Maximise your Avios, air miles and hotel points

The lawsuit against British Airways for the 2018 data breach is proceeding – should you join?

Links on Head for Points may support the site by paying a commission.  See here for all partner links.

If you were impacted by the British Airways data breach in 2018, things are starting to get interesting.

Between June and 5th September 2018, the data of people making a transaction at ba.com or BA Holidays was compromised and passed to an unknown third party.

BA originally stated that the following data was shared:

  • email address
  • postal address
  • credit card number
  • expiration data
  • CVV

….. but this was later found to also include log in and travel booking details as well name and address information.

Passport and frequent flyer data was not compromised as that is not transmitted during the payment process.

500,000 people were impacted by the breach.  If you were included, you will have received various emails from British Airways at the time.

The Information Commissioner’s Office (ICO) was not impressed.  In July 2019 it proposed a fine of £183 million.  This was eventually reduced to £20 million, primarily because of the impact of covid on the airline, although it was made very clear that BA had acted illegally in its treatment of passenger data.

The £20m did not go to impacted customers.  It was divided up between the various European data authorities, with the UK share going directly to the Treasury.

But you can now make your own claim ….

In October 2019, Mr Justice Warby gave permission for a passenger-led case to proceed.  For 18 months now, various groups of lawyers have been planning a group litigation order.

As you may have seen from TV advertising over recent weeks, there is now a final push to get impacted flyers to sign up.

Interestingly, not many people have signed up.  Back in late 2019, when the group litigation order was granted, the largest litigation group had signed up just 5,000 people.  Press reports this week suggest that the total number of people now involved is just 16,000.

Given that Head for Points has around 50,000 readers on an average day, if you include our email readers, and is visited from over 350,000 unique devices per month, the law firms haven’t made much impact.  We could probably have got together a group of 16,000 people ourselves.

Many readers have asked us for guidance

We have receive a substantial number of emails in recent days, since the TV advertising began, asking for our opinion.

Back in October 2019 we said that we would do some digging into the various options and report back.

What happened next, of course, was covid and a financial disaster for the airline industry.

As regular readers will know, British Airways has made over 10,000 redundancies in recent months.  The requirement for covid tests for all flyers coming to the UK from tomorrow, plus the current restrictions, are causing it additional problems.  Any large fine against the airline will only weaken its financial position further and lead to more redundancies.

The group litigation is also – let’s be clear – primarily there to line the pockets of the lawyers.  35% of any money you receive will go to them.

There are some spurious numbers being thrown around at the moment about the compensation you may receive.  One oft-quoted number, put around by the lawyers, is a £3 billion total pot.  Given that this is bigger than the fine Boeing paid for the 737 MAX crashes or indeed BP paid for the Deepwater Horizon oil disaster, this is clearly not happening.

At best, it may work out at a couple of hundred pounds per claimant, less 35% for the lawyers.

That said, this will be a landmark case for UK law as it is likely to be the first major case involving a group litigation order.  No-one knows how it will go and the result will impact many future cases.

What do we recommend you do?

Head for Points has misgivings about encouraging readers to join a process.  It will enrich the lawyers at the expense of a struggling airline and its employees, with claimants receiving a relatively nominal sum in their pockets.

For this reason, we will not be recommending any particular legal group to join.

We are not saying that you shouldn’t join the action if you are entitled to – this is clearly up to you – but it isn’t something that we are comfortable promoting given the current state of the airline industry.

I should flag that the Financial Times reported yesterday that:

“BA indicated it was prepared to settle claims in a letter filed with the court last week and seen by the Financial Times.”

In response, however, one of the law firms involved emailed participants to say:

“We can confirm that, to the best of our knowledge, [the FT article] is factually inaccurate.”

Assuming this is correct, it is not clear if a) the lawyers will accept the settlement and b) whether others will be allowed to join the settlement if BA agrees a sum.  It is also not clear if the sum would be fixed – so your payout is reduced if more people join – or per person, uncapped.  However it works out, it does imply that your chances of receiving something are better than zero.

