British Airways security incident garners record GDPR fine