UK's regulator ICO to fine Marriott ~$123M over GDPR violations related to the Starwood Hotels breach, disclosed in 2018, that affected 380M+ guests
The intent to fine Marriott comes a day after the ICO announced a $230 million GDPR fine against British Airways.
Context & Ripple Effects
The ICO's intent to fine Marriott lands one day after the regulator hit British Airways with a record £183M fine for its 2018 breach — a deliberate back-to-back signal that GDPR enforcement targets breach disclosure and security posture, not just the breach itself. Marriott's exposure traces to the Starwood reservation system, compromised from 2014 and inherited in Marriott's acquisition, affecting over 380 million guests.
The arc since: the ICO later slashed both penalties, cutting the Marriott fine to £14.4M and the BA fine to £20M in 2020, while US regulators took their own run — the FTC's $52M multistate penalty and a mandated security program for Marriott and Starwood followed in 2024.
First-order effects
- Marriott faces an intended ~$123M GDPR penalty (about 1.5% of estimated global revenue territory under the ICO's framing) for security failures on a system it acquired with Starwood — a fine levied on a breach that predates its ownership of the database.
- The ICO establishes, one day after the BA action, that hotel and airline reservation systems holding passport, payment, and contact data are priority enforcement targets.
Second-order effects
- Hospitality groups with acquired or legacy reservation platforms face pressure to audit inherited systems pre-merger, since Marriott is being fined for Starwood's pre-acquisition security debt.
- The back-to-back BA and Marriott fines push global chains toward treating GDPR exposure as a board-level M&A and security cost line, not an IT matter — a posture the later FTC-mandated security program institutionalizes for Marriott specifically.
Third-order effects
- The pattern — headline fines later reduced roughly tenfold (Marriott £99M→£14.4M, BA ~£184M→£20M) while US authorities layer on separate penalties — points to a two-regime structure where GDPR intent notices set deterrence signaling and final amounts get negotiated down, with multi-jurisdiction enforcement stacking costs on a single breach.
- If inherited-system liability holds as precedent, due diligence on data security in large hospitality and travel acquisitions shifts from optional audit to deal-shaping term.
The trend: Cross-border breach enforcement is converging on a model where a single legacy breach triggers stacked penalties from multiple regulators — GDPR intent fines for signaling, negotiated reductions for closure, and FTC-mandated security programs as the lasting remedy.