Marriott International, Inc.

What the regulator decided

An attacker placed a web shell on a Starwood guest-reservations system in or around July 2014 and maintained undetected access through Marriott's 2016 acquisition until September 2018, exfiltrating up to 339 million guest records (including 7 million UK records); Marriott failed to implement appropriate security measures to protect the personal data and to assess the Starwood IT estate adequately on acquisition, breaching Article 5(1)(f) and Article 32 GDPR.

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

EUR amount approximate (round-trip from GBP 18.4M at the enforcement- date FX rate). The original notice of intent was GBP 99.2M; the pandemic-period discount and other mitigating factors reduced the final. Cite when the scanner narrative needs the precedent that acquisition due-diligence on the security posture of an acquired estate is a controller obligation, not just commercial good practice.