megaloman

It's not new that BA does not understand what their obligations are regarding GDPR regulation.
1. they shouldn't ask for any personal information over the email - email is sent as a plain text and any servet between sender and recipient can read it's content.
2. BA prefers to save money and impose idiotic policy, than train their staff properly and apply some common sense.

dylanks

Dave Noble

email is generally encrypted between mail servers

mrow

corporate-wage-slave

I agree and though there are weaknesses in email protocols, they are far less than they used to be. Clearly it remains the case that dodgy people can send emails from "[email protected]" emulating to be "[email protected]", and this extra safeguard reduces that risk slightly. Phishing is a real threat clearly, but this is clearly different: the OP sent a request (and doubtless checked they were using the right address), got a reply from the source and all the OP needs to do is resend the original email with the extra data. Or just ring up and provide the same information, which is less encrypted incidentally. Phishing is more about the unsolicited request for information. Moreover I have been told (and the wording in post 1 implies that this also applies to GGL enquiries) that so long as you remember to include the relevant information in the initial email, then there will be no further followup if it matches the BA data held.

cjb666

Personal choice is not to send this information via email to what appears to be a robot. I am fully versed in email encryption technologies but I also understand how to spoof email clients and manipulate mail headers .

If my bank asked for similar information, even if I had initiated the email conversation, I would not send it. I would actually change who I bank with.

Anyway, happy it was not something more sinister.

Dave Noble

simple solution then is not to use email to deal with BA, but just telephone

cjb666

​​​​​​
Agree

TomMM

I looked up a domain that BA uses for email and it seems they are using Outlook. Hopefully they are using a private cloud solution.

LTN Phobia

IMO it depends on what it is.

In some cases security checks should not even be necessary. If all the data associated with the account to which the flight is requested to be credited and the flight booking match, there should not even be any need to verify who sent the email, but rather, simply verify the flight and the account match. It's not as if the email is trying to make a redemption request, or that it is harming the account holder.

Adding a layer of inconvenience when the customer has already been inconvenienced whether it is genuinely intended to be in the interest of security or not is not good customer service.

I fully recognise the need to ensure customer security and legal compliance but if this is the inconvenient consequence of the GDPR, I have to say it has not been designed (or implemented) with the broad consumer protection in mind. There is more to protect than privacy, e.g. time.

I value my time as much as privacy and there should be a much simpler solution than to use very rudimentary, easily-available information for security verification - seems like a window-dressing solution that does not achieve much.

babats

Rather appropriate for an airline!

MrSimonR

It would be extremely foolish of anyone to send all their personally identifiable information in an email:
- emailing is not necessarily secure and can be intercepted
- a data breach will result in all your account information being in the wrong hands
- knowing that BA sends such requests increases the likelihood of people falling victim to a pfishing email, requesting the same information

To be clear, GDPR does not require BA to ask for this. It requires BA to keep our personal data secure. Ironically, it is making our personal data LESS secure by asking it to be written in an email.

I am refusing to disclose all PII in email form to GGL. I suggest others do the same. The objections are being notes and fed up the chain.

Someone in BA - worrying if it the DPO - doesn't understand what GDPR is about.

Arctic Troll

To be fair, just because you've answered the phone belonging to the account holder it doesn't actually mean you are the account holder.

I work in debt advice and have to go through this every time I ring someone, becuase of the potential consequences of divulging debt problem information to the wrong person. It is a faff, but there we are.

I certainly wouldn't send that information by email. My organisation will only send that sort of information by email where we can encrypt it, either the email itself or by sending an encrypted PDF document as an attachment.

fransknorge

OT/
Who does ? Seriously there are far more poor implementation showing more or less clear misunderstanding that correct ones. Notwithstanding the one not respecting with (hello Internet Brands) or without intent.

MrSimonR

You need to understand much about GDPR, to know it's about ensuring personal data is kept secure. Asking for you to disclose all your personal data relating to your BAEC in an email "because of GDPR" is not only ignorant, it's irresponsible too.