The international hotel group Marriott is to be fined almost £100m by the Information Commissioner’s Office after hackers stole the records of 339 million guests.
In November, Marriott International, the parent company of hotel chains including W, Westin, Le Méridien and Sheraton, admitted that personal data including credit card details, passport numbers and dates of birth had been stolen in a colossal global hack of guest records.
It is the second time in two days the ICO has flexed its muscle to impose huge fines using extensive powers relating to breaches under the General Data Protection Regulation (GDPR). On Monday, British Airways received a £183m fine after a hack involving personal data of half a million of the airline’s customers, the ICO’s first GDPR fine.
The ICO, which is proposing a £99.2m fine for Marriott, said that about 30 million of the hacked guest records related to residents of 31 countries in the European Economic Area. Seven million related to UK residents.
Marriott said it would appeal against the fine.
After an investigation the ICO said the issue appeared to begin when the systems of the Starwood hotels group were compromised in 2014. Marriott acquired Starwood in 2016, although the theft of customer information was not discovered until last year.
The ICO said Marriott had failed to undertake sufficient due diligence when it acquired Starwood and should have done more to make sure its IT systems were secure.
“The GDPR makes it clear that organisations must be accountable for the personal data they hold,” said Elizabeth Denham, the information commissioner. “This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but how it is protected.”
In a statement the company said it intended to respond and vigorously defend its position.
“We are disappointed with this notice of intent from the ICO, which we will contest,” said Arne Sorenson, the president and chief executive of Marriott International. “We deeply regret this incident happened. We take the privacy and security of guest information very seriously and continue to work hard to meet the standard of excellence that our guests expect from Marriott.”
Marriott said the Starwood guest reservation database that was the subject of the hack was no longer used for business operations.
The ICO can seek a fine of up to 4% of a company’s global annual revenue for a breach under the GDPR. This is a significant increase on the maximum fine of up to £500,000 it could levy under the UK’s previous data protection regime.
