British Airways is “surprised and disappointed” that it could be fined £183m by the Information Commissioner’s Office (ICO) for a data breach, according to its chairman and chief executive, Alex Cruz.
He won’t be alone in being shocked. The size of the proposed penalty will cause spluttering in boardrooms up and down the land as the IT chief is summoned to explain whether the company’s back door is securely closed to hackers. For International Airlines Group, BA’s parent, it may mean dispatching directly to HM Treasury a sum equivalent to 5% of this year’s profits. That’s hard to brush away as an everyday cost of doing business.
Willie Walsh, the chief executive of IAG, says BA may appeal and, since the ICO’s enhanced powers have yet to be tested, one can’t blame the airline’s lawyers if they give it a go. It is hard, though, to see why the ICO should budge.
First, the penalty represents 1.5% of BA’s turnover in 2017, so is not even close to the maximum rate of 4% that can be imposed since May 2018 for infringements of the EU-wide General Data Protection Regulation (GDPR).
Second, the airline’s offences were serious. The personal data of 500,000 customers was stolen from BA’s website and mobile app, where security arrangements were deemed “poor”. Under any regime that takes account of the number of people affected, BA was almost bound to collect a chunky penalty.
The surprise, then, lies in the realisation that the GDPR was a major event and that that the ICO, whose fining powers were previously limited to £500,000, is a regulator to be feared.
Both developments are very welcome. Fraud is ultimately a cost to everyone. And even companies that count their customers in the tens of millions – think tech and social media giants – may finally have to take notice.
More pain in store for retail landlords
Half of retail sales in the UK will be conducted over the internet by 2028, versus a fifth today, says a report by the analysts Retail Economics. Even a few years ago, such a prediction might have been viewed as outlandish. And now? It seems entirely plausible.
Exhibit A would be clothing retailer Next, where online sales were already 53% of the total last year. Next set out early online, via its Directory catalogue, but has also shown how physical retailers should adapt. In brief: only sign short leases on stores.
“We do not have too much space, we have too much rent, rates and service charge,” its chief executive, Lord Wolfson, argued in last year’s report to shareholders. His accompanying prediction – that shop space will become much less expensive over the years – is the one that should terrify landlords. The decline in retail rents probably has a long way to run – still.