I spoke to a senior legal friend – and HfP reader – and he believes that BA will lose the case.  The only question is whether the court decides that claimants need to prove direct financial loss before they can receive a payment.

How to earn Avios from UK credit cards

How to earn Avios from UK credit cards (October 2024)

As a reminder, there are various ways of earning Avios points from UK credit cards.  Many cards also have generous sign-up bonuses!

In February 2022, Barclaycard launched two exciting new Barclaycard Avios Mastercard cards with a bonus of up to 25,000 Avios. You can apply here.

You qualify for the bonus on these cards even if you have a British Airways American Express card:

Barclaycard Avios Plus card

Barclaycard Avios Plus Mastercard

Get 25,000 Avios for signing up and an upgrade voucher at £10,000 Read our full review

Barclaycard Avios card

Barclaycard Avios Mastercard

Get 5,000 Avios for signing up and an upgrade voucher at £20,000 Read our full review

There are two official British Airways American Express cards with attractive sign-up bonuses:

British Airways American Express Premium Plus

30,000 Avios and the famous annual 2-4-1 voucher Read our full review

British Airways American Express

5,000 Avios for signing up and an Economy 2-4-1 voucher for spending £15,000 Read our full review

You can also get generous sign-up bonuses by applying for American Express cards which earn Membership Rewards points. These points convert at 1:1 into Avios.

American Express Preferred Rewards Gold

Your best beginner’s card – 20,000 points, FREE for a year & four airport lounge passes Read our full review

The Platinum Card from American Express

40,000 bonus points and great travel benefits – for a large fee Read our full review

Run your own business?

We recommend Capital on Tap for limited companies. You earn 1 Avios per £1 which is impressive for a Visa card, along with a sign-up bonus worth 10,500 Avios.

Capital on Tap Business Rewards Visa

10,000 points bonus – plus an extra 500 points for our readers Read our full review

There is also a British Airways American Express card for small businesses:

British Airways American Express Accelerating Business

30,000 Avios sign-up bonus – plus annual bonuses of up to 30,000 Avios Read our full review

There are also generous bonuses on the two American Express Business cards, with the points converting at 1:1 into Avios. These cards are open to sole traders as well as limited companies.

SPECIAL OFFER: Until 22nd October 2024, the bonus on American Express Business Platinum is increased to up to 80,000 Membership Rewards points, worth 80,000 Avios. You will receive 8 points per £1 spent for the first three months, on up to £10,000 of spending. Click here to read our full card review. Click here to apply.

SPECIAL OFFER: Until 22nd October 2024, the bonus on American Express Business Gold is increased to up to 40,000 Membership Rewards points, worth 40,000 Avios. You will receive 4 points per £1 spent for the first three months, on up to £10,000 of spending. The card is FREE for your first year. Click here to read our full card review. Click here to apply.

American Express Business Platinum

Up to 80,000 points when you sign-up and an annual £200 Amex Travel credit Read our full review

American Express Business Gold

Get up to 40,000 points as a sign-up offer and FREE for a year Read our full review

Click here to read our detailed summary of all UK credit cards which earn Avios. This includes both personal and small business cards.

Category

British Airways and Avios

Comments (170)

This article is closed to new comments. Feel free to ask your question in the HfP forums.

  • Farid hagmil says:
    14 Jan14 January 04:59

    Should it not be the survival of the fittest? The void the weakest airlines will leave will allow either better suited new entrants or expansion of current stronger companies to thrive. Frankly hard to have any sympathy to BA after their years of mis-judgements and arrogance…

    • Keith says:
      14 Jan14 January 06:07

      Exactly. I have 0% sympathy for BA. Much hassle was caused to me as a consequence of forty or so revenue and redemption bookings. BA lied. I received zero for my hassle. I stopped using BA after that – 15 years as gold. If BA go bust I will cheer. The fine was appalling. It should have been much higher. Only when you hit BA where it hurts will they change. And quite frankly, if they go under, so be it. Another airline will take their place. Maybe one that doesn’t say “show us the f**** money” at their shareholder meetings.

