ScienceTeacher

Hi all,

Looking for some help and wisdom into a situation BA has placed me in.

At the start of October I was contacted by a stranger via. email and text message. He told me for the last year he has been receiving emails from BA meant for me that range from the standard booking confirmation type to the more back and forth type. After a brief discussion, we came to the conclusion he has been receiving every email I have been from BA. I therefore telephoned BA and had the case forwarded to the "Compliance Team".

After a week, I received a call from Customer Relations that stated:
- They found the cause: a member of staff copied and pasted the wrong email address into my executive club account.
- This email has acted as an alias and thus every email has gone to both emails.
- The incorrect email has been removed.

Two weeks hence, and again the issue is not resolved. Thanks to the thread about seeing data, I requested a copy. The incorrect email address is still listed as an alias.

I've telephoned again, this time with a view of three things:
1) Getting the email address removed.
2) A full breakdown of what data by myself has been accessed.
3) Compensation for the above.

Worryingly, I could not book flights this morning and received a generic email (as did this stranger one assumes) :
British Airways have locked down my account. After a phone call (that was hard to accomplish as the agents just see "account locked" when I phone), I received this further email from the Audit team:
I can only assume this auditor has seen the words "security" and "breach" and gone on the war path asking me to update my email address. I'm 99.9% convinced this will not fix the incorrect alias BA have placed on my account.

Further to this, I have been reached out to by Customer Relations that have stated they are "unable to offer a gesture and will not consider the matter further".

Therefore, what can I do now?
I'm stuck in a hard place with the audit team who can not remove the alias email address and insist if I create a new one it will help.
Customer Relations concede responsibility of British Airways but will offer no compensation.
My account is locked and will not be unblocked unless I create a new email (back to step one).

At the end of the day, British Airways have supplied a stranger with my travel plans and home address informing them when I am not in the house and indeed will not be in the future (if any of my bookings hold). They have accepted responsibility, found the cause but can not remove the alias email.

Am I going slightly mad here?

Thanks all!

golfmad

I would start by reporting it to the Information Commissioner's Office. Mistakes happen but BA's failure to remedy it within a reasonable timeframe is unacceptable.

DYKWIA

Sorry - but I had to laugh... They expect *you* to change your email address because they have messed up

nufnuf77

This to me sounds like a potential data breach and you should proceed by sneding a email/letter to BA DATA comptroller/data protection officer and also inform ICO. That should get the ball rolling

Often1

But,t hat's not going to get the account unlocked in any reasonable timeframe and, in fact, may simply cause BA to issue a profuse apology but to require a new email and password.

I would respond to the "audit specialist" noting that your account was not "hacked" but rather that BA has chosen to send emails to a third-party without your authority. Accordingly, changing your email and password will have no effect. Repeat the specific request that BA remove the offending email and then unlock the account.

I would expect BA to ask that you provide some form of identification in order to assure that it is not the third-party but you who is inappropriately receiving data.

tuonopepper

Absolutely this and inform BA you are doing so, they have already admitted it is their error.

ScienceTeacher

Thank you everybody for your help here.

Going to the ICO website suggests my first step is a formal complaint to British Airways. It appears the email is [email protected] . Once done, and response received a complaint through the ICO seems more apparent.

I shall do that tonight, and indeed reach back to the auditor expressing concern about the remedy and indeed ask for the removal of the incorrect email. Hopefully he will not want me to actually create a new email account with another provider (!).

No point pursuing Customer Relations just yet, is there? Telling me it is fixed when it wasn't, coupled with the auditors approach has me a tad mad!

Thanks all again.

Mixbury

You will do if you allow yourself to be egged on by the advice offered so far.

Do you have a second email address? Use that to get you account unlocked. Persist until you have the third party's email address disassociated from your account. Move on.

Have you suffered injury? Life is too short.

fruitcage

Each to their own, but this would be my approach for sure

pmarrsouth

If they have locked your account, how can you change your email address on it?

if you use gmail, then you can “change” your email address while still receiving emails to the exact same account:

[email protected] = [email protected] = [email protected] etc

you can also add in a + in your email gmail address, which somewhat accomplishes the same thing:

[email protected] = [email protected] etc

In theory, you should use a completely separate email address for every single account/website you have/access - but few would actually do this

JMorgana

Consider this: Set up a junk email somewhere, use that and a new password to unlock your account, then once your account is unlocked, change the email back to the one you want to use.

Modo

Sad but true.

Similar scenario a few years ago with BA and it would have been easier to open a new account.. Inter-departmental blame game..

Had similar propblems with The Home Office and ICO backed their failure to respoind - 2 years later HO admitted they were wrong.

Manoeuvre around and Move On...

Scares borne

ScienceTeacher

Hardly ‘egged on’. I’ve asked what I should do next and followed the advice.

I do not have a second email address I want to use. My account was locked so no more emails are sent. If I create a new email, it does not fix the issue of a third party alias on my account.

“Am I going mad here?”. I’ve asked BA to remove this three times. They’ve told me they have. They’ve told me they’re trying.


Yes.
Time wasted dealing with BA’s unacceptable incompetence at processing data.
Stress caused by a stranger contacting me out of the blew quipping how was Belfast.
Anxiety caused by the sheer fact a complete stranger knows my travel plans for the next twelve months, which, coupled with my home address isn’t great?

“Can I know when you plan to be out of the house, and for how long over the next year?”. That answer is exactly what BA have handed this stranger.

I agree I need to move on, but I’ll only do so when strangers stop receiving my personal information.

ScienceTeacher

Likely my next step to appease the auditor. Any ideas how else I can ask BA to remove the alias?

Thank you 😊

Jagboi

That doesn't solve the problem of the third party recieving all the OP's emails though. The alias is still attached to the account, no matter if the primary email is changed.

The solution is that BA needs to remove the erroneous alias address and all will be well.