In calculating the fine, ICO took into account British Airways' representations in response to the original Notice of Intention to fine and additional technical information that British Airways submitted, together with the factors listed in Article 83(2) of the GDPR, which include the nature, gravity and duration of the infringement, the number of data subjects affected and the damage to them, and steps taken to mitigate the impact of the incident. Mitigating factors included the fact that British Airways (i) did not gain any financial benefit from the breach, (ii) notified ICO promptly on becoming aware of it, (iii) had no relevant previous infringements and (iv) offered to compensate individuals for financial loss suffered as a direct result of the theft of their card details.