Is this a data breach or a 'feature'?

Old Apr 23, 2024, 10:44 am
  #1  
Original Poster
 
Join Date: Feb 2012
Location: London
Programs: Sir Ratechaser Seigneur de la Patience d'un Saint (Mucci), BA Silver, Starbucks Gold
Posts: 2,672
Is this a data breach or a 'feature'?

Bit annoyed... just made a booking for me and Mrs RC, upgraded the flights and was going to make it a surprise. I'm lead booker and paid, but it seems that the email e-ticket receipt - with all details, went to her contact email as well as to me. Presumably because I added her EC number with her name in the initial booking. And no, my own profile isn't corrupted - all bookings I make just for me, are emailed only to me. So that's the surprise gone.

I'd have thought that BA shouldn't be sharing PNR, price, amount paid to date etc info with anyone other than the lead booker/person that actually paid. But here we are. I may be making more of a mountain out of this molehill right now as I'm feeling rather narked about it, so any advice/feedback here is appreciated.

thx
RC
ratechaser is offline  
Old Apr 23, 2024, 10:58 am
  #2  
 
Join Date: Mar 2014
Location: London, UK
Programs: BAEC
Posts: 2,512
Originally Posted by ratechaser
Bit annoyed... just made a booking for me and Mrs RC, upgraded the flights and was going to make it a surprise. I'm lead booker and paid, but it seems that the email e-ticket receipt - with all details, went to her contact email as well as to me. Presumably because I added her EC number with her name in the initial booking. And no, my own profile isn't corrupted - all bookings I make just for me, are emailed only to me. So that's the surprise gone.

I'd have thought that BA shouldn't be sharing PNR, price, amount paid to date etc info with anyone other than the lead booker/person that actually paid. But here we are. I may be making more of a mountain out of this molehill right now as I'm feeling rather narked about it, so any advice/feedback here is appreciated.

thx
RC
Never add the other passengers BAEC number to surprise bookings
KARFA, wrp96, AJA_ and 3 others like this.
TabTraveller is online now  
Old Apr 23, 2024, 10:58 am
  #3  
FlyerTalk Evangelist
 
Join Date: Oct 1999
Location: Juneau, Alaska.
Programs: AS 75K;BA Silver;AA G;HH Dia;HY Glob
Posts: 15,907
I think the general advice when booking a surprise for someone else is to not include their BAEC number when booking.

This is not an uncommon occurrence.

Did you UuA? Are you and the missus in a HHA?
Lefly and marconess like this.
jerry a. laska is offline  
Old Apr 23, 2024, 11:00 am
  #4  
Ambassador, British Airways Executive Club
 
Join Date: Feb 2008
Location: UK
Posts: 10,242
I've certainly had over the years others in my booking but they don't get the amount paid etc even with putting their FF numbers there. With hindsight, which is a wonderful thing of course!, it may have been best not to add any FF number until shortly before the flight/whenever you thought it best to say.

I'm no GDPR expert, others will no doubt comment, but my hunch would be it's BA's IT.

Overall if I were Mrs RC I would be really delighted that you did such a thoughtful thing/meant it as a surprise (and you'll definitely be in her good books/earned a Brownie Point! )

Pete
BA or bust and flygirl68 like this.
PETER01 is offline  
Old Apr 23, 2024, 11:03 am
  #5  
 
Join Date: May 2014
Location: BRU
Programs: BA GGL, TK E (*G), ITA exec
Posts: 4,219
Originally Posted by ratechaser
Bit annoyed... just made a booking for me and Mrs RC, upgraded the flights and was going to make it a surprise. I'm lead booker and paid, but it seems that the email e-ticket receipt - with all details, went to her contact email as well as to me. Presumably because I added her EC number with her name in the initial booking. And no, my own profile isn't corrupted - all bookings I make just for me, are emailed only to me. So that's the surprise gone.

I'd have thought that BA shouldn't be sharing PNR, price, amount paid to date etc info with anyone other than the lead booker/person that actually paid. But here we are. I may be making more of a mountain out of this molehill right now as I'm feeling rather narked about it, so any advice/feedback here is appreciated.

thx
RC
Unfortunately I think it's a standard. Everyone in the booking with a BAEC account usually receives a copy of the ticket/receipt. I even recall a time when the receipt went to one of my kids email instead of mine...
The only thing you can do in event of planned surprises is to not add any BAEC number aside yours.

I have no information about privacy law or policies in UK, but considering that a ticket, even if paid by someone else, in the end is owned only by the travelling passenger, I can see why BA shares details with all the people named on the booking.
Lefly is offline  
Old Apr 23, 2024, 11:10 am
  #6  
Original Poster
 
Join Date: Feb 2012
Location: London
Programs: Sir Ratechaser Seigneur de la Patience d'un Saint (Mucci), BA Silver, Starbucks Gold
Posts: 2,672
Originally Posted by jerry a. laska
I think the general advice when booking a surprise for someone else is to not include their BAEC number when booking.

