Marriott could be liable for the first significant fining of a brand under GDPR , following a major data breach that exposed the personal data of 500 million of its customers . In 2016, Marriott bought the Starwood, which includes hotel chains Sheraton, Westin, Le Méridien and W. The exposure was discovered in September but may have records as far back as 2010 . The size of the breach and the fact it goes back several years both contribute to a likely GDPR penalty , according to the senior analyst Michael Iannopollo .
Marriott could be liable for the first significant fining of a brand under GDPR , following a major data breach that exposed the personal data of 500 million of its customers . The exposure was discovered in September but may have records as far back as 2010 . The size of the breach and the fact it goes back several years both contribute to a likely GDPR penalty , according to the senior analyst Michael Iannopollo .