An analysis of the Monetary Penalty Notice issued by the Information Commissioner's Office to British Airways plc dated 16 October 2020

Introduction

On 16 October 2020, the Information Commissioner's Office (the "ICO") issued British Airways plc (“BA”) with a Monetary Penalty Notice¹ (the "MPN"), fining the airline £20 million for breaches of Articles 5(1)(f) and 32² of the General Data Protection Regulation³ (the "GDPR") in relation to a data breach in 2018 in which the personal data of around 430,000 of BA's customers was compromised by a hacker gaining access via systems used to permit staff/contractors to work remotely.

Whilst this is the largest fine imposed by the ICO to date, it is noteworthy that it only represents 11% of the £183.39 million fine proposed in the ICO’s Notice of Intent (“NOI”) dated 8 July 2019.

Aside from the headline-grabbing fine (and the extensive discussion regarding how it was reached), the MPN represents a helpful guide for organisations regarding how to ensure that they have "appropriate technical and organisational measures" in place to avoid regulatory sanctions where personal data is lost arising from unauthorised access to their IT systems.

Background

The data breach

The facts of the data breach, which occurred between 22 June and 5 September 2018, are, in overview:

• An attacker gained unauthorised access to BA’s IT systems through a Citrix remote access gateway (the "CAG") using the login details of an employee of Swissport, one of BA's contractors;
• Having gained access via the CAG, the attacker was able to access BA's wider IT infrastructure using methods, which as at the date of the MPN, had not been ascertained, and accessed a privileged domain administrator account;
• Thereafter, over a number of months, the attacker proceeded to exfiltrate various personal data, namely: (A) the cardholder data⁴ of approximately 430,000 BA customers by: (1) editing a Javascript file on BA's website to send customer payment card data to a separate website controlled by the attacker, "BAways.com"; and (2) accessing unencrypted log files; and (B) usernames and passwords/pin numbers of a more limited number of customers, employees and contractors; and
• On 5 September 2018, a third party informed BA that data was being exfiltrated from its website, and within a matter of hours, BA took the necessary steps to end the breach.

BA notified the ICO, affected data subjects, and acquirer banks and payment schemes, regarding the data breach the following day.

The ICO's regulatory response

Thereafter, the ICO commenced its investigation, issuing the NOI the following summer which threatened BA with a fine of £183.39 million on the basis that: "a variety of information was compromised by poor security arrangements at [BA]".

In response to the NOI, BA provided three⁵ sets of substantive written representations⁶ (on 5 September 2019, 31 January 2020, and 12 May 2020): 

• Challenging the ICO's finding that BA had failed to put in place "appropriate technical and organisational measures" to prevent, and thereafter, detect, the breach; and
• In the latter case, informing the ICO of the impact that Covid-19 had had on BA’s financial position.

The basis on which the fine was calculated

No doubt, the question on the lips of even the most casual observer of this case is why the final penalty is almost 90% less than that proposed in the NOI a year ago.

A clear answer is not forthcoming in the MPN; it brushes over the issue and instead starts from scratch with the five-step approach outlined in the ICO’s Regulatory Action Policy (“RAP”)⁷.

The key factors on which the Commissioner relied in deciding the quantum of the fine in line with the RAP included:

• The fact that BA "did not gain any financial benefit, or avoid any losses, directly or indirectly as a result of the breach";
• The “serious” nature of BA’s failings⁸ in "processing a significant amount of personal data in an insecure manner"⁹;
• The substantial duration of the breach (103 days)¹⁰;
• The negligent (but not intentional) nature of BA's breaches of GDPR¹¹;
• The fact that BA were “wholly responsible” for the breaches¹²;
• The absence of previous infringements on BA’s part;
• The full cooperation which BA gave to the ICO;
• The fact that, although no special category data was affected, financial data was compromised in the breach¹³; and
• BA's prompt notification of the breach to the ICO.

These factors contributed to the calculation of an initial fine of £30 million, which was then reduced by 6% to £24 million as a result of the following mitigating factors¹⁴.

• The immediate steps taken by BA to mitigate and minimise damage suffered by affected data subjects (for example, by offering to reimburse all financial losses which they had suffered and offering a free credit monitoring service);
• The prompt notification given to affected data subjects and the ICO;
• Widespread media reporting, which is likely to have increased awareness amongst other data controllers of the risks posed by cyber-attacks; and
• The adverse effect of the breach on BA’s brand and reputation¹⁵.

A further reduction of £4 million was made to reflect the impact of Covid-19 on BA's business¹⁶. The final total was therefore £20 million ¹⁷.

As noted above, the MPN does not spell out in clear terms the reasons for the significant reduction in the quantum of BA's fine from that envisaged in the NOI. However, the references to BA’s representations as summarised in the MPN and the Commissioner’s  responses provide a number of clues.

