Precedent corpus / ICO (United Kingdom)
British Airways plc
ICO (United Kingdom) case ba-2020-10, decided . GBP 20M.
We have not checked whether this decision was appealed. This is not a statement that no appeal exists.
No ConsentMark grade rests on this decision. It is published here because it is relevant enforcement, not because it bears on what a browser does before consent.
What the regulator decided
Between 22 June and 5 September 2018 a Magecart-style skimming attacker injected code into the BA website and mobile app payment pages and exfiltrated names, addresses, payment-card data and BA log- in credentials of approximately 429,612 customers and staff; British Airways failed to implement appropriate technical and organisational measures to secure the processing, breaching Article 5(1)(f) and Article 32 GDPR.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdfConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
The original notice of intent was GBP 183.39M; the pandemic-period discount and other mitigating factors reduced the final to GBP 20M. The skimming-via-third-party-script pattern is directly relevant to scanner findings about supply-chain scripts on the payment page.
Verification trail
Checked against the primary source on 27th May 2026. Next review 27th November 2026.
Cite this case
@misc{consentmark-precedent-ico-ba-2020-10,
author = {{ConsentMark}},
year = {2020},
title = {ICO (United Kingdom) ba-2020-10 - British Airways plc},
howpublished = {\url{https://www.consentmark.com/precedent/ico-ba-2020-10}},
note = {ConsentMark methodology v7.8.1}
}ConsentMark. (2020, October 16). ICO (United Kingdom) ba-2020-10 - British Airways plc. Methodology v7.8.1. https://www.consentmark.com/precedent/ico-ba-2020-10[ICO (United Kingdom) ba-2020-10 - British Airways plc - ConsentMark](https://www.consentmark.com/precedent/ico-ba-2020-10)ICO (United Kingdom) ba-2020-10 - British Airways plc - ConsentMark, 2020-10-16, methodology v7.8.1, https://www.consentmark.com/precedent/ico-ba-2020-10