If you really wanted to get uptight about it , you could sue as it is pretty obvious your personal data was handed out to someone else. Let's hope none of those frequent flyer account scammers from China, who convert your points into hotels trips were onboard - they would of not believed their luck ! However I wouldn't go that far , but would complain and keep BA's reply to gage how serious they take it then attach it to the information commissioner to help provide more of a case that BA don't care or/and hardly acknowledge the incident that occurred.