I'm not too bothered by the number, but am worried that a company will be able to talk their way out of punishment through misinformation. You only need to loo

I'm not too bothered by the number, but am worried that a company will be able to talk their way out of punishment through misinformation. You only need to look at the latest Zoom vulnerability, and the Panera Bread data leak to see how companies will happily tell its users that everything is fine, while doing absolutely nothing to publicly resolve the issues being raised. To make things worse, a lot of people will blindly believe this, or take their side to be contrarian. As you've rightly said, regulation needs to change corporate behaviour, and while a hefty fine will do that, it's also a minor risk to a firms ongoing reputation. It's a cost that can be offset elsewhere - more than likely onto the customer. I would rather the fine be halved or even quartered, if it meant that BA had to publicly accept full responsibility, and to push for independent auditing of all of their software.