    • Erico1875 says:
      14 Jan14 January 06:07

      No.
      The fittest in this covid enviroment will likely be those that have had the most state aid. ie Lufthansa, who have had over 9 Billion from the German government, not those who are best run

      • Farid hagmil says:
        14 Jan14 January 06:18

        Well, then no issues for the airline to pay for data breaches! It might make the government think twice to subsidize companies that have no respect to clients, employees and communities alike…

      • marcw says:
        14 Jan14 January 08:09

        How much has the IAG group already received?

    • BuildBackBetter says:
      14 Jan14 January 08:52

      Huge barriers of entry in airline industry. It’s not competitive enough for ‘fittest of survival’. Billions needed for planes, need to get past approvals with right ownership structure, landing slots are a completely different ball game that favour incumbents etc.
      Tbh, the landing slots allocation has to be revised to give other airlines a chance. BA has a monopoly on this.

  • BS says:
    14 Jan14 January 05:36

    I am of the view that large, punitive settlements through the courts are the one thing that actually drives change for the better. In the NHS for example I am aware of trust policies that are based on cost, rather than best care for the patient. It was not until a serious incident followed by a lawsuit that the trust realised it was cheaper to treat the patients properly in the first place, that to try and save a few quid and do inferior but cheaper treatments.

    I suspect the same will be true with BA and data. Until they are sued for a very large amount of money, they will not take data protection seriously. Until they realise it is cheaper to invest in proper systems/security to start with, or it might bankrupt the company. For this reason I would encourage you to join – even if you give any money gained straight to charity. Even if the money solely went to the lawyers it would be a good thing – the punitive impact on BA is the same.

    • James says:
      14 Jan14 January 09:18

      +1

    • ken says:
      14 Jan14 January 10:46

      I’d consider the original fine to be punitive, and arguably sufficient to foster change for both BA and other companies.
      A little disappointing that it was reduced by quite so much.

      For individuals, the bar for punitive (really exemplary)damages is set very high and I doubt this case makes it, so a BA settlement offer beckons.

      I get the ‘moral hazard’ bit of letting companies off – but lets be honest here, no-one is giving their share to charity, people eyes have lit up like a dogs bollocks and they just want a free couple of hundred quid.

      The critiscm of lawyers (and accompanying sponsoring funders) is fair as they now have infinitly more skin in the game than any claimant.

      • AndyGWP says:
        14 Jan14 January 11:02

        Was going to type similar ken… the initial fine (though reduced), is the mechanism that should (and most probably is) driving BA to change behaviour. That doesn’t come overnight though.

      • Bs says:
        14 Jan14 January 11:16

        Except it wasn’t a punitive fine was it – £20 million is probably the yearly cost saved by using rubbish IT. £180 million clearly would have done the job but they chickened out. This therefore requires civil claims to increase it to something substantial.
        Companies will do simple maths: the cost of doing things properly versus the cost of leaving things are with a fine and potential future fines. Simple numbers one side versus the other. Let’s push them hard to the right way.

  • 1ATL says:
    14 Jan14 January 06:33

    I’m of the opinion that BA won’t learn unless it hits them in the pocket. Covid or no Covid, they acted with flagrant disregard with customers personal data and were targeted twice because their IT security was so weak. Give any money awarded to charity if you’re not in it for personal gain but don’t let an opportunity like this pass you by if you were affected. I had made 3 bookings during the data breach – booking references still retrievable in BAEC. I also suffered identify theft about a month later having never experienced it before. I can’t be certain but I’d wager it was a direct result of the BA data breach. Not to mention the faff and ballache of having to sort that out in my own time – why shouldn’t they pay?

    • Farid hagmil says:
      14 Jan14 January 07:40

      +1

    • ken says:
      14 Jan14 January 10:51

      is anyone arguing that people who suffer loss shouldn’t be compensated ? I don’t think they are.
      Even when there is no provable direct loss, the balance of probabilites test in your case seems persuasive, and I don’t think anyone is saying otherwise.

