The UK Information Commissioner’s Office (ICO) have announced a £20 million fine for British Airways (BA) in relation to a data breach. This is the first fine issued by the Information Commissioner’s Office (ICO) under the EU General Data Protection Regulation (GDPR). It’s a hefty sum, but significantly lower than the £183.39m fine that the ICO declared an intention to impose on BA back 4 July 2019 (which we wrote about here).
So, what is the fine for, how was it calculated and how come the ICO appears to have softened its approach so significantly?
Waterfront Associate, Jessica Vautier, and Partner, Alison Beryman, have carefully pored over the ICO’s announcement of the fine and all 114 pages of the penalty notice to see whether there are any lessons that the rest of us can take away from this unfortunate set of circumstances…
What personal data was disclosed?
Between 22 June and 5 September 2018, a cyber attacker (or attackers) gained access to details of approximately 108,000 payment cards on the BA internal system, then editing a file on the BA website, enabling cardholder data input into the BA website to be accessed by a website controller by the attacker. As a result, the attacker is believed to have potentially accessed approximately 429,612 individuals’ personal data, including: • Name, address, card number and CVV number of BA customers – 244,000 data subjects • Card number and CVV only – 77,000 data subjects • Card number only – 108,000 data subjects • Usernames and passwords of BA employee and administrator accounts • Usernames and pin numbers of up to 612 BA Executive Club accounts
How did this happen?
The attacker(s) gained access to an internal British Airways application using compromised login credentials for a Citrix remote access gateway. The compromised login credentials belonged to an employee of Swissport, a third party cargo services provider used by BA.
How the attacker was able to “break out” of the Citrix environment, thus gaining access to parts of BA’s network usually unavailable to Swissport employees, is not clear – this information has been redacted from the penalty notice (presumably so as not to provide details to other on how to compromise similar systems). However, we know that the attacker obtained access to a file in which the username and password of a privileged domain administrator account were saved in plain text. This gave them almost unlimited access to BA’s systems.
On 26 July 2018, the attacker accessed files in plaintext containing payment card details for BA redemption transactions. Due to human error, these details were stored unencrypted, and had been logged in this way since December 2015. There was a 95-day retention period, so the only logs available were for the preceding 95 days. However, this still included the details of approximately 108,000 payment cards.
Between 14 August and 25 August 2018, the attacker inserted malicious code on BA’s website meaning that when customers entered their payment card information on www.britishairways.com, a copy of this was sent to the attacker’s website (a process known as “skimming”).
BA became aware of the breach on 5 September 2018, when a third party informed them that data was being sent from their website to a third party site. Within 90 minutes, BA had changed the malicious code, and 20 minutes later had blocked the URL paths to the attacker’s site. They notified the ICO the following day (6 September), as well as 496,636 affected customers, plus an additional 39,480 affected customers the day after (7 September).
What legal obligations were breached?
The ICO assessed that BA had failed to comply with its obligations under Article 5(1)(f) and Article 32 of the GDPR.
Article 5(1)(f) sets out the principle that personal data shall be processed in a manner which ensures appropriate security of the personal data.
Article 32 concerns the security of processing personal data and requires data controllers to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
Could BA have done anything to prevent the attack?
The ICO has identified numerous measures which BA could have used to mitigate or prevent the risk of an attacker accessing their network.
These include: • Limiting users’ access to applications, data and tools to only those required for their role • Undertaking rigorous testing on the business’ systems, by simulating a cyber attack • Protecting employee and third party accounts with multi-factor authentication • Not “hardcoding”, i.e. recording passwords in unencrypted plain text files • Manual code reviews • Using file integrity monitoring software
The ICO believes that these security measures would not have been significantly costly for BA to implement, but has confirmed that considerable improvements have been made to BA’s IT security since the attack.
How did the ICO decide on the level of the penalty?
The penalty notice sets out the ICO’s considerations in relation to the penalty figure in extensive detail. I have set out a very brief summary of some of the major points below, which include the nature, gravity and duration of the failure in determining the appropriate penalty (Article 83(2)(a) GDPR).
Based on the above, it was determined by the ICO that in principle a penalty of £30m would be appropriate.
This was adjusted to £24m on the basis that:
• BA had taken immediate measures to mitigate and minimise damage suffered by data subjects • BA promptly informed data subjects, law enforcement and regulatory agencies, and cooperated with the ICO’s enquiries • Widespread media reporting of the attack is likely to have increased awareness of the risks • The attack and subsequent regulatory action had adversely affected BA’s brand and reputation
This amount was further reduced to £20m having regard to the impact of the Covid-19 pandemic (on BA and more generally), in line with the ICO’s published regulatory approach in response to the coronavirus pandemic.
Why was the fine £20m rather than the previously announced £183.39m?
A clear explanation of how the final calculation could be so different from the earlier proposed calculation has not been provided, but the factors below seem likely to have had a bearing on the decision.
The ICO came to the £183.39m figure, published in July 2019, in reliance upon the Draft Internal Procedure for Setting and Issuing Monetary Penalties – this had been developed by the ICO to assist in making penalty figure decisions, using the controller’s turnover as the starting point. However, having considered BA’s representations, the ICO was persuaded that this procedure was not, in fact, an appropriate mechanism to calculate the level of monetary penalty.
Following the ICO’s notice of intention to issue the £183.39 million fine, BA also provided significant additional information to the ICO. These appear to have clarified some points of fact, as well as points of law, which affected the ICO’s decision as to the level of the penalty – although it is not entirely clear from the penalty notice what these clarifications were (partly, perhaps, because some facts have necessarily been redacted).
The ICO was required to discuss the level of the fine with the supervisory authorities in other jurisdictions in which impacted data subjects are resident. The ICO does not disclose to what extent the level of the penalty was adjusted as a result of these discussions (if at all), but given the significance of the reduction, and the fact that no other country’s supervisory authority has so far been reported to have awarded a penalty in excess of £50 million, it seems likely that these discussions had at least some impact.
What should organisations learn from the ICO’s approach in this case?
The list above of the various measures that the ICO expected BA to have taken, and which would likely have prevented or limited the attack, should serve as a helpful reminder to businesses. So very frequently attacks originate with the compromise of one or more individuals’ login credentials and it is of vital importance that businesses put in place appropriate technical and organisational measures to restrict any further breach using this stolen information.
It is also useful to consider the mitigating factors listed above, which contributed to a 20% reduction in BA’s fine – in particular the swift action taken to protect data subjects, which all organisations should be ready to take if such a breach ever occurs.
Above all, however, this decision should serve as a warning to all organisations. Although much less than the sum originally proposed, £20 million is not inconsiderable and fines could be larger still if/when:
• the ICO reverts to the mechanisms of calculation under the Draft Internal Procedure (particularly for organisations with high turnovers); • Brexit means that the ICO is no longer required to consult with overseas supervisory authorities; and • the considerations of the effect of Covid are no longer deemed applicable.
Although most users of your website will not read your terms, this is an important part of your business. Having to argue in court is expensive, so a little investment to avert the risk is a pragmatic approach. This article highlights some of the most common points which your terms should cover so that the risks explained below do not crystallise.
If your business involves sending personal data outside the UK and EEA, you may be aware of the need for a transfer risk assessment (TRA) to demonstrate that you have properly considered and mitigated any associated risks.
When it comes to commercial negotiations, they often don’t turn out the way you had hoped and then there is no going back. Instead of struggling on your own, losing a lot of management time and still not being sure you have got the best deal, let us negotiate for you.
Get it in writing – Commercial Contracts