Does data privacy equal no common sense?
Aug 18, 2022, 1:07 pm
#32
Join Date: Mar 2017
Posts: 726
"Hey BA, your multicity booking tool is broken, it only displays 6 flights a day, can you fix it?" - BA's reply on twitter? "Please provide us with your full name, email, address, exec club number, your next flight and passport number, so we can investigate" - what they need it for? bug is affecting anyone trying to book a flight.
I had this with my bank. Their website wasn't working and showed a phone number to ring to report the problem. I rang the number, they started asking me all these questions so I hung up.
Aug 18, 2022, 3:30 pm
#33
Original Poster
Join Date: Apr 2007
Location: Anywhere
Posts: 6,576
Me: We just spoke. Can you see the email address of my Exec Club account?
Agent: Yes.
Me: That was supposed to be on my PNR. You had typed it incorrectly by two letters. It needs to be corrected, else emails from BA regarding this booking won’t reach me.
Agent: Yes, I’m sorry for that.
Me: Please correct it.
Agent: Give me your BAEC number, name, email address, physical address, credit card last 4 digits and expiry date….
Faceslam.
Aug 18, 2022, 4:32 pm
#34
FlyerTalk Evangelist
Join Date: Jun 2004
Location: LON, ACK, BOS..... (Not necessarily in that order)
Programs: **Mucci Diamond Hairbrush** - compared to that nothing else matters (+BA Bronze)
Posts: 15,130
But surely, if someone audits the call, the agent could “link” the current conversation to a previous one, furthermore it would’ve been obvious from the conversation itself that it’s a continuation of a conversation between the same people within a short space of time.
It’s just company policy so that we don’t inadvertently reveal anything we shouldn’t to the wrong people. Frustrating, yes but keeping us GDPR compliant, also yes.
Last edited by Jimmie76; Aug 18, 2022 at 4:37 pm
Aug 19, 2022, 12:09 am
#35
Join Date: May 2018
Location: Tokyo
Programs: Bonvoy LT Titanium ANA Diamond
Posts: 763
The think here is that the OP is looking at this from a customer viewpoint, however the policy is in place not to protect his data, as much as to
protect the company, in this case BA, from penalty if there is a security breach, in other words its CYA, and it will only get worse, not better.
protect the company, in this case BA, from penalty if there is a security breach, in other words its CYA, and it will only get worse, not better.
Aug 19, 2022, 12:32 am
#36
Join Date: Jan 2022
Programs: BAEC
Posts: 1,472
You can ask a general question without clearing data protection, but then the answer is only a general answer. Its usually better to pass DPA so the agent can discuss your Exec Club account or booking.
The more information given and that can be discussed, the more accurate the answer.
The more information given and that can be discussed, the more accurate the answer.
Aug 19, 2022, 12:36 am
#37
Join Date: Oct 2014
Location: Krakow
Programs: BAEC Silver, Miles and More(FTL), IHG(Platinum), Accor, HHonors(Diamond), SPG, Hertz Five Star
Posts: 5,921
.
How long after the 1st call is it acceptable to say the agent 'recognised the caller' and avoid the checks? 1 hour? 6 hours? A day? A week?
sorry but this would not be an acceptable, auditable, working practice.
I have run a call centre
Aug 19, 2022, 12:45 am
#38
Join Date: May 2014
Posts: 7,237
Another case of damned if you do, damned if you don’t.
The policy is there - as is the big investment in PCI compliance the airline is doing - as a result of the data breach, when BA was found with its metaphorical trousers lowered and customers suffered. A few fines, court cases and brand damage later they are learning how to avoid this in the future. As somebody who had his card data stolen and managed to prevent my life’s savings from being nicked just by sheer accident I’m grateful for having to waste a few seconds of my life in order to avoid a repeat of that experience.
Frankly this whole thread reminds me of one day in Iceland. I was flying what was then called Air Iceland, the little prop planes, to Isfjordur in Westfjords. Weather was rather flatulent over there and so we were delayed while it got to the point when the plane could at least land sideways. All of the passengers just drank coffee and waited it out but for one Brit, the kind of man who has a high-pitched nasal voice and begins every complaining sentence with a “Surely…” that could wake up cats. He goes to the gate to moan about the delay, and the activities they have booked, and supper at some restaurant and how the delay is inconveniencing them. The gate agent just shot him down with the best Icelandic deadpan: “do you want to crash and die when you come in to land? If not, wait”.
The policy is there - as is the big investment in PCI compliance the airline is doing - as a result of the data breach, when BA was found with its metaphorical trousers lowered and customers suffered. A few fines, court cases and brand damage later they are learning how to avoid this in the future. As somebody who had his card data stolen and managed to prevent my life’s savings from being nicked just by sheer accident I’m grateful for having to waste a few seconds of my life in order to avoid a repeat of that experience.
Frankly this whole thread reminds me of one day in Iceland. I was flying what was then called Air Iceland, the little prop planes, to Isfjordur in Westfjords. Weather was rather flatulent over there and so we were delayed while it got to the point when the plane could at least land sideways. All of the passengers just drank coffee and waited it out but for one Brit, the kind of man who has a high-pitched nasal voice and begins every complaining sentence with a “Surely…” that could wake up cats. He goes to the gate to moan about the delay, and the activities they have booked, and supper at some restaurant and how the delay is inconveniencing them. The gate agent just shot him down with the best Icelandic deadpan: “do you want to crash and die when you come in to land? If not, wait”.
Aug 19, 2022, 3:39 am
#39
Join Date: Jul 2014
Location: WAW ✈ LHR ✈ GLA
Programs: BA GfL/GGL/CCR, HH Diamond, IHG Diamond Ambassador
Posts: 2,501
Then we have another issue - BA asking me to provide personal information in every email I sent them - email is (still) sent in plain text over the internet - it may be securely encrypted on my server, and securely encrypted on BA's server, but it travels unencrypted through the network of servers who can collect/retain copy of my personal information - this is in direct violation of GDPR.
Then they ask you for all personal information on twitter/facebook/instagram - these are platforms BA does not own, some of them allow users to have a really poor security setup with weak passwords and no 2FA - so BA asking too much personal details is basically putting customers at risk.
In all above cases - why I can't authenticate my twitter account with BA so when I talk to BA they see my account as linked to my BA account? so then I can ask/exchange minimal information required to get issues solved? why do they have to ask for personal information every single time? can't they scroll up? if I can scroll up and see them, anyone who has access to my account can.
As someone mentioned above - BA protects their own business by putting their customer's data at risk.
My accountant required me to verify my email once, then I can email them back/forth with questions - they don't ask for my personal details, they trust my email came from me. I know you can spoof my email, but spoofed email won't get reply - it will come to me. Far less damage than having all my personal information at hand with BA email/twitter account.
Aug 19, 2022, 8:47 am
#41
Join Date: Oct 2014
Location: Krakow
Programs: BAEC Silver, Miles and More(FTL), IHG(Platinum), Accor, HHonors(Diamond), SPG, Hertz Five Star
Posts: 5,921
twice!! And the 2nd tine quick enough after the 1st that the agent could remember him
Aug 19, 2022, 4:36 pm
#42
Original Poster
Join Date: Apr 2007
Location: Anywhere
Posts: 6,576