0370 270 6000

Marriott International: a look behind the ICO’s £99m fine and what this means for corporate acquisitions

5 August 2019

Last month, the Information Commissioner’s Office (ICO) announced notice of its intention to fine (NOI) Marriott International, Inc. £99m for infringements of the GDPR. This was the second NOI in as many days, following hot on the heels of the NOI issued to British Airways for an eye-watering £183m.

Marriott notified the ICO of a cyber incident it discovered in November 2018. Personal data, including names, addresses, passport numbers and encrypted payment card numbers contained in approximately 339 million guest records globally, were exposed by the incident. This is a classic data breach and the proposed fine is dwarfed by the BA fine, but what is of particular interest here is that Marriott inherited this breach as a result of a corporate acquisition.

The ICO has stated its belief that the vulnerability began in 2014, when the IT systems of Starwood Hotels and Resorts Worldwide LLC, a subsidiary of Marriott, were compromised. Marriott did not acquire Starwood until 2016, but the ICO did not see this as a mitigating factor. In fact, the ICO specified that Marriott had failed to undertake sufficient due diligence on Starwood at the time of the acquisition, with Information Commissioner Elizabeth Denham stating:

“The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition.”

Marriott will make representations to the ICO in an effort to reduce the fine. The ICO will also take into consideration any representations from its equivalent bodies in the other affected countries of the EEA.

Whatever the final outcome, it is clear that the ICO is unlikely to excuse businesses that have inherited an existing data breach through a corporate acquisition, meaning the importance data protection due diligence (in the form of both legal due diligence and technical IT due diligence) when acquiring businesses cannot be overstated. If your business is buying a company, the scope of the due diligence exercise should be clearly defined at the outset, taking into account the nature of the target business and the likely risks it will face from a data protection perspective. Purchasers need to adopt a robust attitude throughout the due diligence exercise, seeking contractual protection in the acquisition documents following that diligence, and ensuring that all ‘post-Completion’ resolutions are actioned and completed as soon as possible following completion of the transaction.

Related opinions

Logistics firm fined for multiple failings leading to asbestos exposure

Logistics company Eddie Stobart has been fined £133,000, after a series of failures which took place whilst excavation work was carried out, exposing its staff to asbestos.

View blog

The Future of Mediation

In an effort to build a stronger justice system, a shift in priorities has emerged away from adversarial court battles and more towards opportunities for consensual resolution. As one of the most popular forms of Alternative Dispute Resolution (ADR), mediation has become increasingly encouraged.

View blog

Dont look down

An engineering company in Tyne and Wear was fined £20,000 after a worker fractured his pelvis and suffered internal injuries after falling through a petrol station forecourt canopy, whilst he was replacing the guttering.

View blog

Directors fined for unsafe removal of asbestos

Two directors of a construction company were fined after failing to ensure the safe removal of asbestos from a plot of land. On 14 and 15 November 2021, Directors Anthony Sumner and Neil Brown, of Waterbarn Limited were involved in the uncontrolled removal of asbestos material from a plot of land in Grasscroft, Oldham.

View blog

Mailing list sign up

Select which mailings you would like to receive from us.

Sign up