On July 9, 2019, the UK Information Commissioner's Office
(ICO) publicly announced its intent to impose a
£99M (approximately $123M) GDPR fine on Marriott in connection with the
discovery and notification of a data breach at Starwood.
Among its justifications for the record fine, the ICO cited
inadequate data protection due diligence by Marriott in its
acquisition of Starwood as a factor that delayed the discovery of
the breach until 2018, even though the breach occurred at Starwood
in 2014, and the acquisition of Starwood by Marriott took place in
2016.
Whether or not the ICO's view of acquirer data protection
due diligence responsibilities is reasonable, the record Marriott
fine should serve as a reminder of the importance of thorough data
protection due diligence in M&A transactions that involve
targets that handle significant amounts of personal data.
