Originally Posted by
ThatT1Feeling
I'd be interested to know what GDPR rule has been breached here - I don't believe that the nanny has been personally identified, have they?
Giving her name or not is actually entirely irrelevant, and anonymity is breached if anyone could reconstruct the identity of a person. If I mention that the Prime Minister of a Government of a country by the Channel with messy blonde hair (or a certain neighbour of mine who is often very loud when she is in the corridors) has done x and y, I cannot claim that what I am saying is anonymous just because I do not spell his/her name as such. In exactly the same way, referring to someone as the nanny of person x (named) means that her identity can easily be guessed by a number of people (it doesn't need to be everyone, even 10 people, even just her own family would be enough). So it would break GDPR obligations for an airline to give information about "the nanny"'s ticket (which in fact is why BA as such has not done so, but unfortunately for them, if some of their employees do, they are responsible).