It appears that, in reaching the £183.39 million figure in the NOI, the Commissioner had used an unpublished internal document entitled “Draft Internal Procedure for Setting and Issuing Monetary Penalties” (“DAP”), which used turnover as the central metric for calculating fines. The Commissioner backtracked prior to issuing a draft decision to BA, agreeing that “the DAP should not be used in the present case” and noting that “in deciding the appropriate penalty no reference has been made to the DAP”. Instead, “the Commissioner…relied on Article 83 GDPR, section 155 DPA and the RAP”.

A number of other comments made in the MPN are worth noting in respect of penalty calculations more generally:

• Contrary to BA’s submission that a turnover-based approach is a “fundamentally flawed” way of achieving proportionate and effective penalties, the MPN emphasises that turnover remains “a relevant metric for assessing whether any fine is proportionate and dissuasive”; it is “one key factor to be taken into account in the round, by reference to the particulars facts at issue in the case”¹⁸;
• The Commissioner rejected BA’s submission that there is a clear conflict between the maximum fines for breaches of Articles 5(1)(f) and 32 (on the basis that they impose the same obligations but attract different maximum fines). The two provisions are “evidently distinct provisions of the GDPR, notwithstanding the degree of overlap… there is no conflict”¹⁹; and
• The Commissioner resisted BA’s submission that the penalty regime lacks legal certainty and that the Commissioner: "should continue to apply penalties in a manner which is consistent with the approach adopted under the superseded DPA 1998 regime, or with the limited decisions or guidance issued to date by the other supervisory authorities under the GDPR"²⁰. The Commissioner also pushed back on assertions that its investigation, the NOI, and the MPN were procedurally deficient in a number of ways²¹.

Appropriate technical/organisational measures

The extensive focus in the MPN on the calculation of the fine should not detract readers from  carefully reviewing the useful guidance provided in the MPN in relation to the Commissioner's views on "appropriate technical and organisational measures". Taken together with other recent Monetary Penalty Notices (including those issued to Cathay Pacific Airways Limited, The Carphone Warehouse Limited, DSG Retail Limited and Equifax Limited), there is now a substantial body of practical guidance for organisations to rely upon when assessing the appropriateness of the "technical and organisational measures" they have in place.

In summary, the Commissioner concluded that: "between 25 May 2018, when the GDPR entered into force, and (at least) 5 September 2018, when BA took action to prevent the transfer of personal data to BAways.com… BA failed to process personal data in a manner that ensured appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures as required by Article 5(l)(f) and Article 32 GDPR" and that: "each step of the [a]ttack could have been prevented, or its impact mitigated, by BA implementing one or more of a range of appropriate measures that were open to it".

In the context of the MPN, the following points are of particular note:

• Initial access to the BA systems²²: the Commissioner determined that BA should have considered the following factors in order to minimise the risk of the attacker gaining initial access to its systems: multi-factor authentication²³; external public IP address whitelisting; and IPSec VPN.
• Supply chain management²⁴: the Commissioner placed particular emphasis on BA's failure to mitigate the risks of a "supply chain attack" attendant in permitting contractors to access its IT infrastructure. The ICO also rejected BA's attempt to rely on a Third-Party System Access Agreement with Swissport which contained certain requirements on password protection to demonstrate that it had implemented appropriate "technical and organisational measures", noting that it does not consider "reliance on such agreements alone to be an effective measure in ensuring that Swissport user credentials, and the access they provided to BA's systems, were appropriately secured."
• Remote access²⁵: the Commissioner determined that BA had not appropriately mitigated the risks associated with remote access which was the threat vector which was used by the attacker to access BA's wider IT infrastructure. Appropriate measures in this regard may have included: application whitelisting;²⁶ application blacklisting; and application/server hardening.²⁷ Given that many readers' organisations will now be working remotely, these measure should be carefully considered. The importance of penetration testing was also stressed; if it had been carried out, “many of the problems identified within [the] decision are likely to have been detected and appropriately addressed” and "security testing of the CAG and associated applications may have identified the ability to break out of the Citrix environment".²⁸ 
• Privileged account management²⁹: a key vulnerability identified by the Commissioner was the ease with which the attacker could obtain privileged account details (for example, details of the domain administrator account). This was largely due to the fact that these details were saved in an unencrypted plain text file (referred to as “hardcoding”). In line with previous Monetary Penalty Notices³⁰, the Commissioner expressed serious concern about the storage of credentials in plain text, emphasising that this was neither standard practice nor an acceptable way of “aiding functionality”, as BA had tried to argue. The Commissioner found that, in any event, these risks may have been mitigated by monitoring access to the script in which the passwords were stored in plain text; requiring the input of credentials on execution of the script; and encrypting the script itself when not in use. The Commissioner also emphasised BA's failure to monitor attempts to access administrator accounts (the attacker had, in fact, failed to access an administrator account on a number of occasions prior to ultimately gaining access thereto), the use of guest accounts or the creation of additional administrator accounts, and to securely manage all privileged accounts across its IT infrastructure more generally (e.g. through monitoring and auditing their usage) as a matter of serious concern.
• Failure to appropriately manage its website³¹: the Commissioner identified that despite the fact that its website represented a significant threat vector, BA had failed to: review the website's code; put in place file integrity monitoring to detect changes to that code; or manual change management controls.
• Failure to adequately protect payment card data³²: the Commissioner identified that BA's approach to logging such data was particularly deficient, arising (remarkably given the sensitivity of such data) from inadvertence on BA's part: "logging and storing of these card details (including, in most cases, CVV numbers) was not an intended design feature of BA's systems and was not required for any particular business purpose. It was a testing feature that was only intended to operate when the systems were not live, but which was left activated when the systems went live." This approach was in breach of both the Payment Card Industry Data Security Standard and GDPR.
• Breach detection³³: the Commissioner emphasised the importance of logging in the breach detection process (for example, the use of a Security Information and Event Managing System).³⁴ As noted above, the breach only came to BA's attention by virtue of a third party's intervention.

