Maximise your Avios, air miles and hotel points

The lawsuit against British Airways for the 2018 data breach is proceeding – should you join?

Links on Head for Points may pay us an affiliate commission. A list of partners is here.

If you were impacted by the British Airways data breach in 2018, things are starting to get interesting.

Between June and 5th September 2018, the data of people making a transaction at or BA Holidays was compromised and passed to an unknown third party.

British Airways data breach claim

BA originally stated that the following data was shared:

  • email address
  • postal address
  • credit card number
  • expiration data
  • CVV

….. but this was later found to also include log in and travel booking details as well name and address information.

Passport and frequent flyer data was not compromised as that is not transmitted during the payment process.

500,000 people were impacted by the breach.  If you were included, you will have received various emails from British Airways at the time.

The Information Commissioner’s Office (ICO) was not impressed.  In July 2019 it proposed a fine of £183 million.  See the ICO’s statement here.  This was eventually reduced to £20 million, primarily because of the impact of covid on the airline, although it was made very clear that BA had acted illegally in its treatment of passenger data.

The £20m did not go to impacted customers.  It was divided up between the various European data authorities, with the UK share going directly to the Treasury.

But you can now make your own claim ….

In October 2019, Mr Justice Warby gave permission for a passenger-led case to proceed.  For 18 months now, various groups of lawyers have been planning a group litigation order.

As you may have seen from TV advertising over recent weeks, there is now a final push to get impacted flyers to sign up.

Interestingly, not many people have signed up.  Back in late 2019, when the group litigation order was granted, the largest litigation group had signed up just 5,000 people.  Press reports this week suggest that the total number of people now involved is just 16,000.

Given that Head for Points has around 50,000 readers on an average day, if you include our email readers, and is visited from over 350,000 unique devices per month, the law firms haven’t made much impact.  We could probably have got together a group of 16,000 people ourselves.

Many readers have asked us for guidance

We have receive a substantial number of emails in recent days, since the TV advertising began, asking for our opinion.

Back in October 2019 we said that we would do some digging into the various options and report back.

What happened next, of course, was covid and a financial disaster for the airline industry.

As regular readers will know, British Airways has made over 10,000 redundancies in recent months.  The requirement for covid tests for all flyers coming to the UK from tomorrow, plus the current restrictions, are causing it additional problems.  Any large fine against the airline will only weaken its financial position further and lead to more redundancies.

The group litigation is also – let’s be clear – primarily there to line the pockets of the lawyers.  35% of any money you receive will go to them.

There are some spurious numbers being thrown around at the moment about the compensation you may receive.  One oft-quoted number, put around by the lawyers, is a £3 billion total pot.  Given that this is bigger than the fine Boeing paid for the 737 MAX crashes or indeed BP paid for the Deepwater Horizon oil disaster, this is clearly not happening.

At best, it may work out at a couple of hundred pounds per claimant, less 35% for the lawyers.

That said, this will be a landmark case for UK law as it is likely to be the first major case involving a group litigation order.  No-one knows how it will go and the result will impact many future cases.

What do we recommend you do?

Head for Points has misgivings about encouraging readers to join a process.  It will enrich the lawyers at the expense of a struggling airline and its employees, with claimants receiving a relatively nominal sum in their pockets.

For this reason, we will not be recommending any particular legal group to join.

We are not saying that you shouldn’t join the action if you are entitled to – this is clearly up to you – but it isn’t something that we are comfortable promoting given the current state of the airline industry.

I should flag that the Financial Times reported yesterday that:

“BA indicated it was prepared to settle claims in a letter filed with the court last week and seen by the Financial Times.”

In response, however, one of the law firms involved emailed participants to say:

“We can confirm that, to the best of our knowledge, [the FT article] is factually inaccurate.”

Assuming this is correct, it is not clear if a) the lawyers will accept the settlement and b) whether others will be allowed to join the settlement if BA agrees a sum.  It is also not clear if the sum would be fixed – so your payout is reduced if more people join – or per person, uncapped.  However it works out, it does imply that your chances of receiving something are better than zero.

I spoke to a senior legal friend – and HfP reader – and he believes that BA will lose the case.  The only question is whether the court decides that claimants need to prove direct financial loss before they can receive a payment.

