4 ms·

For context, Marriott's 2018 revenue was $20 Billion...so this fine is 0.5% - not insignificant, but not as high as the maximum 4% which is possible under GDPR

For context, Marriott's 2018 revenue was $20 Billion...so this fine is 0.5% - not insignificant, but not as high as the maximum 4% which is possible under GDPR. EDIT: source: https://www.statista.com/statistics/266279/revenue-of-the-marriott-international-inc-hotel-chain/ https://www.statista.com/statistics/266279/revenue-of-the-ma...

me_me_me 7y ago
I am ok with it being below maximum for now. They should start to increase the fines little by little and the big corps will caught on and start to treat the security with more respect.
- isostatic 7y ago
  If Marriot are caught again they can expect a far larger fine. The board should be planning some proper security. A £50m capital budget and £5m a year revenue should be good enough.
  - DocTomoe 7y ago
    Or they could set up an insurance fund for that kind of fine for similar money, and eventually that fund would be less expensive. After all, you don't have such a leak every other week.
    - isostatic 7y ago
      If they make no attempt to improve their security I suspect the next incident will cost them $800m. Be interesting to see who will insure them against that.
      - filoleg 7y ago
        When the parent comment said "they could set up an insurance fund", I believe they didn't mean a literal contract with an insurance company, but a straight up savings fund set up by Marriott to be used in the future specifically for expenses like that.
        isostatic 7y ago
        That's still self insurance, and it's still going to hit them for $800m next time they have a leak. Will have to be a big fund.
        filoleg 7y ago
        Of course. My comment was mostly directed towards the "interesting to see who will insure them against that" part.
- jocro 7y ago
  I'd imagine that Marriott self-reporting and cooperating with the ICO investigation can only help RE leniency.
zaarn 7y ago
That's still going to hurt a lot.
- isostatic 7y ago
  It's about 3 weeks profit
  - gcthomas 7y ago
    Is there a US fine in the pipeline too? Only a tenth of the data lost was from EU nationals.
    - isostatic 7y ago
      Does the US have laws against this type of negligence?
      - gcthomas 7y ago
        I'm sure some states do. California perhaps?
  - zaarn 7y ago
    3 week profit is a lot. I'd have a hard time imagining my boss telling me that the next three weeks, every employee's entire profit outcome will solely be dedicated to paying off a fine and that would be acceptable.
    - isostatic 7y ago
      By comparision a speeding fine for doing 75 in a 70 in the UK and you have to pay a week's revenue (not profit) This fine is half a week's revenue, so losing 330m records is deemed not as serious as going 75 in a 70.
      - zaarn 7y ago
        Well obviously, doing 75 in a 70 means you endanger the lives of yourself and those around recklessly and without proper reason (being an Ambulance is a good reason). Endangering Lives of others for no damn reason other than wanting to be home 3 seconds earlier > Loosing customer records
noir_lord 7y ago
The are two tiers, 2% and 4%. If this is under the 2% then it's 25% of the max for that tier. In either case explaining 99 million quid to the board isn't a conversation you'd want to have.
ckastner 7y ago
On the bright side, the overall regulatory effects of this decision are much larger, as it sets a precedent for future acquisitions (by any company, not just Marriott).
c3534l 7y ago
I think you mean profit, not revenue. 99 million is enough for them to alter their behavior and for heads to roll without putting themat a strategic disadvantage in the market.
- pmiller2 7y ago
  Fines need to be significant relative to revenue, not profit. Otherwise, they become a “cost of doing business.” A punishment isn’t a punishment unless it hurts.
  - fiter 7y ago
    Doesn't this just affect low margin businesses more then?
    - universenz 7y ago
      Should management of personal information be standard or offered at premium?
      - fiter 7y ago
        I'm not sure what your question is getting at, but if I owned a business, a fine proportional to the profit that I would otherwise receive would hurt equally for a low margin business and a high margin business.
        pmiller2 7y ago
        That’s the point: if you can’t profit off my personal data while simultaneously protecting it as a “low margin,” your business doesn’t need to exist. Fines relative to revenue hurt every business a lot, which is how it should be. A massive data breach should be cause for going out of business, not “oh, we’re taking X% of your profits this year, but we totally trust you to do better next year.”
        7y ago
vonmoltke 7y ago
> Marriott's 2018 revenue was $20 Billion What's your source for that? Marriott International only reported $5.2B in 2018[1]. [1] https://finance.yahoo.com/quote/MAR/financials?p=MAR https://finance.yahoo.com/quote/MAR/financials?p=MAR

me_me_me 7y ago

I am ok with it being below maximum for now. They should start to increase the fines little by little and the big corps will caught on and start to treat the security with more respect.

