20.3 million Euro fine against Marriott International Inc
Unknown hackers captured data of 339 million hotel guests over several years.

The company Marriott International Inc has been fined £18.4 million. Initially, the UK's data protection regulator announced on 9 July 2019 that it would fine Marriott International Inc £99 million. As the hotel industry is also heavily exposed to the impact of COVID-19 and its associated protections, following the aviation industry, the fine has been significantly reduced.

The background to the fine proceedings is a 2014 hacking attack on the IT system of the company Starwood Hotels & Resorts Worldwide Inc. In 2016, Marriott International Inc bought the company. In the period between the effective date of the GDPR on 25 May 2018 and the discovery of the attack on 26 September 2018, the hacker continued his attack by exporting Starwood customers' personal data stored in the database. Marriott International Inc estimates that 339 million guests worldwide are affected. The company took immediate action and informed affected individuals and the data protection authority. The ICO's investigation found that Marriott had not taken appropriate technical or organisational measures to protect the personal data processed on its systems. The violation of Art. 5(1) and 32 DPA herein relates to the period between the applicability of the DPA (25 May 2018) and the discovery of the attack in September 2018.