Security News > 2020 > August > UK data watchdog having a hard time making GDPR fines stick: Marriott scores another extension, BA prepares to pay 11% of £183m penalty threat
British Airways expects the fine for its 2018 credit card data leak to be just 10.8 per cent of the £183m proposed by the UK data watchdog - while US hotel chain Marriott has both halved and kicked its own data blunder punishment into the long grass once again, The Register can reveal.
Marriott has secured an extension for fine negotiations to 30 September, having secured two already; one from January to 31 March and a second that ran through May. On top of that, the company set aside $65m to cover its proposed fine, down from the Information Commissioner's original intention to impose a £99m penalty.
An ICO spokeswoman confirmed the latest extension of Marriott's fine negotiation period to The Register, saying: "Under Schedule 16 of the Data Protection Act 2018, Marriott has agreed to an extension of the regulatory process until 30 September. We will not be commenting until the regulatory process has concluded."
Mishcon's Baines pondered whether the amount of ICO effort devoted to the two cases had disrupted its other data protection enforcement work: "One wonders if the effect of the BA and Marriott investigations has also been to cause work on other enforcement action to be paused, or at least delayed," he mused, referring to boasts from Information Commissioner Elizabeth Denham last year that she was about to announce more big GDPR fines.
Data protection fines across the European Union are generally increasing, though with Britain having issued just three fines since the EU regulation was enforced across the political bloc in 2018, it seems unlikely that we'll be contributing to this trend.