It's not always clear cut. A lot of legislation is 'outcomes focused', ie having 'policies and procedures' in place or ensuring x 'so far as is reasonably practicable'. The legislation doesn't say "airline call centre agents must verify the passport expiry date of each customer when seeking to use frequent flier miles to upgrade travel trade bookings"! BA's procedure is no doubt a response to findings from things like internal compliance audits, and is a policy brought in to meet legal requirements. Obviously there's an element of what is commercially appropriate too which is a judgment call. So, in those circumstances, is it wrong to say it's a measure introduced for 'legal' reasons? I don't think it is. It's a form of shorthand.