It is a paradox that since law enforcement are powerless against the majority of cybercrimes due to their cross-border behaviour (long article in last weekends Sunday Times Magazine), the governments have through GDPR decided on the easier route of fining the victims instead of going after the perpetrators. Yes, BA is a victim here as well, and an easy target for some more taxes under a different name.