Between Aug. 21 and Sept. 5, thousands of British Airways customers who used a credit or debit card to make a reward flight booking had their personal and payment card's information hacked, the airline announced.

By Oct. 26, British Airways declared that fewer payment cards than originally announced were impacted, skimming the total to 244,000 from 380,000. But for some customers, information stolen included their name, billing and email addresses and their debit and credit cards' number, expiration date and CVV security code. 

The Information Commissioner's Office, the United Kingdom's regulator charged with fining organizations that don't process personal data properly, said its investigation into the cyberattack was ongoing.

Such an investigation poses questions over whether the airline will face penalties under the EU's new General Data Protection Regulation. But lawyers contacted by Legaltech News, who were following press reports regarding the cyberattack, said it wasn't entirely clear if British Airways could face fines or what the regulators' investigation would find.

The GDPR went into effect May 25, roughly three months before British Airways said its customers' information was hacked. The maximum fine issued under the GDPR is 4 percent of a company's global revenue or 20 million euros, whichever is higher. While British Airways could possibly face these stiff fines, lawyers cautioned that a breach doesn't instantaneously incur a penalty.

“Just because they suffered a breach doesn't automatically mean you suffer from penalties,” said Sandra Jeskie of Philadelphia's Duane Morris office. Jeskie explained there are factors taken into consideration when deciding to levy GDPR fines including the nature, gravity and duration of the incident. Regulators also assess how the business processes personal information and respond to the attack, she said.

Emily Carter of Kingsley Napley's London office said if British Airways had efficient and appropriate security in place, it may not be hit with fines, but the Information Commissioner's Office would still investigate if the airline was in compliance with the GDPR.

“The information commissioner would no doubt look into if other provisions of the GDPR were not complied with, such as maintaining proper records and ensuring appropriate contracts were in place with third-party processors.”

James Koenig, who co-chairs Fenwick & West's privacy and cybersecurity practice, said that while it wasn't yet clear how stringently the 6-month-old GDPR would be enforced, regulators may be influenced by public outcries.

“If a lot of people [are] impacted or especially if people are upset, they lost money or there was fraud, regulators listen to that,” he said. Koenig added that companies are watching with bated breath how the GDPR will be enforced.

“I think that many companies that have GDPR contacts are holding their breath, waiting to see how conservative or liberal this data protection regulations will be,” he said.

Although the GDPR hasn't been in effect for very long, Steve Bunnell, the former chief of the U.S. Attorney's Office's Criminal Division and current O'Melveny & Myers partner, said regulators may be looking for cases that are high profile.

“One of the things you look for is an opportunity to show people that you are serious,” said Bunnell. “You look at something that is high profile, something to make a statement,” if they have the merits and facts.