My sister received an email recently with someone elses booking details etc.

She, working for a large retail family, advised BA of the following:

This is I believe a data privacy breach. Given GDPR regulation is coming into force May 2018 I would think BA would already have this sort of major privacy breach fixed. If GDPR was already in force I do believe BA may be liable for a fine of EU20M or 4% annual turn over.

She is waiting to see what their response is.

M