British Airways

The 2018 breach is the most-studied GDPR case in aviation because of what the regulator found: attackers reached BA's systems and harvested payment card details in real time as customers typed them, and the ICO concluded BA had processed a significant amount of personal data without adequate security. The penalty history is the part worth remembering - the ICO announced an intention to fine roughly £183 million and ultimately imposed £20 million, a reduction of about 89%, driven substantially by pandemic-era representations about the airline's financial position. For a consumer, the practical translation is that the size of a regulatory penalty tracks the company's ability to pay at the moment of assessment, not the scale of the harm done to you.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. iapp.org/news/a/ico-finalizes-20m-gbp-fine-against-british-airways — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected; as a UK/EU carrier, disputes are more likely litigated under GDPR/UK data protection law than a US-style arbitration clause.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.