Marriott to be slapped with multi-million pound UK fine for data breach
Hotel chain Marriott is facing a fine of £99.2 million from the UK’s data privacy regulator for a data breach five years ago.
The breach in 2014 resulted in about 339 million guests having their personal details exposed.
It was only discovered in 2018, and now the Information Commissioner’s Office is planning to fine US-based Marriott International.
The news comes a day after the ICO said it planned to fine British Airways £183 million for an unrelated data breach. BA says it will appeal the ruling.
The ICO, which polices data protection in the UK, has greater powers to fine companies as a result of the EU’s General Data Protection Regulation (GDPR), which came into force last year.
The Marriott data breach, which affected customers of its Starwood brand, is believed to be the largest of its kind.
The company is also facing lawsuits filed in its home state of Maryland and elsewhere.
The ICO said that of the customers affected by its data breach, around 30 million were residents of 31 countries in the European conomic Area. Seven million were UK residents.
It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014.
Marriott subsequently acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018.
The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.
Information Commissioner Elizabeth Denham said: "The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.
"Personal data has a real value so organisations have a legal duty to ensure its security, just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public."
Marriott has co-operated with the ICO investigation and has made improvements to its security arrangements since these events came to light. The company will now have an opportunity to make representations to the ICO as to the proposed findings and sanction.
The ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR ‘one stop shop’ provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO’s findings.
The ICO said it will consider carefully the representations made by the company and the other concerned data protection authorities before it takes its final decision.
Linsey McNeill
Editor Linsey McNeill has been writing about travel for more than three decades. Bylines include The Times, Telegraph, Observer, Guardian and Which? plus the South China Morning Post. She also shares insider tips on thetraveljournalist.co.uk
Vegas’s Billion-Dollar Secrets – What They Don’t Want Tourists to Know
Visit Florida’s New CEO Bryan Griffin Shares His Vision for State Tourism with Graham
Chicago’s Tourism Renaissance: Graham Interviews Kristin Reynolds of Choose Chicago
Graham Talks with Cassandra McCauley of MMGY NextFactor About the Latest Industry Research
Destination International’s Andreas Weissenborn: Research, Advocacy, and Destination Impact
Graham and Don Welsh Discuss the Success of Destinations International’s Annual Conference
Graham and CEO Andre Kiwitz on Ventura Travel’s UK Move and Recruitment for the Role
Brett Laiken and Graham Discuss Florida’s Tourism Momentum and Global Appeal
Graham and Elliot Ferguson on Positioning DC as a Cultural and Inclusive Global Destination
Graham Talks to Fraser Last About His England-to-Ireland Trek for Mental Health Awareness
Kathy Nelson Tells Graham About the Honour of Hosting the World Cup and Kansas City’s Future
Graham McKenzie on Sir Richie Richardson’s Dual Passion for Golf and His Homeland, Antigua
ADS PRO 
Phocuswright reveals the world's largest travel markets in volume in 2025
Higher departure tax and visa cost, e-arrival card: Japan unleashes the fiscal weapon against tourists
Cyclone in Sri Lanka had limited effect on tourism in contrary to media reports
Singapore to forbid entry to undesirable travelers with new no-boarding directive
Euromonitor International unveils world’s top 100 city destinations for 2025