UK Watchdog Investigation of British Airways and Marriott Hotels Security Breaches

Following an incident reported to the ICO in September 2018, the Information Commissioners Office (ICO), the UK’s data protection supervisory authority, investigated and uncovered that the personal data of up to 500,000 BA customers had been unlawfully accessed. The BA’s website had been diverted to a dummy site where customer details were harvested by hackers. Some credit cards long number and security codes had been discolosed causing serious security breaches. On 8th of July 2019, the ICO published a Notice of Intent to fine British Airways 183 million £.

“ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR ‘one stop shop’ provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO’s findings.

The ICO will consider carefully the representations made by the company and the other concerned data protection authorities before it takes its final decision.”

The Following day, a Notice of Intention was issued against Marriott International.

“Following an extensive investigation the ICO has issued a notice of its intention to fine Marriott International £99,200,396 for infringements of the General Data Protection Regulation (GDPR).”

The proposed fine relates to a cyber incident which was notified to the ICO by Marriott in November 2018. A variety of personal data contained in approximately 339 million guest records globally were exposed by the incident, of which around 30 million related to residents of 31 countries in the European Economic Area (EEA). Seven million related to UK residents.

It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018. The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.

It will be interesting to watch the effects of a no deal Brexit on these cases where the ICO will no longer be a lead authority and UK possibly becoming a country of non adequate data protection.

The Information Commissioner Elizabeth Denham said:

“The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.

“Personal data has a real value so organisations have a legal duty to ensure its security, just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”

In an interview with WSJ Pro Cybersecurity, the Information Commissioner Elizabeth Denham said her office considered cybersecurity gaps, among other factors, in proposing that Marriott International Inc. and British Airways ’ parent company pay the biggest fines to date under Europe’s data-privacy laws.

‘Companies had fundamental security flaws, says Information Commissioner Elizabeth Denham; their size and number of people affected also played a role‘

Both first major cases investigated by the ICO after the FB/Cambridge Analytics concern the security of personal data. It is unknown if they have been found to have infringed the ‘Security Principle’ Article 5(1)(f) or the ‘Security of Processing’ Article 32(1).

BA and Marriott International have 21 days to make representation. Other concerned EU national data protection supervisory authorities will be able to comment until the final Monetary Penalty Notice is issued.

Both organisations intend to appeal the decision. Appeal will be presented to the First Tier Tribunal in the General Regulatory Chamber within 28 days of receiving the MPN (Section 162, UK Data Protection Act 2018).

The First Tier Tribunal must allow the appeal if it considers that either the ICO’s decision was not made in accordance with the law, or a different outcome was expected.

The Tribunal may also dismiss the appeal, modify the notice or cancel the ICO’s Intention of fine.

More investigations are coming to an end. Expected outcomes from Carphone Warehouse and TicketMasters are awaited. The Grace period seems to have ended.

Meanwhile, The French CNIL has kept its promised going after estate agencies, it has issued a fine of 400.000 €. In June, the CNIL Fines French Real Estate Service Provider for Data Security and Retention Failures.

We will conclude by saying GDPR compliance could seem costly, watch for the cost of non compliance. Privacy Impact Assessment/DPIA, data minimisation and other healthy GDPR requirement would have avoid the security breaches that cost in fines and trust. Next to Data Protection authorities sanctions are customers distrust and other legal actions including class actions.

• This work is licensed under a Creative Commons Attribution 4.0 International License.