Maximise your Avios, air miles and hotel points

The lawsuit against British Airways for the 2018 data breach is proceeding – should you join?

Links on Head for Points may pay us an affiliate commission. A list of partners is here.

If you were impacted by the British Airways data breach in 2018, things are starting to get interesting.

Between June and 5th September 2018, the data of people making a transaction at or BA Holidays was compromised and passed to an unknown third party.

British Airways data breach claim

BA originally stated that the following data was shared:

  • email address
  • postal address
  • credit card number
  • expiration data
  • CVV

….. but this was later found to also include log in and travel booking details as well name and address information.

Passport and frequent flyer data was not compromised as that is not transmitted during the payment process.

500,000 people were impacted by the breach.  If you were included, you will have received various emails from British Airways at the time.

The Information Commissioner’s Office (ICO) was not impressed.  In July 2019 it proposed a fine of £183 million.  See the ICO’s statement here.  This was eventually reduced to £20 million, primarily because of the impact of covid on the airline, although it was made very clear that BA had acted illegally in its treatment of passenger data.

The £20m did not go to impacted customers.  It was divided up between the various European data authorities, with the UK share going directly to the Treasury.

But you can now make your own claim ….

In October 2019, Mr Justice Warby gave permission for a passenger-led case to proceed.  For 18 months now, various groups of lawyers have been planning a group litigation order.

As you may have seen from TV advertising over recent weeks, there is now a final push to get impacted flyers to sign up.

Interestingly, not many people have signed up.  Back in late 2019, when the group litigation order was granted, the largest litigation group had signed up just 5,000 people.  Press reports this week suggest that the total number of people now involved is just 16,000.

Given that Head for Points has around 50,000 readers on an average day, if you include our email readers, and is visited from over 350,000 unique devices per month, the law firms haven’t made much impact.  We could probably have got together a group of 16,000 people ourselves.

Many readers have asked us for guidance

We have receive a substantial number of emails in recent days, since the TV advertising began, asking for our opinion.

Back in October 2019 we said that we would do some digging into the various options and report back.

What happened next, of course, was covid and a financial disaster for the airline industry.

As regular readers will know, British Airways has made over 10,000 redundancies in recent months.  The requirement for covid tests for all flyers coming to the UK from tomorrow, plus the current restrictions, are causing it additional problems.  Any large fine against the airline will only weaken its financial position further and lead to more redundancies.

The group litigation is also – let’s be clear – primarily there to line the pockets of the lawyers.  35% of any money you receive will go to them.

There are some spurious numbers being thrown around at the moment about the compensation you may receive.  One oft-quoted number, put around by the lawyers, is a £3 billion total pot.  Given that this is bigger than the fine Boeing paid for the 737 MAX crashes or indeed BP paid for the Deepwater Horizon oil disaster, this is clearly not happening.

At best, it may work out at a couple of hundred pounds per claimant, less 35% for the lawyers.

That said, this will be a landmark case for UK law as it is likely to be the first major case involving a group litigation order.  No-one knows how it will go and the result will impact many future cases.

What do we recommend you do?

Head for Points has misgivings about encouraging readers to join a process.  It will enrich the lawyers at the expense of a struggling airline and its employees, with claimants receiving a relatively nominal sum in their pockets.

For this reason, we will not be recommending any particular legal group to join.

We are not saying that you shouldn’t join the action if you are entitled to – this is clearly up to you – but it isn’t something that we are comfortable promoting given the current state of the airline industry.

I should flag that the Financial Times reported yesterday that:

“BA indicated it was prepared to settle claims in a letter filed with the court last week and seen by the Financial Times.”

In response, however, one of the law firms involved emailed participants to say:

“We can confirm that, to the best of our knowledge, [the FT article] is factually inaccurate.”

Assuming this is correct, it is not clear if a) the lawyers will accept the settlement and b) whether others will be allowed to join the settlement if BA agrees a sum.  It is also not clear if the sum would be fixed – so your payout is reduced if more people join – or per person, uncapped.  However it works out, it does imply that your chances of receiving something are better than zero.

I spoke to a senior legal friend – and HfP reader – and he believes that BA will lose the case.  The only question is whether the court decides that claimants need to prove direct financial loss before they can receive a payment.

Comments (170)

  • Baji Nahid says:

    hate companies that leverage their employees to get the begging bowls out when things go bad. “Dont help us, we’ll sack the staff and look at that, mass unemployment. You wouldn’t want that would you?”

    Feel for the staff being shafted.

    • Eric says:

      Hmm. Hfp will happily recommend any loophole/arbitrage to take advantage of an airline in normal times (and BA shag over their staff at the best of tines with the excuse to improve margins for shareholders ) yet think we should be merciful now? Utter tosh. BA handled the data breach disgracefully and compromised my data. I fully intend to see them pay.

    • sayling says:

      If the result of this action is a big fine, BA will have to find the money to pay it.
      They will either have to increase income or decrease costs.
      Very difficult to do the former at this time

  • gzo450580 says:

    Disagree completly with this position advising consumers to not exercise their legal rights. Let’s not forget that this is an airline which has put profit before safeguarding its customers’ privacy.
    Given the amount of scams / fraud that we all face, this breach has enabled crime and had a very real impact on people’s lives.
    To use the HfP argument that one shouldn’t join a claim due to lawyers receiving fees (for their hard earned professional advice), and the state of the industry (which has received government support and yet continues to deprive customers of their rights re refunds etc), is negligent at best. At worst, this recommendation could be disingenuous – HfP receives affiliate commission from BA, and therefore has a clear conflict of interest in making any recommendation to readers regarding this.

