Hacker News Reader

Comment by cs702 | Hacker News Reader

As a first rough approximation, this figure includes everyone on HN.

It appears to include everyone who's ever stayed in a room at a Marriott, St. Regis, Ritz-Carlton, Bulgari, W Hotel, JW Marriott, The Luxury Collection, Le Meridien, Renaissance, Westin, Tribute Portfolio, Sheraton, Autograph Collection, Design Hotel, Marriott Executive Apartments, Delta Hotels & Resorts, AC Hotels, Element, Gaylord, SpringHill Suites, Courtyard, Residence Inn, Fairfield Inn & Suites, Moxy Hotels, Protea Hotels, TownePlace Suites, Aloft, Four Points by Sheraton, or Marriott Vacation Club property.

For reference, there are under 130M households in the US and around 200M households in the entire EU.

View on HN

From the article:

"The hotel chain said the guest reservation database of its Starwood division had been compromised by an unauthorised party."

"Starwood's hotel brands include W Hotels, Sheraton, Le Méridien and Four Points by Sheraton. Marriott-branded hotels use a separate reservation system on a different network."

edit: the Marriott website itself confirms as much that this is limited to Starwood properties.

http://news.marriott.com/2018/11/marriott-announces-starwood...

" guest information relating to reservations at Starwood properties* on or before September 10, 2018.'"

"* Starwood brands include: W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels. Starwood branded timeshare properties are also included."

Do you have other information?

> * Starwood brands include: W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels. Starwood branded timeshare properties are also included.

What possible reason would Marriot have to have details of my stay from 6 years ago on record, especially on their reservation system.

Customer reactivation.

Other marketing activities.

Resale to third parties.

You at any point requested to be added to their mailing list and that's linked to purchase history.

Web analytics linked to purchase history.

Corporate policy is not to delete data.

Laziness.

So there's seven reasons of various legitimacy off the top of my head.

Not convinced any of those would pass the GDPR legitimate interests test, especially if I haven't specifically consented to such reasons.

Resale to third parties.

Corporate policy is not to delete data.

Laziness.

especially are great examples of why the GDPR was created, even once we ignore the advertising industry.

Reply on news.ycombinator.com