Originally Posted by
cauchy
If, after some time has passed, the person in question makes a GDPR request under the 'right to be forgotten' I don't see how the airline can refuse unless there's an ongoing risk from carrying them.
They can refuse due to, or merely potential, legal proceedings. If it went through BA's legal department there may be separately Legal Privilege in play. There's also a public interest test on staff safety and welfare, which won't be difficult to demonstrate.