It is important to note that in making these findings, the Commissioner accepted that: "[n]ot every instance of unauthorised processing or breach of security will amount to a breach of Article 5 or Article 32" and that: "comprehensive monitoring of an IT estate as large as BA's may be a relatively complex task".

However, despite BA's protestations to the contrary, including that the attack was highly sophisticated, it considered that: "[t]he [a]ttack in this case was not of such a degree of sophistication as to negate BA's responsibilities for securing its system and the personal data processed within it. Many of the steps taken by the [a]ttacker were of a kind that could have been anticipated and addressed, as they were well-known means of attempting to exploit a system" and "BA failed to put in place these measures, which could have prevented, or at least alerted BA, to this [a]ttack". The Commissioner also considered BA's contention that, had certain of the deficiencies identified by the Commissioner been remedied, the attacker might nevertheless have adapted their strategy, to be unpersuasive.

Next steps

If BA wishes to appeal the MPN to the First Tier Tribunal, it must serve a notice of appeal by no later than 16 November 2020.

Comment

A portend of future regulatory sanctions?

Caution should be exercised in assuming that the reduced penalty imposed on BA, which, of course, remains substantial in absolute terms, can be taken either as an indicator of: (A) the level at which future fines might be set by the Commissioner; or (B) the approach applied in calculating this fine being adopted by the Commissioner in future cases³⁵.

In October 2020, the ICO launched a public consultation on its draft statutory guidance on its regulation policy (the "Guidance").³⁶ The Guidance, the publication of which appears at least in part to be motivated by the issuance of the MPN, sets out a different approach to calculating fines to that which was taken in the instant case; instead of the five steps (in line with RAP), the draft sets out a nine step approach, with fines, in the first instance, being calculated in accordance with turnover as follows:

Had the Guidance been applied in relation to BA, the starting point for the penalty would have been significantly higher than £30 million, and would, in fact, have been in line with the fine of £183.39 million proposed in the NOI³⁷. Accordingly, if the Guidance is finalised in its current form, the spectre of fines running to hundreds of millions of pounds still looms large.

Regardless of whether the Guidance is ultimately adopted, the reduced fine which BA achieved highlights the benefits of organisations faced with a serious data breach of:

• Promptly reporting the breach to the ICO and affected data subjects;
• Fully engaging with the ICO throughout any investigation and, as appropriate, following a Notice of Intent being issued;
• Promptly addressing deficiencies in "technical and organisational measures" which have become apparent by virtue of the data breach³⁸; and
• Robustly challenging the findings in any Notice of Intent ultimately issued. Had BA adopted a more passive approach, it may have been left facing a fine running into the hundreds of millions.

Civil claims against BA

Despite the findings in the MPN, BA's position remains, of course, that it was not in breach of its obligations under Articles 5(1)(f) and 32 GDPR. However, given the fact that the MPN sets out in great detail why BA's position is untenable in this regard, notwithstanding that the Commissioner's decision does not bind BA in the various sets of civil proceedings arising out of the data breach which are presently afoot against BA, it is going to have an uphill struggle in contesting liability in those proceedings.

In the instant case, if BA elects not to appeal and assuming that all affected customers pursue claims against BA, its liability from those proceedings could well be more than double that deriving from the MPN.

This is likely to be reflective of a wider trend, with the losses from civil claims arising out of data breaches potentially eclipsing those deriving from regulatory sanctions, even where those sanctions are calculated by reference to the Guidance if it is finalised in its current form³⁹.