British Airways hit with sky-high fines after GDPR breach

The ICO has revealed that it intends to fine British Airways a hefty £138 million pounds in relation to severe breaches of data protection that has resulted in customers’ personal information falling into the wrong hands! The day after the ICO announced its intentions to fine BA, Marriott International have been informed they too will be fined £99 million pounds for similar breaches.

Understanding when, and if, you are processing an individual’s personal data is crucial to understanding whether the General Data Protection Regulations apply. Not only must individuals have the right to access their personal data, as and when requested, they must be provided with the reasons behind why you are processing their data, your retention periods for holding their personal data and who it will be shared with. If not adequately managed, you may find yourself subject to the wrath of the ICO resulting in irreparable consequences!

The recent fines issued to both British Airways and Marriott demonstrate that a year on from the implementation of the new GDPR regulations, individuals and business alike are still struggling to get to grips with the regulations and how these are monitored in practice.

So what should you do to ensure you are complying with the regulations?

Firstly, and most importantly, you should ensure that you have adequate procedures in place, including a suitable data protection policy, which is essential to evidencing your commitment to GDPR compliance. You should also ensure that any policies and terms and conditions that you currently have in place are up to date and compliant with the GDPR.

If you require legal advice on the GDPR and what this means for your business, or if you require a legal health check and review of any of your current policies or terms and conditions of business that you may have in place, then please do not hesitate to contact Christopher Buck, Associate Partner in the Commercial Services Department here at Franklins.