A while has passed now since the first and second data loss/theft. I was involved in both, according to BA emails, but so far I have not suffered direct money loss as I cancelled my cards on time.
So what are the rights for people in our position? We wasted time and are left potentially exposed to future identity thefts and the likes, but given we did not suffer and direct/immediate money loss it appears BA is not offering any form of compensation besides that ridiculous Experian check, which is wrong in my view as time is possibly more valuable than money.