Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 10 OCTOBER 2018

Up Up And Away – Bumpy Take-Off For British Airways Post GDPR Commencement

RDJ LLP
RDJ LLP
Contributor
RDJ LLP

RDJ LLP

RDJ is one of Ireland’s leading corporate law firms. With more than 300 employees and offices in...

View firm profile
Explore more from RDJ LLP

British Airways have found themselves the subject of a significant data breach where some 380,000 customers' data has been stolen.

IrelandPrivacy
Ailbhe Ní Bhriain
Ailbhe Ní Bhriain
Seán O'Reilly
Seán O'Reilly
Author LinkedIn connections

9 October, 2018

British Airways have found themselves the subject of a significant data breach where some 380,000 customers' data has been stolen. The hack is said to have taken place over a two week period from the 21 August to the 5 September, during which time personal and financial details relating to passengers were stolen. The airline however contends that this information did not include travel or passport details.

The severity

While financial information is not considered 'special' category personal data in accordance with the GDPR, the hack nevertheless remains of high severity due to the security codes or 'CVV' numbers which were accessed by the hackers. Access to this code along with credit card numbers and expiry dates allows for extensive misuse of cards. This information is considered particularly valuable and companies are not permitted to store this data. While British Airways insists that it did not do so, users who booked or amended bookings

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

The Data Act – “Access By Design” Requirement Comes Into Force

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act: “Access By Design” Requirement Comes Into Force For Medical Devices

The Data Act's "access by design" requirement came into force on 12 September 2026, mandating that manufacturers of connected products and providers of related services must enable direct user access to generated data by default. This article examines the scope of this new obligation and its practical implications for businesses in the Life Sciences sector, particularly those developing medical devices and Internet of Things products.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act – Part I: Key Considerations Regarding Data Access And Sharing

The EU Data Act, which became applicable on 12 September 2025, fundamentally reshapes how businesses handle data generated by connected devices and related services. With Ireland's General Scheme published in February 2026 designating ComReg and CCPC as enforcement authorities, companies must now assess their compliance obligations across data sharing frameworks, contractual terms, and user access rights or face significant fines.
IrelandPrivacy
Matheson
Matheson
Article

DPC AI Insights Report: Key Takeaways

Ireland's Data Protection Commission has published a comprehensive report examining its supervisory engagement with organizations developing AI products between 2021 and 2025, revealing a tenfold increase in AI-related engagements and highlighting critical compliance areas including lawful basis, transparency, and children's data protection. The report provides detailed insights into the DPC's quasi-regulatory sandbox approach and outlines key observations on data protection obligations for AI technologies,
IrelandPrivacy
Matheson
Matheson
Article

EU Introduces Mandatory Withdrawal Button For Online Consumer Contracts

The EU's new withdrawal button requirement will fundamentally reshape how online traders interact with consumers across member states. From June 2026, businesses offering digital contracts must implement a two-step withdrawal function that allows consumers to exercise their 14-day cooling-off period with unprecedented ease. What technical, operational, and legal changes must traders implement to meet these obligations, and what are the consequences of non-compliance?
IrelandConsumer Protection
RDJ LLP
RDJ LLP
Article

Rental Law Update: Recent Enactments Under The Housing And Residential Tenancies (Miscellaneous Provisions) Act 2026

Ireland's residential tenancies regime has undergone further significant reform through the Housing and Residential Tenancies (Miscellaneous Provisions) Act 2026, introducing new enforcement mechanisms and procedural changes that landlords must navigate. The RTB now wields expanded powers including fixed payment notices for compliance breaches, while adjudication hearings have shifted to public forums with published outcomes.
IrelandReal Estate and Construction
RDJ LLP
RDJ LLP
Article

Greenwashing Enforcement Has Arrived: What The EU's New Fast Fashion Rules Signal For All Consumer-Facing Businesses

The EU's Ecodesign for Sustainable Products Regulation has banned the destruction of unsold apparel and footwear from July 2026, forcing retailers to pivot from recycling and disposal to donation, resale and reuse strategies. With mandatory public reporting on unsold stock disposal and stricter policing of environmental marketing claims now in force, consumer-facing businesses across Ireland and the EU face a fundamental shift in how they manage inventory, report waste, and communicate sustainability creden
IrelandEnvironment
RDJ LLP
RDJ LLP
Article

Neurodivergence And Reasonable Accommodation: What Employers Need To Know

Employers face growing challenges in supporting neurodivergent employees, with up to 20% of the global population potentially affected by conditions like ASD, ADHD, and dyslexia. Irish law mandates reasonable accommodations under the Employment Equality Acts, but what constitutes appropriate measures and when does the burden become disproportionate? Recent case law reveals the narrow interpretation of employer defenses and the significant financial consequences of failing to properly assess and implement wo
IrelandEmployment and HR
RDJ LLP
RDJ LLP