Marriott International, Inc.
("Marriott") on December 4, 2018
announced1that a major database security incident has
occurred in Starwood Hotels and Resorts guest reservation database.
The Starwood brands includes major hotels such as, among others, W
Hotels and Sheraton Hotels & Resorts2. The news
spread swiftly in the written and visual media and seriously
affected the data subjects, whose private information such as name
and credit card details were accessed by unauthorized persons.
Since the breach involved all the hotels under the Starwood brand,
it soon became one of the hot topics in lots of different media
platforms in many countries.
Article 12/1 of the Turkish Personal Data Protection Law No.
6698 ("Law") states the data controller
shall take all necessary technical and organizational measures to
provide a sufficient level of security. This is to prevent unlawful
processing of, and access to personal data. In addition, Article
12/5 of the Law obliges the