This is not an uncommon occurrence.

Did you UuA? Are you and the missus in a HHA?
Indeed, and many thanks to everyone for the 'hindsight' comments, I guess I need a trip to specsavers...

We are in a HHA but it was a pure cash booking - I see where you are going in terms of her needing to know if her Avios were being used. Not the case here though.

I'm sure she will be thrilled, although perhaps less at my profligacy. It's for the same reason I don't get email receipts from her hairdresser. All absolutely fine, I just don't want to know how much...

I guess the question remains though, would this legally be considered a breach of personal data? In my own industry, it would be treated seriously if I sent financial or other personal data to someone other than the account holder themselves.

And to forestall the boomerang question of 'what outcome would I want from any complaint' - not compo, god no, let's nip that one in the bud. I'd want them to say that they were wrong, and that it wouldn't happen again. Which of course is a pipe dream...
scoonee likes this.
ratechaser is offline  
Old Apr 23, 2024, 11:16 am
  #7  
 
Join Date: Jan 2018
Location: Glasgow, UK
Programs: BA Gold
Posts: 676
Originally Posted by ratechaser
I guess the question remains though, would this legally be considered a breach of personal data?
Whose personal data? Yours, or your wifes?
GM1985 is offline  
Old Apr 23, 2024, 11:20 am
  #8  
Ambassador, British Airways; FlyerTalk Posting Legend
 
Join Date: Apr 2012
Location: Leeds, UK
Programs: BA GGL/CCR, GfL, HH Diamond
Posts: 43,466
Whilst understanding the desire to provide a surprise, I am not clear why sending an email to your wife about a booking she is on with you could be considered as a breach of GDPR? Presumably she also received and email when it was originally booked prior to your recent upgrade?

One might even argue that BA has a duty to send an email to a passenger whose booking has been changed.
KeaneJohn and GM1985 like this.
KARFA is online now  
Old Apr 23, 2024, 11:27 am
  #9  
Original Poster
 
Join Date: Feb 2012
Location: London
Programs: Sir Ratechaser Seigneur de la Patience d'un Saint (Mucci), BA Silver, Starbucks Gold
Posts: 2,672
Originally Posted by KARFA
Whilst understanding the desire to provide a surprise, I am not clear why sending an email to your wife about a booking she is on with you could be considered as a breach of GDPR? Presumably she also received and email when it was originally booked prior to your recent upgrade?

One might even argue that BA has a duty to send an email to a passenger whose booking has been changed.
My OP may have had a poor choice of words, in that this was the initial booking - we would normally fly ET, but I decided to go CE instead (so an 'upgrade' to our norm...).

But that last part is the key one. It's my financial transaction, but one that does benefit someone else. Where does GDPR fall on this, in terms of 1) the need to notify that she is the beneficiary of a service, and if that is the case 2) the amount of money paid by someone else for that service.

My instinctive parallel here is that you order a present for someone and include their contact details for delivery. Should the company that is supplying the gift let that person know in advance what they were going to receive, and also how much it cost? I'm guessing not.

Of course there's also the small point that there is enough detail in the email (PNR/name) to be able to cancel the booking and incur cancellation costs, despite not having paid for anything in the first place. Clearly not a practical issue here, but one that could have actual consequences if someone on a group booking was feeling naughty...

Last edited by ratechaser; Apr 23, 2024 at 11:33 am
ratechaser is offline  
Old Apr 23, 2024, 11:29 am
  #10  
Ambassador, British Airways; FlyerTalk Posting Legend
 
Join Date: Apr 2012
Location: Leeds, UK
Programs: BA GGL/CCR, GfL, HH Diamond
Posts: 43,466
You think you should be allowed to make changes to a passenger on a booking and for them not to be notified in any way?

Edit: I dont see cost being personal data btw.

i think you are a bit frustrated in having your surprise spoiled, perfectly understandable. But I dont think trying to blame ba or contrive some data breach argument is a way out here.
MaxFlyer and marconess like this.
KARFA is online now  
Old Apr 23, 2024, 11:43 am
  #11  
Original Poster
 
Join Date: Feb 2012
Location: London
Programs: Sir Ratechaser Seigneur de la Patience d'un Saint (Mucci), BA Silver, Starbucks Gold
Posts: 2,672
Originally Posted by KARFA
You think you should be allowed to make changes to a passenger on a booking and for them not to be notified in any way?

