<!-- wp:paragraph -->
<p><a href="https://www.thetimes.co.uk/edition/news/hundreds-of-thousands-lose-bank-details-as-ba-hacked-nzktw262k?CMP=Sprkr-_-Editorial-_-thetimes-_-Unspecified-_-TWITTER" target="_blank" rel="noreferrer noopener">Hundreds of thousands lose bank details as British Airways hacked</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="http://uk.businessinsider.com/british-airways-customer-data-stolen-2018-9?r=US&amp;IR=T" target="_blank" rel="noreferrer noopener">Data stolen from hundreds of thousands of British Airways customers in major breach</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>A data breach follows a data breach. It's not IF it's when. Is your organisation ready to react?</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The New European Data Protection Regulation that entered into force on May 25 after a grace period of two years of adaptation is in continuity of the previous data Protection Directive. One of the main change from the previous situation is a short period of required reactions after a data breach.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The GDPR introduced a 72-hour notification requirements. It is therefore critical for organisations to have a systematic GDPR incident response protocol in place to meet these requirements. Having a breach response plan in place is critical. Every organisation need to appoint one central post to receive all data breach in order to act promptly, to evaluate against notification requirements, and analyse overall risk against the underlying data inventory.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>According to the&nbsp;<a href="https://www.bbc.co.uk/news/uk-england-london-45440850" target="_blank" rel="noreferrer noopener">BBC</a>, BA was made aware of the breach by a partner on Wednesday evening.</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>"BA said the breach took place between 22:58 BST on 21 August and 21:45 BST on 5 September."</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>"We have notified the police and relevant authorities. We take the protection of our customers' data very seriously."</p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>The BBC reports "<em>BA said all customers affected by the breach had been contacted on Thursday night. The breach only affects those people who bought tickets during the timeframe provided by BA, and not on other occasions</em>."</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://www.bbc.co.uk/news/uk-england-london-45440850" target="_blank" rel="noreferrer noopener">British Airways breach: How did hackers get in?</a>&nbsp;They are assumption that despite the encryption of customers data, these were intercepted from the website.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="http://Security%20Experts%20Comments%20%E2%80%93%20British%20Airways%20Data%20Breach/" target="_blank" rel="noreferrer noopener">Security Experts Comments – British Airways Data Breach</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Not sure if every customer has been contacted as Mr Cruz added:</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>"<em>At the moment, our number one purpose is contacting those customers that made those transactions to make sure they contact their credit card bank providers so they can follow their instructions on how to manage that breach of data."</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Article 33 GDPR requirements in case of data breach are :</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>1 - In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with&nbsp;&nbsp;<a href="https://gdpr-info.eu/art-55-gdpr/" target="_blank" rel="noreferrer noopener">Article 55</a>, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.&nbsp;</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>2 - Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>The processor shall notify the controller without undue delay after becoming aware of a personal data breach.</p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>BA knows how important it is to react on time to notify the Data Protection Authority and each and every customers hurt by the breach. The GDPR fines of 4% of General turn over or 20 Million € are serious incentives. Fine or notBA fine, a breach of customers data cause serious harm to the business reputation.</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>"Already, we are told that Shares in BA owner IAG fell by 3.1% in early trade on Friday."</p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>Social media is getting filled with comments from outraged customers :</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>Mat Thomas said he placed a booking on 27 August, but had not been contacted about the breach.</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>"Atrocious that I had to find out about this via news and twitter," he tweeted.</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>"Called bank and had to cancel both mine and my wife's card. Probably won't get it back before we fly (ironically)."</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>Gemma Theobald tweeted: "My bank... are experiencing extremely high call volumes due to this breach! Couldn't do anything other than cancel my card... not how I wanted to spend my Thursday evening."</p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>If you have remained impermeable to the new regulation, should this data breach incident be a wake up call. Data breach and GDPR is not exclusively a concern for big organisations. That includes SMEs or charities or any entity processing personal data outside household activities. To check GDPR wide application, you can read my previous posts.