Mustafa al-Bassam, a former member of Anonymous and now a doctoral researcher in the UK, said in his letter to the airline that he had not consented for his information to be shared in this manner, adding that it appeared to be a violation of an article of the European Union's General Data Protection Regulation.
This article says, "where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data" and "the data subject shall have the right to withdraw his or her consent at any time", he pointed out.
He wrote that he was attaching some network logs from the Chrome Web developer console as evidence of his claim.
They irony to all of this by the way, is that this is in relation to my flight to Barcelona for Privacy Enhancing Technologies Symposium. https://t.co/mRb80OMLr1— Mustafa Al-Bassam (@musalbas) 17 July 2018
"I do not recall being requested for consent for you to share my data with third parties in a clearly distinguishable way."
He posed three questions to BA:
- Why did you not explicitly ask for my consent to share my data, in a clearly distinguishable way?
- How do I exercise my right to opt-out from consenting for you to share my data with third parties for advertising purposes, in accordance with GDPR?
- How will you remedy or compensate customers who have had their privacy rights violated because you have not explicitly asked for their consent?
Bassam said that under article 15 of the GDPR and UK Data Protection Act, he was exercising his right to request all the data the airline held about him and a list of the recipients to whom his personal data had been, or would be, disclosed.
He gave the airline a month to respond. "I understand that before reporting my concern to the Information Commissioner’s Office I should give you the chance to deal with it," he wrote. "If, when I receive your response, I would still like to report my concern to the ICO, I will give them a copy of it to consider."
Contacted for comment, British Airways responded: "We are transparent with customers about our cookie terms and conditions, and always ask them to review the details before choosing whether to accept or opt out."