THE Marriott International Hotel chain will be fined £99million after a cyber security breach that left millions of customers’ details exposed.
The cyber incident, which was reported to the Information Commissioner’s Office in November 2018, affected 7 million UK residents and 44 million people in the European Economic Area.
The hotel giant revealed there had been “unauthorised access” to a network containing up to 500m of its guests’ information – including passport details and credit card numbers.
The information included some combination of name, mailing address, phone number, email address, passport number, date of birth and other personal details.
Under GDPR, companies must be careful to protect consumer data or risk facing hefty fines.
Marriott’s troubles are thought to have begun when the chain acquired Starwood Hotels in 2016.
Starwood had been compromised in 2014, but the breach wasn’t discovered until after Marriott International bought the group.
The regulator’s investigation decided that Marriott had not done its due diligence when it purchased Starwood Hotels and that it should have done more to secure the systems.
Marriott has co-operated with the ICO investigation and has made improvements to its security arrangements since these events came to light.
HERE's how to stay safe online.
The company is now able to appeal the fine, and make representations to the ICO on the proposed findings and sanction.
If the ICO does decide to fine £99million it will be the largest fine to date under the new GDPR rulings.
The regulator said it “will consider carefully the representations made by the company and the other concerned data protection authorities before it takes its final decision”.
Any fines are paid into the Treasury’s Consolidated Fund and are not kept by ICO.
This is the government’s main bank account where things like taxes are paid into.
Unfortunately, the ICO’s ruling does not mean any redress for consumers who’s details have been exposed.
But it is possible to try and get compensation for breaches.
You may have to show that the theft of your data has caused you “distress or inconvenience.”
The claims procedure can begin once Marriott has been held responsible for the breach by the ICO and the appeal process has ended.
The airline has 28 days to appeal today’s decision.
Information Commissioner Elizabeth Denham said: GDPR makes it clear that organisations must be accountable for the personal data they hold.
“This can include carrying out proper due diligence when making a corporate acquisition.
“Personal data has a real value so organisations have a legal duty to ensure its security, just like they would do with any other asset.
“If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”
How British Airways customers can apply for compensation and protect themselves from fraud after airline exposed 400,000 card details.
Scam alert – Fraudsters con people out of thousands with FAKE GDPR emails.
Warning for Npower customers as energy giant exposes details of 5,000 customers in letters.
