12.07.2019 | KPMG Law Insights

Fine for serious data protection violations

By Sebastian Hoegl, LL.M. (Wellington), Maik Ringel

Fine for serious data protection violations

“The U.K.’s Information Commissioner’s Office (ICO) intends to take action against U.S. hotel chain Marriott International, Inc. impose a hefty fine of more than GBP 99 million for serious data protection violations. At Mariott, data from more than 339 million guest records worldwide, including approximately 30 million from EU/EEA residents, was exposed as a result of a cyberattack. The data breach apparently occurred at Starwood Hotel Group before it was acquired by Mariott in 2016. The ICO said the size of the fine was justified because the data breach went undetected until 2018 due to poor data protection due diligence on the transaction and continued inadequate data security measures at Mariott. Since the data breach was discovered, Mariott has been cooperating with the ICO; otherwise, the fine would have been even higher. Mariott and the data protection authorities of the other EU member states whose residents are affected by the data breach now have the opportunity to comment on the allegations before the ICO makes its final decision.

The ICO’s actions show that data protection law is also becoming increasingly important in corporate acquisitions. Buyers must therefore not only assess the data protection risks in the target company as part of due diligence. But it is much more important to raise data protection at the target company to an appropriate level (at the latest) when it is integrated into the corporate group.”

Explore #more

15.10.2026 | KPMG Law Insights

Faster Building Permits – Legal Options for Businesses

Planning and permitting procedures do not always have to delay construction projects. The law provides several options for expediting the process. To take advantage of…

09.10.2026 | KPMG Law Insights

Claims Management for Cyber Incidents: How Insurers Actively Manage Claims

Cyber incidents are among the most complex claims scenarios for insurers. Ransomware attacks, in particular, can paralyze entire IT infrastructures—with enormous financial consequences. Insurers for …

08.10.2026 | In the media

KPMG Law Guest Column in AUTOHAUS: Consumer Credit Directive: Sales Under New Circumstances

Car dealerships should use the time remaining before the new Consumer Credit Directive takes effect to systematically review their financing and sales processes for regulatory…

08.10.2026 | In the media

KPMG Law Interview with HAUFE: Even If AI Makes a Mistake, the Board of Directors Is Still Liable

AI analyzes, makes recommendations, and helps make decisions. But who bears the consequences if it’s wrong? KPMG Law experts Nikolaus Vincent Manthey and Sabrina Riesenbeck…

30.09.2026 | KPMG Law Insights

Mixed-Use Real Estate as an Opportunity for Downtown Areas

Downtown areas should be vibrant, sustainable, and attractive. But the traditional business model behind them—retail—is becoming less and less viable. Rents are high, customers are…

28.09.2026 | Deal Notifications

KPMG Law and KPMG are advising Rohde & Schwarz on the acquisitions of NEOSAT and PHYTRONIC

KPMG Law Rechtsanwaltsgesellschaft mbH (KPMG Law) and KPMG AG Wirtschaftsprüfungsgesellschaft (KPMG) advised the Munich-based technology group Rohde & Schwarz on its acquisitions of NEOSAT GmbH…

28.09.2026 | Deal Notifications

KPMG Law and KPMG are advising Diehl Defence on the acquisition of the Dr. Carls aerial imagery database

KPMG Law Rechtsanwaltsgesellschaft mbH (KPMG Law) and KPMG AG Wirtschaftsprüfungsgesellschaft (KPMG) advised Diehl Defence on its acquisition of the aerial imagery database Dr. Carls GmbH.…

26.09.2026 | In the media

Op-Ed in Lebensmittelzeitung: PPWR Introduces New Requirements for the Food Industry

The EU Packaging Regulation (PPWR) has been in effect since August 12, 2026—and presents companies in the food industry with a question that requires urgent…

18.09.2026 | Press releases

KPMG Law Honored at the PMN Management Awards

KPMG Law was awarded first place in the Business Development category at this year’s PMN Management Awards. In addition, the project “The Agent-Based Law Firm”…

18.09.2026 | KPMG Law Insights

How the Data Act Affects the Drafting of Lease Agreements

The EU Data Act is also of great significance to the real estate industry, as modern commercial properties have become data spaces. Heating and air…

Contact

Sebastian Hoegl, LL.M. (Wellington)

Senior Manager
Lawyer
Specialist lawyer for IT law
LL.M. (Wellington)

Heinrich-von-Stephan-Straße 23
79100 Freiburg im Breisgau

Tel.: +49 761 769999-20
shoegl@kpmg-law.com

Maik Ringel

Senior Manager

Münzgasse 2
04107 Leipzig

Tel.: +49 341 22572563
mringel@kpmg-law.com

© 2026 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit https://home.kpmg/governance.

KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.