Edit: I don’t see cost being personal data btw.

i think you are a bit frustrated in having your surprise spoiled, perfectly understandable. But I don’t think trying to blame ba or contrive some data breach argument is a way out here.
I'm certainly a bit frustrated, but I'm also unconvinced that this is just how things should work - possibly my view is coloured from working in a highly regulated industry where sharing any financial transaction information outside of the person that made it would be a huge no-no. Even more of a no-no would be providing details that allowed another party to access and modify a transaction (back to my PNR/Surname point). If that's more a consequence of financial services regulations than of GDPR then I will stand corrected but it just sounds... iffy.

And I'm sure that Mrs RC would be equally annoyed if the details of certain things she buys were shared with me. It's not a question of trust, it's just that sometimes ignorance is bliss!
ratechaser is offline  
Old Apr 23, 2024, 11:43 am
  #12  
 
Join Date: Jan 2018
Location: Glasgow, UK
Programs: BA Gold
Posts: 676
Originally Posted by ratechaser
But that last part is the key one. It's my financial transaction, but one that does benefit someone else. Where does GDPR fall on this, in terms of 1) the need to notify that she is the beneficiary of a service, and if that is the case 2) the amount of money paid by someone else for that service.

My instinctive parallel here is that you order a present for someone and include their contact details for delivery. Should the company that is supplying the gift let that person know in advance what they were going to receive, and also how much it cost? I'm guessing not.
But to extend your analogy, under your logic I wouldnt be entitled to notifications on around half of my tickets, which were paid for by my employer. Id only be entitled to receive confirmations/notifications for my own personally funded travel. Which doesnt seem tenable.

During booking, you provided your wifes BAEC details which includes her personal data and contact details. Its not about your financial transaction. Id argue the email was about her reservation/ticket. And the fact that individual contact details were provided for each passenger suggests that BA should contact each passenger individually. As others have said, the workaround in these situations is to not provide contact details or BAEC info for the surprise recipient.

Its unfortunate this didnt work out as you had hoped. But lesson learned. And hopefully the cat getting out of the bag early doesnt spoil the trip!
MaxFlyer, Sprodo and wrp96 like this.
GM1985 is offline  
Old Apr 23, 2024, 12:16 pm
  #13  
 
Join Date: Feb 2005
Location: London
Programs: BA Gold
Posts: 318
Originally Posted by Lefly
Unfortunately I think it's a standard. Everyone in the booking with a BAEC account usually receives a copy of the ticket/receipt. I even recall a time when the receipt went to one of my kids email instead of mine...
The only thing you can do in event of planned surprises is to not add any BAEC number aside yours.

I have no information about privacy law or policies in UK, but considering that a ticket, even if paid by someone else, in the end is owned only by the travelling passenger, I can see why BA shares details with all the people named on the booking.
(my bold)

I've been booking tickets for the family, all in the household account, I've never once seen an email go to the others in the booking.
Just booked one flight yesterday for all of us. Only I got the email. Same as always.

The others have their own email addresses in their profiles.

So, either BA IT is buggered or only the lead booker gets an email.
mrandery is offline  
Old Apr 23, 2024, 12:41 pm
  #14  
Original Poster
 
Join Date: Feb 2012
Location: London
Programs: Sir Ratechaser Seigneur de la Patience d'un Saint (Mucci), BA Silver, Starbucks Gold
Posts: 2,672
Originally Posted by mrandery
(my bold)

I've been booking tickets for the family, all in the household account, I've never once seen an email go to the others in the booking.
Just booked one flight yesterday for all of us. Only I got the email. Same as always.

The others have their own email addresses in their profiles.

So, either BA IT is buggered or only the lead booker gets an email.
Well on that last point, the bookies aren't taking bets any more

Just so I know we're comparing apples with apples here, do your bookings always include the others BAEC numbers from the start?

Anyway, Mrs RC was happy as expected, so this is certainly not an emotionally driven rant now, but at a minimum, I am very uneasy with the principle of BA handing out details of a booking I've paid for, to someone else that could play around with/mess up/totally balls up either through incompetence or malice.

Certainly something to consider if making a group booking for people you are not that closely connected to...
ratechaser is offline  
Old Apr 23, 2024, 12:45 pm
  #15  
 
Join Date: Feb 2005
Location: London
Programs: BA Gold
Posts: 318
Originally Posted by ratechaser
..

Just so I know we're comparing apples with apples here, do your bookings always include the others BAEC numbers from the start?

...
Yes. They're in the household account and I pick their names from the drop down when it comes to entering names of the other pax. And they can see the booking in their account / app immediately.
mrandery is offline  

Thread Tools
Search this Thread

Contact Us - Manage Preferences Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service -

This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.