&nbsp;<a href="https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/" target="_blank" rel="noreferrer noopener">GDPR Material and Territorial Scope.</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Another major innovation of the GDPR is class action or remedies from data subjects.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/" target="_blank" rel="noreferrer noopener">All you need to know about GDPR compliance.</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://www.telegraph.co.uk/news/2018/09/07/british-airways-hacking-customers-cancel-credit-cards-airline/" target="_blank" rel="noreferrer noopener">The Telegraph report</a>&nbsp;: "Alex Cruz, BA's chairman, revealed the hackers were "very sophisticated criminals" who had not hacked the company's encrypted data, but rather gained "illicit access" to the airline's system.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This meant the breach went unnoticed for more than two weeks and now customers&nbsp;are scrambling to cancel their cards once the airline became aware of the breach on September 5."</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>It is thought the number of payments compromised could be up to 400,000 and BA confirmed Friday morning hackers had obtained names, addresses, credit card numbers, expiry dates and the three-digit security codes on the backs of cards - plenty to make a fraudulent payment.&nbsp;</p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>THE UK ICO has published "Records management for small business means safeguarding people’s personal information and making sure any risk has been reduced.&nbsp;<a href="https://ico.org.uk/for-organisations/resources-and-support/data-protection-self-assessment/" target="_blank" rel="noreferrer noopener">We’ve designed a records management checklist and many GDPR checklists</a>"</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>So far, nothing much in the&nbsp;<a href="https://lnkd.in/dvAaQRd" target="_blank" rel="noreferrer noopener">ICO statement in response to British Airways breach announcement</a>&nbsp;nor&nbsp;<a href="https://www.ncsc.gov.uk/news/ncsc-statement-reported-british-airways-data-breach" target="_blank" rel="noreferrer noopener">NCSC statement on the reported British Airways data breach</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Interestingly, in July this year,&nbsp;<a href="https://www.theverge.com/2018/7/19/17591732/british-airways-gdpr-compliance-twitter-personal-data-security" target="_blank" rel="noreferrer noopener">British Airways asked customers to post personal information on Twitter ‘to comply with GDPR’</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>And finally, we can wonder if BA has suffered from the absence of an active DPO as they have advertised for the post :</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>"Role Title: Group Data Protection OfficerPurpose of the role</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>The Group Data Protection Officer will be&nbsp;responsibility for overseeing the Group’s dataprivacy compliance programmes. The role is appointed to fulfil the statutory obligation under the *General Data Protection Regulation to appoint a Data Protection Officer (DPO) for the Group companies meeting the statutory criteria...</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>The ability to remain calm, controlled and resilient"</p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p><a href="https://www.information-age.com/british-airways-customer-data-hacked-stolen-123474644/" target="_blank" rel="noreferrer noopener">British Airways customer data hacked and stolen</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong><u>UPDATE:</u></strong>&nbsp;~If the financial harm is difficult to prove and the ICO fine uncertain, BA risk to be liable to compensate for non-material damage under the Data Protection Act 2018. Psychological harm and distress are used for a customer class action by SPG law.<a href="https://www.telegraph.co.uk/business/2018/09/09/british-airways-customers-claim-data-distress/" target="_blank" rel="noreferrer noopener">&nbsp;Law firm representing customers action asking compensation for distress, not necessary a financial</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Read more :&nbsp;<a href="https://londonlovesbusiness.com/spg-law-launch-500m-group-action-against-british-airways-following-catastrophic-data-breach/" target="_blank" rel="noreferrer noopener">SPG Law launch £500m Group Action against British Airways following catastrophic data breach</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>According to this security expert,&nbsp;<a href="https://twitter.com/kristofera/status/1038262610729156608?s=21" target="_blank" rel="noreferrer noopener">the website remains unsecure</a>.&nbsp;<a href="https://twitter.com/kristofera/status/1038336281325928448?s=21" target="_blank" rel="noreferrer noopener">read more</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>More technical explanation / supposition :&nbsp;<a href="https://www.riskiq.com/blog/labs/magecart-british-airways-breach/" target="_blank" rel="noreferrer noopener">Inside the Magecart Breach of British Airways: How 22 Lines of Code Claimed 380,000 Victims</a></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>This work is licensed under a&nbsp;<a href="http://creativecommons.org/licenses/by/4.0/" target="_blank" rel="noreferrer noopener">Creative Commons Attribution 4.0 International License</a>.</li></ul>
<!-- /wp:list -->