Privacy & Information Security Law Blog

On October 30, 2020, the UK Information Commissioner’s Office (“ICO”) announced its fine of £18.4 (approximately $23.9 million) issued to Marriott International, Inc., (“Marriott”) for violations of the EU General Data Protection Regulation (“GDPR”). This is a significant decrease from the proposed fine of £99,200,396 (approximately $124 million) announced by the ICO in July 2019. The ICO’s fine only relates to the breach from the point at which the GDPR came into force in May 2018, and is the second largest fine levied by the ICO thus far under the GDPR. Marriott has not admitted liability for the breach, but has indicated that it does not plan to appeal.

The security breach suffered by Marriott, which stemmed from a 2014 cyberattack on Starwood Hotels and Resorts Worldwide Inc. (“Starwood”) (acquired by Marriott in 2016), affected an estimated 339 million guest records globally, with seven million records relating to individuals in the UK. The affected data included names, email addresses, phone numbers, passport numbers, arrival and departure information, and VIP status and loyalty program information. The unknown attacker had installed code on a device in the Starwood system and through malware gained remote access as a privileged system user. The attacker thereby gained unrestricted access to the relevant device, as well as other devices on the Starwood network to which the account had access. Login credentials were then gathered, and the database storing reservation data accessed and exported by the attacker. The attack was initially detected in September 2018, and Marriott notified the ICO and affected individuals in November 2018 after becoming fully aware of the nature of the breach.

According to the ICO, Marriott had failed to put appropriate technical and organizational measures in place to secure personal data, as required under Article 5(1)(f) and Article 32 of the GDPR. The ICO identified four principal failures: insufficient monitoring of privileged accounts that would have detected the breach; insufficient monitoring of databases; failure to implement server hardening as a preventative measure (i.e., reducing the vulnerability of the server), such as through whitelisting; and failure to encrypt certain personal data, including some passport numbers.

Marriott sought to persuade the ICO that the sophistication of the attack should have been taken into account in determining appropriate enforcement action, but the ICO rejected this, stating: “What the [a]ttack disclosed was the failure by Marriott to put in place appropriate security measures to address attacks of this kind and/or other identifiable risks to the system.” The ICO also disagreed with Marriott’s contention that Article 33 of the GDPR requires a controller to be reasonably certain that a personal data breach has occurred before notifying the ICO, commenting that a controller must be “able reasonably to conclude that it is likely a personal data breach has occurred.” The ICO concluded that Marriott had not breached its notification obligation under Article 33 of the GDPR. The ICO also did not find a breach of the Article 34 requirement to notify data subjects of the breach, but pointed to several shortcomings in Marriott’s approach, such as an accidental failure to include the phone number for its “dedicated call centre” in the email sent to data subjects.

In calculating its fine, the ICO applied the five-step process set out in its Regulatory Action Policy, establishing first that Marriott did not gain any financial benefit from the breach. The ICO determined that the nature of Marriott’s failures were of significant concern, as there were multiple measures Marriott could have employed to detect the attack earlier, and an “extremely large number” of individuals were affected. The ICO considered distress to individuals, evidenced by the likely cancellation of payment cards, and the 57,000 calls received by Marriott’s call center following the breach. The ICO concluded that Marriott had acted negligently in failing to adequately maintain the systems affected by the breach, particularly given Marriott’s size and profile, and the likelihood that it would be targeted by attackers.

In reducing the proposed fine, the ICO took into consideration the representations made by Marriott, steps it took to mitigate the impact of the incident, and the economic impact suffered by Marriott as a result of the COVID-19 pandemic. It acknowledged that Marriott had acted promptly in contacting customers and the ICO, promptly sought to mitigate the risk of damage to customers once it discovered the breach, and that it has since improved the security of its systems. The steps Marriott took to mitigate the effect of the breach included implementing password resets, disabling accounts known to be compromised, and implementing enhanced detection tools. Further, Marriott set up a dedicated incident website in a number of languages and a call center, and took a number of other steps to assist and reassure data subjects. The ICO also considered the fact that Marriott had fully cooperated with the ICO’s investigation.

Considering the representations made by Marriott in response to its notice of intent to fine, the ICO ultimately settled on a fine of £28 million. The mitigating factors discussed above resulted in a reduction of the fine to £22.4 million, a 20% decrease, and the impact of the COVID-19 pandemic on Marriott’s business was then considered, further reducing the fine to £18.4 million.