Comments (170)

  • Pippa Holden says:

    This article is unbelievable. Rob dedicates his working life towards nominal savings on flying, and sharing that information with his readers. Yet now, when BA are responsible for one of the UK’s worst ever data breaches with individuals losing personal and financial to fraudsters, he doesn’t support affected customers from being rightly compensated? This is the consequence of an individual that has a financial interest in not publicly throwing BA to the dogs. The quotes about the lawyers are also an embarrassing attempt to seek to justify his position. In my opinion, Rob lost credibility with this article – and also a reader.

    • Save East Coast Rewards says:

      I see nothing wrong with the article. It’s not saying don’t claim it’s just getting you to think before you do. In these difficult times I’d rather do my bit to see BA survive. I think losing an airline the size of BA would be bad for the UK on many levels

      • QwertyKnowsBest says:

        100% agree

      • Rob says:

        For clarity, if BA ends up saying ‘we will put £100m into a pot and anyone who submits a valid claim can have a share’ then you can be 100% certain that we will be helping readers jump through the hoops to get a share. At that point the airline has committed to a sum and it is only about how it is shared out.

        • James says:

          If BA came out and said “we were wrong, he’s £200 to compensate you”, would you knock it back?

          • Rob says:

            No, because on that basis BA has agreed to make a payment which it believes it can afford.

            If you’d driven over one of your neighbours plants by mistake, I would recommend you offer him a nice bottle of wine as compensation and I would recommend him to accept. I wouldn’t be telling him to launch a £20,000 lawsuit against you for unspecified and unproven mental anguish.

      • Martin says:


        • Martin says:

          Reply fail

        • Mr(s) Entitled says:

          But what if your neighbour drove over your prized plant. One you held very dear. The Personi Informational Fraudulous.

          What if your neighbour then did it repeatedly. What if they then failed to acknowledge their action. What if they then failed to engage with you. Take your call, respond to your email, acknowledge your letter. What if when they did engage they fobbed you off with all communication going via their seven year old daughter with the head of the house always beyond reach. What if all your other neighbours, at their expense had been avoiding your plant. What if doing so put them in a worse position than the perpetrators. What if they had spent their own money ensuring your plant was safe and the other neighbour, well he had put his financial gain ahead of your plant. What if they never even offer the wine?

          • kitten says:

            Brilliant, Entitled !!!

          • ChrisC says:

            Surely you’d move this super special plant and plant it somewhere so it was out of danger of being run over.

            Then build a wall / install a bollard or two and wait for the “crunch” as your neighbours car hit them.

  • James says:

    The journalism on this site is deteriorating at a rapid rate. The email from the lead lawyers actually reads:
    “We are aware of statements being made that suggest that the Defendants have agreed to settle the Group Litigation out of court and that settlement discussions have already started. We can confirm that, to the best of our knowledge, this is factually inaccurate.” They were not refuting the FT’s point that “BA indicated it was prepared to settle claims in a letter filed with the court last week and seen by the Financial Times.” Indeed, they expressly confirm the FT’s point: “The correct position is that, at the Case Management Conference in November 2020, British Airways informed the High Court that it was open to the possibility of entering into settlement discussions with the Claimants.”

    Others must do what they feel is right, but I signed up early and will pay no fee. BA and its shareholders gained a financial advantage through scrimping on IT at the expense of customers and it must serve as a message to other companies that wanton disregard for the personal data of those customers they supposedly value has a cost. Those who have read the ICO report can have little sympathy for BA.

    • Tom says:

      Firms should be punished for such breaches but the regulator already does this by issuing fines. Far more effective than a bunch of entitled individuals most with no proof of hardship who believe they should get money for nothing.

  • Cavallinorampante says:

    Separate from the pro- and con- arguments above, I have a different concern. While the law firm concerned has taken out insurance to protect claimants from costs if the case is lost, I would assume that this policy, like most others, is valid only if there is no disqualifying behaviour by the law firm
    Itself. If the lawyers took actions intentionally or inadvertently that invalidated the policy, would claimants be on the hook for the legal costs awarded against them in a lost case?

