12.07.2019 | KPMG Law Insights

Fine for serious data protection violations

By Sebastian Hoegl, LL.M. (Wellington), Maik Ringel

Fine for serious data protection violations

“The U.K.’s Information Commissioner’s Office (ICO) intends to take action against U.S. hotel chain Marriott International, Inc. impose a hefty fine of more than GBP 99 million for serious data protection violations. At Mariott, data from more than 339 million guest records worldwide, including approximately 30 million from EU/EEA residents, was exposed as a result of a cyberattack. The data breach apparently occurred at Starwood Hotel Group before it was acquired by Mariott in 2016. The ICO said the size of the fine was justified because the data breach went undetected until 2018 due to poor data protection due diligence on the transaction and continued inadequate data security measures at Mariott. Since the data breach was discovered, Mariott has been cooperating with the ICO; otherwise, the fine would have been even higher. Mariott and the data protection authorities of the other EU member states whose residents are affected by the data breach now have the opportunity to comment on the allegations before the ICO makes its final decision.

The ICO’s actions show that data protection law is also becoming increasingly important in corporate acquisitions. Buyers must therefore not only assess the data protection risks in the target company as part of due diligence. But it is much more important to raise data protection at the target company to an appropriate level (at the latest) when it is integrated into the corporate group.”

Explore #more

04.11.2026 | KPMG Law Insights

EUDR: These obligations apply throughout the supply chain – as of 2026

After being postponed twice, the EU Deforestation Regulation (EUDR) is expected to take effect on December 30, 2026. Companies that handle certain products derived…

04.11.2026 | In the media

JUVE: Risks Associated with the Use of AI at the Highest Levels

AI can assist executive boards, supervisory boards, and managing directors in making decisions. However, unverified results can create liability risks. Fraport General Counsel Thomas Stoll…

30.10.2026 | In the media

New Podcast in the Packaging Journal: PWR in Practice—Who Is Liable, Who Pays, and What Are the Current Rules?

The core obligations of the PPWR have been in effect since August 12, 2026. In the Packaging People podcast, Dr. Simon Meyer of KPMG Law…

29.10.2026 | In the media

KPMG and KPMG Law Article in Betriebs-Berater: Pitfalls in Customs Law

In light of geopolitical changes, new trade barriers, and more rigorous audits, customs and foreign trade law are increasingly becoming a focus for companies. The…

27.10.2026 | In the media

Op-Ed in Versicherungsmonitor: The Environment Is Finally Becoming a Compliance Risk

With the implementation of the new EU Environmental Criminal Law Directive, the environment is becoming a core area of managerial liability. Managers face reputational damage,…

27.10.2026 | KPMG Law Insights

Federal Court of Justice on the Summary Report: Tax-Exempt but Still a Criminal Offense

Can someone be punished for sales tax evasion even if the sales were subsequently deemed tax-exempt? Yes, says the Federal Court of Justice (BGH) in…

23.10.2026 | KPMG Law Insights

PHP2Shell may trigger legal obligations for companies

Two critical vulnerabilities in the PHP programming language are threatening web applications and digital products worldwide. The Federal Office for Information Security (BSI) has warned…

20.10.2026 | In the media

KPMG Law Guest Column in it daily: The Business Judgment Rule and the Use of AI

The rapid advancement of artificial intelligence presents corporate leadership with diverse and far-reaching decisions. These decisions concern not only the selection and deployment of appropriate…

19.10.2026 | In the media

New articles have been published in PERSONALFÜHRUNG

The current issue of PERSONALFÜHRUNG (10–11/2026) features two articles by female experts from KPMG and KPMG Law. In the article “Will AI Save the Day?…

15.10.2026 | KPMG Law Insights

Faster Building Permits – Legal Options for Businesses

Planning and permitting procedures do not always have to delay construction projects. The law provides several options for expediting the process. To take advantage of…

Contact

Sebastian Hoegl, LL.M. (Wellington)

Senior Manager
Lawyer
Specialist lawyer for IT law
LL.M. (Wellington)

Heinrich-von-Stephan-Straße 23
79100 Freiburg im Breisgau

Tel.: +49 761 769999-20
shoegl@kpmg-law.com

Maik Ringel

Senior Manager

Münzgasse 2
04107 Leipzig

Tel.: +49 341 22572563
mringel@kpmg-law.com

© 2026 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit https://home.kpmg/governance.

KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.