British Airways fined £20m over data breach