Data Protection – 'Proper Due Diligence'

What do I need to know?

Quick summary

The UK's data protection regulator, the ICO, intends to fine Marriott International, Inc £99.2 million. This proposed fine arises from a cyber incident which affected Starwood hotels from 2014 to 2018. Marriott bought Starwood hotels in 2016 while the incident was ongoing.

The ICO's investigation highlighted that when buying Starwood, "proper due diligence" of the personal data they were acquiring and how it was protected would help meet Marriott's obligations under data protection law. They also noted that companies have a legal duty to ensure the security of personal data "just like they would do with any other asset".

This is not a final decision. Marriott now has 21 days to make representations to the ICO. Other European data protection regulators can also make representations on the proposed penalty. Following these representations, the ICO will issue a monetary penalty which will include more detail of the specific issues that caused the fine. There is a subsequent appeals process.

Facts and Notice

In 2014 the systems of Starwood hotels group were compromised by a cyber incident. Marriott acquired Starwood in 2016. The GDPR took effect on 25 May 2018. This law includes mandatory data breach reporting (over a certain risk threshold) and the principle of "accountability", which is about demonstrating compliance with the law. In November 2018 Marriott identified the cyber incident and informed the ICO. Over the course of the incident, personal data contained in approximately 339 million guest records was exposed. These included 30 million records of residents of 31 countries in the EEA and 7 million records of UK residents. Marriott has subsequently co-operated with the ICO investigation and made improvements to its security. ICO Notice of Intent

The ICO intends to fine Marriott £99.2 million. Their investigation found that Marriott failed to undertake proper due diligence when buying Starwood and should have done more to secure its systems.

Reasoning behind the proposed fine

Due diligence

The Information Commissioner's press release identifies "proper due diligence when making a corporate acquisition" as part of the accountability principle.

The press release goes on to state that companies can also fulfil their accountability obligations by assessing "not only what personal data has been acquired, but also how it is protected".

Security

The GDPR also contains specific security obligations which...