UK Information Commissioner's Office has fined Marriott £18.4m over breach
theregister.com
theregister.com
They had initially announced a fine against British Airways of 183M, and reduced it to about 20M.
Marriot's original was 99M, now reduced to 18.4M.
Cathay Pacific was fined... 500K.
In most cases, each fine has been announced as a large amount (presumably for publicity) after which it goes through appeals, tribunals, some private meetings and a substantially reduced fine.
I can only imagine why it keeps ending up this way - is money changing hands during these negotiations? Are the fines kept "low" in order to not scare businesses away from continued laxity?
In July 2019, the ICO issued a formal notice of intent under the U.K. Data Protection Act 2018 proposing a fine in the amount of £99 million against the Company in relation to the Data Security Incident (the “Proposed ICO Fine”). We mutually agreed with the ICO to an extension of the regulatory process until June 1, 2020 and the ICO proceeding is ongoing. In the 2019 second quarter, we recorded an accrual in the full amount of the Proposed ICO Fine for this loss contingency, and in the 2019 fourth quarter, we reduced the accrual to $65 million based on the ongoing proceeding.
To date, we have not seen a meaningful impact on demand as a result of the Data Security Incident.
In 2018, we recorded $28 million of expenses related to the Data Security Incident, partially offset by $25 million of accrued insurance recoveries [...]
(EDIT) Also:
To date, approximately 100 putative class action lawsuits have been filed by consumers and others against us in U.S. federal, U.S. state and Canadian courts related to the Data Security Incident.
In the case of fines levied by the ICO, the money goes to the UK government