 September 2018 a Magecart-style skimming attacker injected code into the BA website and mobile app payment pages and exfiltrated names, addresses, payment-card data and BA log- in credentials of approximately 429,612 customers and staff; British Airways failed to implement appropriate technical and organisational measures to secure the processing, breaching Article 5(1)(f) and Article 32 GDPR.

Primary source

Regulator-owned URL. Quote this in legal briefs and academic citations.

https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

EUR amount approximate (round-trip from GBP 20M at the enforcement- date FX rate). The original notice of intent was GBP 183.39M; the pandemic-period discount and other mitigating factors reduced the final to GBP 20M. The skimming-via-third-party-script pattern is directly relevant to scanner findings about supply-chain scripts on the payment page.

Verification trail

Verified by: donal
Verified at: 2026-05-27
Review due: 2026-11-27

Cite this case

Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.

BibTeX

@misc{consentmark-precedent-ico-ba-2020-10,
  author       = {{ConsentMark}},
  year         = {2020},
  title        = {ICO (United Kingdom) ba-2020-10 - British Airways plc},
  howpublished = {\url{https://www.consentmark.com/precedent/ico-ba-2020-10}},
  note         = {ConsentMark methodology v1.3}
}

APA

ConsentMark. (2020, October 16). ICO (United Kingdom) ba-2020-10 - British Airways plc. Methodology v1.3. https://www.consentmark.com/precedent/ico-ba-2020-10

Markdown

[ICO (United Kingdom) ba-2020-10 - British Airways plc - ConsentMark](https://www.consentmark.com/precedent/ico-ba-2020-10)

Plain text

ICO (United Kingdom) ba-2020-10 - British Airways plc - ConsentMark, 2020-10-16, methodology v1.3, https://www.consentmark.com/precedent/ico-ba-2020-10