  • Nick says:

    Email from BAEC on the 25th May 2018: “..At British Airways we’ve always taken data protection very seriously. We want you to know you can trust us to respect your privacy and keep your personal information safe…”

  • Farid hagmil says:

    I think the rant against lawyers ( and I am not one myself!) Is unfair, because the class action is the best way for the real victims to be indemnified. I cannot imagine each and every individual affected by the breach ( even the most serious instance of it) to have the patience, money and willingness to go all alone…the fact that they make money out of it , is not unfair! Journalists make money out of news reporting, commercials deals with brands,…

    • Jimmy T says:

      The vast majority of the affected BA customers do not need to be indemnified as they suffered no financial loss. I had bookings during the affected period but I will not be joining the class action as I have not suffered as a result of this data breach.

      • Mr(s) Entitled says:

        Yet. Or in ways that you are aware of.

        The information is valuable and protected for a reason.

  • Charlie says:

    Find it hard to think you’d be saying the same if it was Ryanair, who also does not advertise on your site / you go to events with, etc.

  • Sarju says:

    Is there any way of finding out if I was impacted/ one of the 500,000?

    I probably would have deleted any email telling me I had.

    • Mouse says:

      Search you emails to see if you recevied a booking confirmation from BA between June and September 2018

  • James says:

    Ask yourself this… Would you claim against BA if they lost your luggage? Just because your data isn’t a physical thing, doesn’t mean it should be treated any differently. I find the stance from HfP strange.

    • Jimmy T says:

      @James, this is completely different to lost luggage as that has a tangible value and is covered on an indemnity basis.

      If you join the class action, what are you claiming for? Either you’ve suffered financially, which is fine. If not, you’d be claiming to make a quick buck. Are there any other reasons?

    • Martin says:

      There’s a huge difference in my opinion. They lost my luggage twice and yes I claimed cause I lost property and wanted it back. I got the money back to the value of the loss. Here i didn’t lose anything of value, so won’t be claiming.. each to their own but I don’t personally agree with the compensation culture especially in this case when BA is struggling enough.. each to their own though..

      • James says:

        You don’t find your data valuable? Interesting. Would you have a problem with BA selling your data?

        • Martin says:

          Of course it’s valuable, but I didn’t lose out financially or suffer as a result on this occasion. Mistakes happen. If they sold my data intentionally without me knowing that’s a different story..

          • James says:

            So you agree you’ve lost something of value, therefore you should be compensated.

      • marcw says:

        So your personal data has no value to you? You must leave in a different century, sorry.

      • T says:

        I would say your data is of far more value. In fact how do you put a figure on something that is unique to you? Criminals trade this data as they realise its value. Why don’t you?

        • Thom says:

          I have to agree with Martin – It’s not a question of data having no value but a question of the financial impact to you (it would be different if BA sold the data).

          If your luggage is lost it’ll cost you money to replace – you’ve been financially impacted. Asking the airline to cover the cost of replacements makes you whole; it doesn’t give you a profit.

          If your data is stolen as in this case you may or may not have been financially impacted. If you were (I.e through fraud) then you should reclaim the money – I recall BA saying at the time they’d reimburse anyone impacted in this way though I don’t know if they actually did – which would make you whole, but wouldn’t give you a profit.

          If you weren’t financially impacted then asking for compensation is asking to make a profit.

          They were fined and rightly so, but I don’t believe in a culture of suing just because we don’t like something – showing impact is a good start and keeps claims proportional.

          • Martin says:

            Agreed Thom and I can’t be bothered to get into an argument with people. I’ll do what I believe is best and I’m sure others will. Good luck all ..

        • Harry Holden says:

          Great – where can I sell my data to make a quicker buck?

      • kitten says:

        If they’re struggling then compensation and fines should be able ti be deferred or paid over time provided they’re index linked.

        But they should pay. Not many of us can change our identity once details are out.

    • Farid hagmil says:


    • sayling says:

      Losing luggage is one thing, having your systems breached and your customer’s data stolen is another.
      It feels like some people want to punish the victim of the breach here. Yes, security should have been better, no two ways about that. But they have been fined and punished for this failure.

      • James says:

        So what do the customers who’ve had their data stolen receive as compensation? A simple sorry from BA and a promise it’ll never happen again?

        • Ben says:

          I guess another way to ask the question is if BA lost other people luggage would you still claim just to try and get something for nothing. Clearly by reading replys from Farid and James it would seem so.

          • James says:

            But that isn’t what has happened here. People’s data WAS stolen. It is unknown what has since happened with that data, but it WAS stolen in the first place. For the record, I was unaffected.

    • Adam says:

      Totally agree with James.

      The arguments about mistakes happen is not strong. Mistakes do happen but this, by all accounts could have been avoided but BA choose to risk it to save money. At what point does it become negligent?

      I spent the best part of a year back and forth with Virgin CC trying to prove transactions were fraudulent before they agreed and refunded. Also spent time cancelling cards and updating accounts. Did I ultimately suffer any funicular lose? No. Am I claiming. Absolutely.

      Will let the lawyers argue as to what the time and effort I spent is worth.

    • Tim says:

      BA lost my luggage and were twats over paying out compensation. To my mind they deserve all the fines and damages coming their way.

  • Dave says:

    Rob clearly not affected by this then!!

Leave a comment

Your email address will not be published. Required fields are marked *

Please click here to read our data protection policy before submitting your comment