Dramatically upping the ante on cybersecurity in the context of mergers and acquisitions, the UK Information Commissioner’s Office (“ICO”) has announced its intention to fine Marriott £99 million for apparent GDPR violations. The proposed fine relates to a highly publicised data breach at Starwood, a company acquired by Marriott. We offer here a summary of what is publicly known about the ICO action, and some thoughts on how companies might raise their game when it comes to cyber diligence in the M&A sphere.

The proposed Marriott fine is the first major regulatory action anywhere to specifically call out a company for purportedly inadequate cyber due diligence in connection with an M&A deal. The proposed fine comes hot on the heels of the ICO’s notice of intent to fine British Airways £183 million. That proposed fine relates to British Airways’ 2018 data breach affecting approximately 500,000 customers.

The ICO has not yet published the details of Marriott’s alleged GDPR violations. Hence it remains to be seen exactly what more the ICO thinks Marriott could or should have done to identify and remediate the Starwood breach, whether pre- or post-closing of the acquisition.

Based on the ICO’s announcement, the breach originated in a system belonging to the Starwood hotels group, which Marriott acquired in 2016. The relevant Starwood systems apparently were compromised in 2014, but the exposure of customer data was only discovered in 2018. By that point, the breach is said to have affected 30 million people within the European Economic Area (“EEA”)–touching all 31 EEA member states–including 7 million in the UK. The global estimate is that 339 million individuals were affected.

The ICO’s press release states that Marriott failed to undertake sufficient due diligence when it acquired Starwood and that it should have done more to secure its systems. This is an important reminder of the need for all companies–whether subject to GDPR or to other legal regimes–to conduct thorough information security and cyber due diligence pre-acquisition; to obtain appropriate contractual protections in the deal process through representations, warranties and indemnities; and to give priority to secure integration of systems post-closing an acquisition.

This message is by no means restricted to the EU, and is gaining traction amongst regulators globally. For example, the New York Department of Financial Services’ cybersecurity regulation FAQ states that Covered Entities (essentially banks and insurers, wherever headquartered, that carry a licence to operate in New York) must have “a serious due diligence process and cybersecurity should be a priority when considering any new acquisitions,” and that Covered Entities should have written policies and procedures covering cybersecurity due diligence.

The challenges of pre-closing cyber diligence are well known. Cyber will always be competing for dealmakers’ attention with a host of other issues. There is only so much oxygen in the dealmaking room, and cyber has not often been seen as a major driver of valuation. (This despite headline-making examples, such as Verizon imposing a $350 million haircut on Yahoo! in 2017 when Verizon learned about a major Yahoo! breach between the original agreement over the deal and closing.) Even when the acquirer makes cyber diligence a priority, target companies may be reluctant to disclose their cyber risks at a useful level of detail.

The result of these and other challenges is that robust cyber diligence, as often as not, has only occurred post-closing. The proposed ICO fine to Marriott and the New York DFS guidance suggest that companies on both sides of the deal table may now want to give greater priority to these issues earlier on. Steps to consider include:

Post-closing cyber diligence also might usefully be elevated in terms of priority and resources. Here too, outside expertise can be useful, as can promptly making a specific action plan to assess the risks at the acquired company, then creating targeted risk mitigation plans with clear milestones and appropriate budget authority.

Listed companies should also remain vigilant of the potential need to notify the market when breaches occur and at key points thereafter. Like with British Airways, the ICO made its announcement in response to a regulatory filing: here, Marriott’s update to the U.S. Securities and Exchange Commission in which it disclosed a possible fine by the ICO. Listed companies need to consider carefully when to disclose data breaches to the market and when to issue public updates or make regulatory filings on any follow-on litigation or enforcement action and what steps might be needed to prevent insider trading on that information.

With Marriott having publicly stated that it intends to “vigorously defend its position”– in what many will view as a troubling case, given the genuine challenges that any acquirer faces in cyber diligence–it might be some time before the ICO issues its final penalty. Regardless of how long it takes for the ICO and Marriott to resolve this particular matter, the lessons for how to address cybersecurity in the M&A context are vivid and immediate.

With members of its Cybersecurity & Data Privacy Group on both sides of the Atlantic, Debevoise is well-placed to assist EU and non-EU businesses on all areas of GDPR compliance, including cyber incident preparation, incident response, and interaction with data protection authorities.

• The UK Information Commissioner’s Office has announced its intention to fine Marriott £99 million for apparent GDPR violations linked to a data breach which originated at the Starwood hotels group before it was acquired in 2016 by Marriott.
• The proposed fine is a dramatic reminder of the importance of cybersecurity in the M&A context, with the ICO finding that Marriott carried out inadequate due diligence when it acquired Starwood and that it should have done more to secure its systems.
• While the details of Marriott’s alleged failings are not yet known, the fine is a useful opportunity for companies to reacquaint themselves with how they can minimise potential cyber risks in the M&A context. We discuss those here.