isostatic 7y ago
If Marriot are caught again they can expect a far larger fine. The board should be planning some proper security. A £50m capital budget and £5m a year revenue should be good enough.
- DocTomoe 7y ago
  Or they could set up an insurance fund for that kind of fine for similar money, and eventually that fund would be less expensive. After all, you don't have such a leak every other week.
  - isostatic 7y ago
    If they make no attempt to improve their security I suspect the next incident will cost them $800m. Be interesting to see who will insure them against that.
    - filoleg 7y ago
      When the parent comment said "they could set up an insurance fund", I believe they didn't mean a literal contract with an insurance company, but a straight up savings fund set up by Marriott to be used in the future specifically for expenses like that.
      - isostatic 7y ago
        That's still self insurance, and it's still going to hit them for $800m next time they have a leak. Will have to be a big fund.
        filoleg 7y ago
        Of course. My comment was mostly directed towards the "interesting to see who will insure them against that" part.
jocro 7y ago
I'd imagine that Marriott self-reporting and cooperating with the ICO investigation can only help RE leniency.

zaarn 7y ago

That's still going to hurt a lot.

isostatic 7y ago
It's about 3 weeks profit
- gcthomas 7y ago
  Is there a US fine in the pipeline too? Only a tenth of the data lost was from EU nationals.
  - isostatic 7y ago
    Does the US have laws against this type of negligence?
    - gcthomas 7y ago
      I'm sure some states do. California perhaps?
- zaarn 7y ago
  3 week profit is a lot. I'd have a hard time imagining my boss telling me that the next three weeks, every employee's entire profit outcome will solely be dedicated to paying off a fine and that would be acceptable.
  - isostatic 7y ago
    By comparision a speeding fine for doing 75 in a 70 in the UK and you have to pay a week's revenue (not profit) This fine is half a week's revenue, so losing 330m records is deemed not as serious as going 75 in a 70.
    - zaarn 7y ago
      Well obviously, doing 75 in a 70 means you endanger the lives of yourself and those around recklessly and without proper reason (being an Ambulance is a good reason). Endangering Lives of others for no damn reason other than wanting to be home 3 seconds earlier > Loosing customer records

noir_lord 7y ago

The are two tiers, 2% and 4%. If this is under the 2% then it's 25% of the max for that tier. In either case explaining 99 million quid to the board isn't a conversation you'd want to have.

ckastner 7y ago

On the bright side, the overall regulatory effects of this decision are much larger, as it sets a precedent for future acquisitions (by any company, not just Marriott).

c3534l 7y ago

I think you mean profit, not revenue. 99 million is enough for them to alter their behavior and for heads to roll without putting themat a strategic disadvantage in the market.

pmiller2 7y ago
Fines need to be significant relative to revenue, not profit. Otherwise, they become a “cost of doing business.” A punishment isn’t a punishment unless it hurts.
- fiter 7y ago
  Doesn't this just affect low margin businesses more then?
  - universenz 7y ago
    Should management of personal information be standard or offered at premium?
    - fiter 7y ago
      I'm not sure what your question is getting at, but if I owned a business, a fine proportional to the profit that I would otherwise receive would hurt equally for a low margin business and a high margin business.
      - pmiller2 7y ago
        That’s the point: if you can’t profit off my personal data while simultaneously protecting it as a “low margin,” your business doesn’t need to exist. Fines relative to revenue hurt every business a lot, which is how it should be. A massive data breach should be cause for going out of business, not “oh, we’re taking X% of your profits this year, but we totally trust you to do better next year.”
        7y ago

vonmoltke 7y ago

> Marriott's 2018 revenue was $20 Billion What's your source for that? Marriott International only reported $5.2B in 2018[1]. [1] https://finance.yahoo.com/quote/MAR/financials?p=MAR https://finance.yahoo.com/quote/MAR/financials?p=MAR