How much will Cathay Pacific be fined by UK regulator, given British Airways’ record US$229 million penalty over similar data breach?

Both airlines last year suffered major cyberattacks, with data of 9.4 million Cathay passengers affected, and half a million customers involved for British carrier

BA was hit with a fine equivalent to 1.5 per cent of its revenue in 2017, and by same benchmark, Cathay could lose US$186.5 million

Reading Time:4 minutes

A Cathay Pacific aircraft taking off from the Hong Kong International Airport in Chek Lap Kok. Photo: Felix Wong

Published: 10:00am, 9 Jul 2019Updated: 10:59am, 9 Jul 2019

The spotlight is once again on Cathay Pacific Airways as it awaits results of an investigation by a British regulator over its massive data breach last year, with British Airways handed a record £183 million (US$229 million) fine by the authority for a similar incident.

In an era of tighter rules on how companies manage personal data, the hefty fine by Britain’s Information Commissioner’s Office (ICO) on Monday was the first major penalty for a company governed by Europe’s tough General Data Protection Regulation, introduced last summer.

The ICO did not explain how it decided on the fine but BA said it intended to challenge the penalty. On two occasions last year, the company suffered from data breaches involving the loss of credit card information that affected half a million people.

Hong Kong’s privacy commissioner last month criticised Cathay Pacific for its 2018 data breach in which 9.4 million customers were affected – one of the worst-ever losses of customer data. The watchdog slammed Cathay for being too lax in protecting its data systems, which had been accessed without authorisation.

Cathay Pacific called in the Hong Kong police to help investigate a massive data breach. Photo: Felix Wong

With British citizens among Cathay passengers affected, Hong Kong’s flag carrier is also under investigation by the ICO. In a statement, British Information Commissioner Elizabeth Denham said of BA’s fine: “People’s personal data is just that – personal.