How Cathay Pacific narrowly escaped a potentially financially crippling privacy fine. What are the lessons learned?