CEDR is indeed different on this to BA's approach - that is to say for those on the same booking but who don't share a surname. I would follow CEDR's advice for a single entry, but in a suitable text field explain why BA has two sets of reference numbers. CEDR seems more relaxed about the nuts and bolts of GDPR than BA so I don't think it's an issue.