  • Rich says:

    Good article by Rob. Storm in a tea cup. BA were rightly fined. Wheel in the ambulance chasers. Most name and address info. is publicly available anyway and if those impacted cancelled / got reissued cards then they’ll have been fine and I hope got over it after a bit of inconvenience. BA could have given 10000 Avios as a wp gesture but weren’t that warm in those days! In this e-world we enjoy, we know we must take care to avoid phishing scams and keep a check on our credit file anyway and it’s free to do so. I expect proving any loss for the vast majority of people will be tough – as they won’t have suffered any. You never hear much about the perpetrators of these crimes do you, they should be hunted by the ambulance chasers and joined as defendants!!

  • Neal says:

    Not impressed by Rob’s stance on this. Does not look good due to conflicts of interest.

    • Save East Coast Rewards says:

      I guess wanting the biggest airline in the UK to exist in the future is a massive conflict of interest. I’d rather have BA existing in a few years than a few hundred quid extra in the bank

    • Rob says:

      Which are what? We haven’t got paid on flights or BA Holidays sold via the site since last March. We have never had a free long-haul press trip from the airline.

      BA does advertise with us but so do many other people. I think the Amazon Business credit cards stuff we ran last year paid more than BA’s entire 2020 ad spend. Marriott’s Week of Wonders paid multiple times BA’s 2020 spend.

  • AJA says:

    My other half received the email that their details had been compromised in the data breach. Thus far as far as we know nothing has happened with that data so no financial loss has occurred. So no compensation due but is there an entitlement to compensation for the potential harm from the breach itself? I wonder how many have actually suffered a financial loss? I suspect most are like my spouse which is why there is so little uptake to pursue a claim against BA on the basis that they actually did not suffer any loss.

    The trouble is that apart from the £20 million fine has anything actually changed at BA to ensure that this won’t happen again? I hope so.

    As for getting compensation I see both sides of the argument (a) that it would harm BA versus (b) BA should pay for its mistakes.

    I’m inclined to give BA the benefit of doubt and hope that the £20 million fine was enough of a slap on the wrist. But if it happens again then really go hard.

    • Rob says:

      You have to assume the £20m was more than the money BA saved by scrimping on IT spend over the years. If it wasn’t, of course, it doesn’t do any good.

      HfP was massively underspending on IT for years, mainly because I don’t know anything about it. We got to 1 million page views per month on a £6.99 monthly hosting package. However, it got to a point where the loss in ad revenue from the site going down was looking higher than the cost of beefing things up. We arguably overspend on hosting now but – recent issues apart, which were our fault and not the hosting company – we come out ahead vs the cost of the site going down for 24 hours.

      • AJA says:

        I think the fine was smaller than it should have been but I also accept the figure since the Covid-19 pandemic hasn’t helped things.

  • Jonny Price says:

    I think the anti Rob comments are totally unfair.

    Let’s be clear – yes BA was negligent and should be punished (and they already have been – with the £20m fine), but there has been zero evidence of fraud as a result of the data breach. So no-one has been left out of pocket financially.

    I could understand if people want to claim to recoup losses – but no-one has lost anything.

    If you’re concerned about your data, cancel your payment card and get a new one (which is arguably a sensible thing to do every now and again anyway). Google and Apple probably have more personal data on you than BA…

    • Ben says:

      And with the amount of churning that goes on (including me) they can have my credit card details from 2018 if they like.
      I also changed my login – problem solved.

    • kitten says:

      several people here have reported fraud on their cards considerably after the breaches in circumstances where no other breach save BA’s had taken place. Comnents on here are often the tip of a iceberg.

      • Ben says:

        Then those people are 100% right to claim. My issue here is there are people who have had absolutly no issues at all but desperate to claim and using the “but my details might be on the dark web” excuses.

  • Peter Talbot says:

    Lets make it clear I am not normally a supporter of BA but in this case I will side with the editor. I am not comfortable with these type of lawsuits , we will become too much like the USA and look where that has led to litigation at the drop of a hat. I would hope that BA would do the honest thing and contact ALL affected passengers and offer a remuneration without the need for any court case whereby lets face it ONLY the lawyers win.

Leave a comment

Your email address will not be published. Required fields are marked *

Please click here to read our data protection policy before submitting your comment