    • Alex Sm says:
      14 Jan14 January 19:17

      Two pence from me here:

      1) BA has already got a whooping 89% discount/rebate/haircut off the original fine, so it’s more than enough to offset the covid element of the impact which the original fine would have made

      2) Rob’s claim that lawyers will primarily benefit from the litigation is not entirely true. Even if their commission is 35%, passengers will receive almost the double of this – 65%. And lawyers help them unlock this money – individually they would have received a slice of nothing. And even if it’s a couple of hundred pounds, it will be helpful when many families struggle to make the ends meet. And if it’s a family, you can get 2x or 3x of this amount which is not unsubstantial!

  • Magic Mike says:
    14 Jan14 January 06:34

    Hmm, don’t sue BA for their negligent handling of customer data due cheaping out on their IT, vs the regular advice here to sue BA through MCOL for failure to adhere to their legal requirements with regard to EC261.

    I hate ambulance chasing lawyers as much as anyone but this doesn’t seem very consistent.

    If I had suffered direct financial loss due to BA in either of those situations I would be straight to the lawyers.

    • Mouse says:
      14 Jan14 January 07:04

      But this is exactly the point, most people suffered no direct financial loss due to the data breach.

      • Jimmy T says:
        14 Jan14 January 07:51

        Exactly Mouse, hardly any customers have suffered a financial loss due to this breach.

        • Henry says:
          14 Jan14 January 10:01

          Irrespective of individual financial loss ( which is not actually relevant) this is a breach of the Data Protection Act and it is this breach and this breach alone which is what BA is being fined for. Parties are being compensated for being victims of the data breach totally irrespective of whether or not they suffered and actual financial loss. Further claiming in addition for financial loss, direct or indirect, is a secondary claim and should indeed be considered against the incompetence and arrogance of BA (bloody awful).

      • memesweeper says:
        14 Jan14 January 08:23

        It’s very hard to prove loss in these cases, even if you were a victim. Criminals rarely cough up where they got your data from.

        The fact is the data stolen was almost certainly *sold*. This means it had value, and a large number of customers and/or their banks will have lost significant amounts of money at the hands of the purchasers of the data.

        As an affected individual it’s hard for me to show on the balance of probabilities I had a specific loss. Gather up 10,000 people who’s data was stolen and it’s a racing certainty they collectively suffered large losses. I’m not sure what the courts look at in a class action (10,000 individuals or one aggregate) but BA should expect to loose, and would deserve to IMHO.

        An industry downturn is not a reason for BA to be let off the hook — they caused a loss and should pay for it — and a useful message would be sent to other custodians of data.

        • Mouse says:
          14 Jan14 January 08:43

          Sure, BA should reimburse real losses, but anyone who has not been the victim of identity theft between 2018 and now (which is the vast majority of people) can be sure that they have not been impacted financially by this, whether their data was sold or otherwise, and therefore have no claim in my view.

          Maybe a few people were so worried as to have paid for an identity protection service, and could claim that small amount as a direct loss.

          Anyone who suffered fraud on the card they used to pay BA during that period (again, probably a very small number in any case) should have been reimbursed by their bank – so it’s on the banks to sue BA for fraud cases.

  • Tom says:
    14 Jan14 January 06:38

    Good on you for taking this stance. Sadly legal action such as this often seems to be less about compensation for those who have suffered genuine hardship and more about herd mentality looking to making a quick buck. The VW emissions scandal is the same, name me one driver who genuinely cares their grotty diesel has been putting out more fumes than it should have been.

    • Chaz says:
      14 Jan14 January 07:03

      That echoes my view. If you have genuinely lost out and have good reason to believe that the data loss was the cause of that loss, then go for it. If you suffered no impact despite making a booking over that time, then what are you claiming for?

      Yes dodgy IT system, yes there was a data breach but I cannot reconcile that with lining a lawyers pocket.

      • Farid hagmil says:
        14 Jan14 January 07:43

        Financial losses are not the only measure to suffering consequences of data breach…if this was only about financial losses, justice would be unfair…

        • Jimmy T says:
          14 Jan14 January 07:52

          Farid, what are the other consequences and should receive financial compensation for them in this instance?

