Maximise your Avios, air miles and hotel points

The lawsuit against British Airways for the 2018 data breach is proceeding – should you join?

Links on Head for Points may pay us an affiliate commission. A list of partners is here.

If you were impacted by the British Airways data breach in 2018, things are starting to get interesting.

Between June and 5th September 2018, the data of people making a transaction at ba.com or BA Holidays was compromised and passed to an unknown third party.

British Airways data breach claim

BA originally stated that the following data was shared:

  • email address
  • postal address
  • credit card number
  • expiration data
  • CVV

….. but this was later found to also include log in and travel booking details as well name and address information.

Passport and frequent flyer data was not compromised as that is not transmitted during the payment process.

500,000 people were impacted by the breach.  If you were included, you will have received various emails from British Airways at the time.

The Information Commissioner’s Office (ICO) was not impressed.  In July 2019 it proposed a fine of £183 million.  See the ICO’s statement here.  This was eventually reduced to £20 million, primarily because of the impact of covid on the airline, although it was made very clear that BA had acted illegally in its treatment of passenger data.

The £20m did not go to impacted customers.  It was divided up between the various European data authorities, with the UK share going directly to the Treasury.

But you can now make your own claim ….

In October 2019, Mr Justice Warby gave permission for a passenger-led case to proceed.  For 18 months now, various groups of lawyers have been planning a group litigation order.

As you may have seen from TV advertising over recent weeks, there is now a final push to get impacted flyers to sign up.

Interestingly, not many people have signed up.  Back in late 2019, when the group litigation order was granted, the largest litigation group had signed up just 5,000 people.  Press reports this week suggest that the total number of people now involved is just 16,000.

Given that Head for Points has around 50,000 readers on an average day, if you include our email readers, and is visited from over 350,000 unique devices per month, the law firms haven’t made much impact.  We could probably have got together a group of 16,000 people ourselves.

Many readers have asked us for guidance

We have receive a substantial number of emails in recent days, since the TV advertising began, asking for our opinion.

Back in October 2019 we said that we would do some digging into the various options and report back.

What happened next, of course, was covid and a financial disaster for the airline industry.

As regular readers will know, British Airways has made over 10,000 redundancies in recent months.  The requirement for covid tests for all flyers coming to the UK from tomorrow, plus the current restrictions, are causing it additional problems.  Any large fine against the airline will only weaken its financial position further and lead to more redundancies.

The group litigation is also – let’s be clear – primarily there to line the pockets of the lawyers.  35% of any money you receive will go to them.

There are some spurious numbers being thrown around at the moment about the compensation you may receive.  One oft-quoted number, put around by the lawyers, is a £3 billion total pot.  Given that this is bigger than the fine Boeing paid for the 737 MAX crashes or indeed BP paid for the Deepwater Horizon oil disaster, this is clearly not happening.

At best, it may work out at a couple of hundred pounds per claimant, less 35% for the lawyers.

That said, this will be a landmark case for UK law as it is likely to be the first major case involving a group litigation order.  No-one knows how it will go and the result will impact many future cases.

What do we recommend you do?

Head for Points has misgivings about encouraging readers to join a process.  It will enrich the lawyers at the expense of a struggling airline and its employees, with claimants receiving a relatively nominal sum in their pockets.

For this reason, we will not be recommending any particular legal group to join.

We are not saying that you shouldn’t join the action if you are entitled to – this is clearly up to you – but it isn’t something that we are comfortable promoting given the current state of the airline industry.

I should flag that the Financial Times reported yesterday that:

“BA indicated it was prepared to settle claims in a letter filed with the court last week and seen by the Financial Times.”

In response, however, one of the law firms involved emailed participants to say:

“We can confirm that, to the best of our knowledge, [the FT article] is factually inaccurate.”

Assuming this is correct, it is not clear if a) the lawyers will accept the settlement and b) whether others will be allowed to join the settlement if BA agrees a sum.  It is also not clear if the sum would be fixed – so your payout is reduced if more people join – or per person, uncapped.  However it works out, it does imply that your chances of receiving something are better than zero.

I spoke to a senior legal friend – and HfP reader – and he believes that BA will lose the case.  The only question is whether the court decides that claimants need to prove direct financial loss before they can receive a payment.

Comments (170)

  • Phil Gollings says:

    BA emailed me saying our data was breached which caused no end of hassle constantly checking credit scores and paying for notifications for any credit changes. BA have had no problems in ripping off customers with their monopoly pricing cartels and many other bad experiences we all have had and loyalty works both ways

  • PeterK says:

    Had BA offered a token gesture to all those affected right at the start, I wonder how many would look on the situation a lot differently today. Since around the time of the data breach, BA appears to have pretty much ‘closed the door’ on giving any gestures of goodwill when it screws things up.

  • Urty says:

    I’ve read a few of the comments but I’m still not sure if it is worth joining the group for legal action? To be honest I did however not sure if it is worth it if my avios points are at risk.

  • Doug M says:

    Some of the accusations against HfP are QAnon level madness. It’s a guidance piece, no one is saying don’t join, just consider that actions have consequences.
    The punishment for BA is the ICO fine, and rather than be reduced I believe that should have been deferred.
    The claim for individuals is the normal cash grab. It will make lawyers wealthier, it won’t do much for anyone else. I don’t dislike lawyers in general, just the ambulance chaser variety.

  • Dace says:

    Personally I have no sympathy for BA and recommend that everyone who is able to apply. My lack of sympathy for BA comes down to them knowing that their IT was poor yet they preserved with it in order to scrimp on costs even though by doing so they were putting their customers at risk. I mean how many times did BA’s IT fail them prior to the data breach? Yet they did nothing to very little to recitify it.

    Further, the breach has also putting those affected at risk of idenity identity theft. Now you may not have been hit with any problems at this moment in time but that doesn’t mean you will not in future as the details are on the dark web and available for the right price.

    For me, this is a prime case of a company being penny wise, pound foolish. If they had invested properly in the correct IT then this wouldn’t have happened. Instead they tried to be clever and reduce costs to inflate their bottom line regardless of the issues that caused their customers.

    This claim for me is a case of chickens coming home to roost and needs to have the full support of those affected so that other companies and BA start to take data privacy and security properly.

  • Harry says:

    I guess this will be settled by an Avios award to all the members of the class action and a money award to cover the legal fees. I cannot prove direct financial loss but I will be happy to accept some Avios to compensate me for the time spent changing passwords etc.

  • Mco says:

    I was one of those effected and won’t be pressing ahead with this. I agree with Rob that this will only line the Law firms pockets.
    BA gave me free access to my credit report for year.

    • John says:

      In the UK you have 4 credit reports and you have a legal right to get 3 of them for free; the 4th with a subject access request which is free unless excessively requested.

  • Peter says:

    They wanted to make me pay £800 for missing my flight because someone got hit by a Piccadilly line train. Luckily there was a cheap Ryanair flight the next day. Definitely works both ways.

Leave a comment

Your email address will not be published. Required fields are marked *

Please click here to read our data protection policy before submitting your comment