I guess one issue here is that while BA are potentially on the hook for 4% of turnover under GDPR regs - passengers will see none of this, as I understand the way this works it is sucked into the coffers of local governments - they're not in a position to make generous gestures to customers.

It would actually be very interesting to know where GDPR fines go exactly, and I don't know the answer to that as I don't know whether BA itself or IAG (Spanish) is ultimately responsible. As they will eventually be paid for by customers and end up in general taxation somewhere, this probably ends up as a net cost to people affected by the breach.