ICO’s new strike on giants for bad management of data breaches under GDPR rules

​After the £183.39m -worthy BA episode, the Information Commissioner’s Office (ICO) disclosed its intention to fine Marriott International, Inc. £99,200,396 for breaches under GDPR and linked to a lacking due diligence during the acquisition of Starwood hotels group. 

The Starwood hotels has had cyber security vulnerabilities in 2014. Mariott acquired the group in 2016, the same year of its own cyber security incident, announced to the Office only in 2018.

The authority justified the amount of the fine with the lack of a deeper due diligence during the acquisition, as the giant should have made more specific analysis on the security and data protection regulation compliance of the acquired-to be entity.

The GDPR’s principle of accountability is the leitmotif of the purpose of the injunction: even during the data processing and communication due to a corporate transaction- such as an acquisition- the roles should be minded and made clear. On the contrary, the few attentions paid to the data protection may lead to events such as data breaches/incidents. And this is the case: the ICO reports that “339 million guest records globally were exposed by the incident, of which around 30 million related to residents of 31 countries in the European Economic Area (EEA). Seven million related to UK residents”.

Art. 32, GDPR provides for that: “(..)In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed.”.

Recitals no. 76,77,79 on risk assessment, risk assessment guidelines and responsibilities’ allocation between controller and processor make their sense when the data communication and processing is made.

This case points out that every single corporate action and event has a data protection-related consequence.