British Airways-owner IAG is facing a record $230m (€205m) fine for the theft of data from 500,000 customers from its website last year under tough new data-protection rules policed by the UK’s Information Commissioner’s Office (ICO).