British Airways and Marriott UK data protection fines deferred again as coronavirus shutdown hits business
- Reference: 1586160912
- News link: https://www.theregister.co.uk/2020/04/06/ico_data_protection_fines_ba_marriott_hack_postponed/
- Source link:
The fines were handed to both companies following damaging and [4]widely publicised digital break-ins affecting millions of people around the world.
According to EU news website Politico, the fines have been [5]delayed for Marriott until 1 June this year, with UK law firm Mishcon de Reya's data protection man Jon Baines [6]blogging , with reference to the same source, that BA owner IAG's annual report revealed that its own fine had been postponed until 18 May.
That [7]statement [212-page PDF, statement on page 184] said in part: "The ICO initially had six months from issuing the Notice of Intent to British Airways within which it could issue a penalty notice, which has been extended through to May 18, 2020, to allow the ICO to fully consider the representations and information provided by British Airways."
It added that BA would "vigorously defend" itself all the way to the Court of Appeal if needed, suggesting the airline isn't going to let the ICO collect a cheque without a fight.
The ICO would not comment other than to say the process was "ongoing".
Marriott copped its £99m fine after [8]letting 383 million people's data go AWOL thanks to Chinese hackers. BA was stung for £183m after [9]losing control of 380,000 people's payment card details in 2018 .
British (and thus EU) data protection law is convoluted when it comes to fines: the ICO announces its intention to impose a big monetary penalty and then the naughty companies have a chance to argue about it behind closed doors, a bit like an appeal.
So it was that BA and Marriott managed to have their fines [10]postponed in January for three months while lawyers argued about it.
It is easy to see why BA scored an extension, what with the [11]existential threat posed to it by the global economic coronavirus shutdown. Marriott, meanwhile, has a [12]whole new hack of 5.2 million customers' records on its hands to deal with.
El Reg will keep an eye on the situation. The ICO's legal budget for all of its functions, as well as taking on two multinationals in one go, is a relatively paltry £2m. ®
Sponsored: [13]Legacy Modernization: Finding Your Way With Low-Code
[1] https://www.theregister.co.uk/2020/01/13/ico_british_airways_marriott_fines_delayed/
[2] https://www.theregister.co.uk/2018/09/06/british_airways_hacked/
[3] https://www.theregister.co.uk/2019/07/09/marriott_hotels_ico_fine_intention_99m_starwood_breach/
[4] https://www.theregister.co.uk/2018/11/30/marriott_starwood_hotels_500m_customer_records_hacked/
[5] https://www.politico.eu/pro/uk-authority-delays-multimillion-pound-privacy-fine-on-british-airways-again/
[6] https://www.mishcon.com/news/further-delays-to-ico-proposed-fines-for-ba-and-marriott
[7] https://www.iairgroup.com/~/media/Files/I/IAG/documents/IAG%20Annual%20report%20and%20accounts%202019.pdf
[8] https://www.theregister.co.uk/2019/07/09/marriott_hotels_ico_fine_intention_99m_starwood_breach/
[9] https://www.theregister.co.uk/2018/09/06/british_airways_hacked/
[10] https://www.theregister.co.uk/2020/01/13/ico_british_airways_marriott_fines_delayed/
[11] https://www.dailymail.co.uk/news/article-8181301/British-Airways-furlough-workers-80-cent-pay-grounding-flights-Gatwick.html
[12] https://www.theregister.co.uk/2020/03/31/marriott_hotels_hacked_5m_guests/
[13] https://go.theregister.co.uk/tl/1936/-8553/legacy-modernization-finding-your-way-with-low-code?td=wptl1936
"The ICO's legal budget [..] is a relatively paltry £2m"
We've already discussed that point. Let the ICO retain 10% of the fines it collects until it has a war chest of around 100 million.
That will ensure it has the teeth needed to impose the fines.
Re: "The ICO's legal budget [..] is a relatively paltry £2m"
We've already discussed that point. Let the ICO retain 10% of the fines it collects until it has a war chest of around 100 million.
That will ensure it has the teeth needed to impose the fines.
No, it would ensure that the ICO's role changed from policing a system to making as much money as it could from it, to the detriment of everyone else.
There is plenty of evidence that this is how public and private bodies behave when a punishment becomes a cash cow. Look at parking fines - [1]councils make half a billion from them annually and the [2]Coronavirus emergency is used to extract large amounts of money from vulnerable people .
Instead the ICO should just be properly funded.
[1] https://www.telegraph.co.uk/news/2019/11/16/councils-made-almost-half-billion-parking-fines-rac-finds/
[2] https://www.bbc.co.uk/news/uk-england-london-52091664
Something tells me....
Marriot are going to have zero chance.
They can't exactly say "We take peoples information very seriously". But I'm sure they will.