In our
last blog article, we discussed the British data protection
authority's ("ICO") announcement to
impose large fines on British Airways and Marriott Hotels for
separate large-scale data breaches affecting those businesses. In
this article, we will turn our minds to the significance of
Commissioner Denham's statement, referring to the Marriott
situation, about the impact of privacy due diligence in M&A
activity.
The European Data Protection Regulation
("GDPR") allows for fines of up to four
percent of global annual turnover. The ICO's decisions to
impose the equivalent of a $300M fine on British Airways and a
$160M fine on Marriott have sparked much debate about the extent to
which these fines should serve as a benchmark, regarding both the
amount itself and the underlying analysis of how the ICO arrived at
its decision. Commissioner Julia Denham's brief but clear
remarks regarding an organization's accountability and the
importance of due diligence when
