Not sure of the current GDPR but under the old Data Protection Act to infer or acknowledge a relationship was a breach.

Be interesting to see the real outcome here as whilst it can be reasonable to expect receipts to be provided for reimbursement in my experience BA have never asked for them and been more than reasonable themselves. Eg when my bag was ripped open on the Inaugural KRK a few years ago I claimed £20 for a third of a bottle of fragrance that had come out and £10 to get a tear in some trousers repaired, BA callled me and said well you can’t replace a third of a bottle so that will be £60 for the fragrance and you are not getting the tear repaired will £40 for a new pair of trousers be enough,...so they offered to pay me £70 more than I was claiming

WHilst BA have been very lacklustre in this scenario and I suffered minor inconvenience by having to get replacement cards and BA have been very good to me this year so I can’t really get too angry but it does annoy me that they played the victim card here..

Still with Facebook’s breach now I guess BA can breathe a sigh of relief