British Airways, GDPR and data breaches