      • 1ATL says:
        14 Jan14 January 07:50

        But the point is legal action is your ONLY avenue here. It’s not like the PPI situation where it was relatively easy to pursue via non legal channels. If you out in 20 minutes research and submitted claims to the supplier directly you got resolution fairly swiftly. Agreed there were plenty of ambulance companies bombarding everyone at the time willing to do the leg work for a fee and you’d have been a fool to have done that. If I personally instructed legal proceedings against BA the fees I’d incur would be more than the no win no fee solicitors are proposing (30-35% on a win estimated between £500-£2000)

      • Martin says:
        14 Jan14 January 08:13

        Agreed Chaz

    • Baji Nahid says:
      14 Jan14 January 07:09

      +1

    • Jonathan says:
      14 Jan14 January 08:00

      They might not care about the environmental impact (although that’s not a given-look at the growing popularity of electric vehicles which aren’t really the cheap option) but they will certainly care about the fact that the 2nd hand value of diesel cars has plummeted recently!

    • kitten says:
      14 Jan14 January 11:01

      I admire VW for what they did. Nothing wrong with it for me. Even if the one VW I’ve had was a heap of junk.

  • Alan says:
    14 Jan14 January 06:51

    Any thoughts on what may happen to BAEC membership and Avios balances for those that join the suit? I’m sure nothing directly but the Club terms given BA a lot of leeway and you do wonder how it may affect things going forward. Agree the traditionally (in the US at least) the majority of money goes in legal expenses for class actions – look at how tiny the payouts normally are vs the size of the funds set aside.

    • Mouse says:
      14 Jan14 January 07:09

      I’m not a lawyer, but it feels like punitive action against customers who have won court cases against you are likely to be frowned upon, even if if expulsion is allowed by the broad terms and conditions. And certainly from a reputational point of view it would be a disaster – imagine the write-up in the Daily Mail!

  • Stuart says:
    14 Jan14 January 06:52

    There was a change of policy to the executive club membership a while ago. Could taking action against BA be against this policy and for the sake of a few hundred pounds your hundreds of thousands of points could be wiped out.

  • Adam says:
    14 Jan14 January 07:05

    @lucky.

    I specifically asked the question about their share of any potential compensation and received the following.

    In the new terms, you will not be required to pay us 35% of any compensation awarded and you will instead retain 100%. This is also a no win no fee agreement which means if we are unsuccessful – we are covered by insurance. Therefore, you will not be liable to pay our fees.

    If you have any other queries, please do not hesitate to get back in contact.

    • Adam says:
      14 Jan14 January 07:27

      Rob.

      My apologies. Gave you the wrong name there. Clearly thought I was reading a different blog. SORRY!!

    • Doug M says:
      14 Jan14 January 13:27

      Lawyers make a settlement that says BA pay them their ‘costs’ of £300 million, and create a pot of £10K for the claimants settlements. Lawyers take none of the £10K as that’s 100% for the claimants.

This article is closed to new comments. Feel free to ask your question in the HfP forums.

New to Head for Points?

Welcome!  We’re the UK’s most-read source of business travel, Avios, frequent flyer and hotel loyalty news. Let us improve how you travel. Got any questions? Ask them in our forums.

Get 25,000 Avios with the Barclaycard Avios Plus Mastercard

NEW: Sign-up bonuses boosted to 3,000 and 18,000 points

Latest Forum Posts

Get 40,000 bonus points (worth 40,000 Avios) and £300 dining credit with The Platinum Card

Check reward flight availability instantly for free!

See a whole year of reward seat availability on one page at SeatSpy.com

Get £10 when you spend £150 on your free Currensea card

Booking a luxury hotel?

Our luxury hotel booking service offers you GUARANTEED extra benefits over booking direct. Works with Four Seasons, Mandarin Oriental, The Ritz Carlton, St Regis and more. We've booked £1.7 million of rooms to date. Click for details.

SME? GET POINTS WORTH 10,500 AVIOS WITH CAPITAL ON TAP

Get 20,000 bonus points (converts to 20,000 Avios) with 'first year free' American Express Gold

The UK's biggest frequent flyer website uses cookies, which you can block via your browser settings. Continuing implies your consent to this policy. Our privacy policy is here.

Got it!