12.07.2019 | KPMG Law Insights

Fine for serious data protection violations

By Sebastian Hoegl, LL.M. (Wellington), Maik Ringel

Fine for serious data protection violations

“The U.K.’s Information Commissioner’s Office (ICO) intends to take action against U.S. hotel chain Marriott International, Inc. impose a hefty fine of more than GBP 99 million for serious data protection violations. At Mariott, data from more than 339 million guest records worldwide, including approximately 30 million from EU/EEA residents, was exposed as a result of a cyberattack. The data breach apparently occurred at Starwood Hotel Group before it was acquired by Mariott in 2016. The ICO said the size of the fine was justified because the data breach went undetected until 2018 due to poor data protection due diligence on the transaction and continued inadequate data security measures at Mariott. Since the data breach was discovered, Mariott has been cooperating with the ICO; otherwise, the fine would have been even higher. Mariott and the data protection authorities of the other EU member states whose residents are affected by the data breach now have the opportunity to comment on the allegations before the ICO makes its final decision.

The ICO’s actions show that data protection law is also becoming increasingly important in corporate acquisitions. Buyers must therefore not only assess the data protection risks in the target company as part of due diligence. But it is much more important to raise data protection at the target company to an appropriate level (at the latest) when it is integrated into the corporate group.”

Explore #more

11.09.2026 | KPMG Law Insights

The Procurement Acceleration Act and Sustainable Procurement: What Is Permitted and What Is Required?

The Public Procurement Acceleration Act took effect on July 1, 2026. The Act implements the reform of public procurement law that has been under discussion…

08.09.2026 | Deal Notifications

KPMG Law advises the shareholders and management of KODIAK on the sale of shares and the strategic partnership with Bencis

KPMG Law Rechtsanwaltsgesellschaft mbH (KPMG Law) advised the shareholders and management of KODIAK GmbH (KODIAK) on the sale of shares to Bencis and the establishment…

07.09.2026 | In the media

KPMG Law advises Bosch Rexroth on the sale of its Active Shuttle product business to Neura Robotics

KPMG Law Rechtsanwaltsgesellschaft mbH (KPMG Law) has provided legal counsel to Bosch Rexroth AG (Bosch Rexroth) in the sale of its product business related to…

31.08.2026 | In the media

Op-Ed in the Börsen-Zeitung – Interim Assessment of the European Crypto Regulation MiCAR

A year and a half after MiCAR took effect, it is clear that, despite European guidelines, there are still misunderstandings regarding the requirements. KPMG Law…

19.08.2026 | In the media

KPMG Law Interview in HAUFE: Even If AI Makes a Mistake, the Board of Directors Is Still Liable

AI analyzes, makes recommendations, and helps make decisions. But who bears the consequences if it makes a mistake? KPMG Law experts Vincent Manthey and Sabrina …

19.08.2026 | In the media

KPMG Law Article in Bloomberg Tax: Germany’s Tax Crime Action Plan Pushes the Boundaries of the Constitution

The new 26-point action plan against tax and financial crime, issued by Germany’s finance and justice ministries, signals a shift toward tougher sanctions, closer interagency…

13.08.2026 | KPMG Law Insights

Federal Ministry of Finance Presents Draft Bill on Mandatory Use of Electronic Cash Registers and Combating Tax Evasion

In July 2026, the Federal Ministry of Finance (BMF) and the Federal Ministry of Justice (BMJV) presented an action plan to combat tax and financial …

11.08.2026 | In the media

Guest article in Versicherungsmonitor on the topic of cyber claims regulation

Cyberattacks—particularly ransomware campaigns—pose challenges for insurers when it comes to claims settlement. When entire IT infrastructures at insured companies come to a standstill and the…

11.08.2026 | KPMG Law Insights

Transparency Requirements Under Article 50 of the AI Act: Companies Should Address These Questions Now

The transparency requirements of the EU AI Act have been in effect since August 2, 2026. These obligations apply to chatbots, AI assistants, avatars, synthetic…

10.08.2026 | In the media

Op-Ed on the Procurement Acceleration Act and Sustainable Public Procurement

On April 23, 2026, the Bundestag passed the Act on Accelerating the Award of Public Contracts. After the Act was published in the Federal Law…

Contact

Sebastian Hoegl, LL.M. (Wellington)

Senior Manager
Lawyer
Specialist lawyer for IT law
LL.M. (Wellington)

Heinrich-von-Stephan-Straße 23
79100 Freiburg im Breisgau

Tel.: +49 761 769999-20
shoegl@kpmg-law.com

Maik Ringel

Senior Manager

Münzgasse 2
04107 Leipzig

Tel.: +49 341 22572563
mringel@kpmg-law.com

© 2026 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit https://home.kpmg/governance.

KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.