Your privacy is important to us.
The data breach in question arose from a cyberattack in 2014 on Starwood, a business acquired by Marriott. 339 million guest records globally were impacted and 7 million records related to data subjects in the UK. The attacker gained access to a wide range of information, including names, email addresses, phone numbers, passport numbers, arrival and departure information, and VIP status and loyalty program information. Marriott became aware of the breach in September 2018 and made a breach notification to the ICO in November 2018.
The ICO announced a fine against Marriott International Inc of £18.4million on 30 October 2020. Whilst it is still a very significant fine, it was a substantial reduction from the original proposed fine of £99.2million announced by the ICO in its notice of intent in July 2019. The fine reduction was expected though in light of the ICO’s similar fine reduction against British Airways from £183.39million to £20million. The ICO highlighted that the fine related only to the period from 25 May 2018 when GDPR came in to force and that Marriott had acted promptly once it discovered the breach.
The ICO found that Marriott failed to process personal data in a manner that ensured appropriate security of the personal data as required by Article 5 and Article 32 GDPR. The ICO identified four main security failures:
On a positive note, the ICO did not find that Marriott had breached its notification obligation under Article 33 of the GDPR, nor had it breached its Article 34 requirement to notify data subjects of the breach, but noted that Marriott had accidentally failed to include a phone number for its dedicated call centre in its email to data subjects.
An interesting point made by Marriott was that it was only able to undertake limited due diligence when acquiring Starwood. The ICO, however, gave this argument short shrift. It made the point that the fine only relates to the period from May 2018 when GDPR came into force. The ICO stated that the “need for a controller to conduct due diligence in respect of its data operations is not time-limited or a ‘one-off’ requirement” and that it is “no answer to claim that certain due diligence steps were, or only needed to be, taken in the period immediately after acquisition.”
The ICO adjusted the fine downwards and took the following mitigating factors into account:
Although the fine was significantly less than the previously announced proposed fine, it still demonstrates the impact of the ICO’s enforcement powers. For any businesses involved in acquisitions, the case also highlights the importance of undertaking proper data due diligence in corporate transactions.
This article has been produced for general information purposes and further advice should be sought from a professional advisor. Please contact our Data Protection team at Cleaver Fulton Rankin for further advice or information.