FTC Finalizes Order with Marriott and Starwood Requiring Them to Implement a Robust Data Security Program to Address Security Failures

The Federal Trade Commission finalized an order requiring Marriott International, Inc. and its subsidiary Starwood Hotels & Resorts Worldwide LLC to implement a comprehensive information security program to settle charges that the companies failed to implement reasonable data security, which led to three large data breaches affecting more than 344 million customers worldwide.

In a complaint first announced in October, the FTC charged that Marriott and Starwood deceived consumers by claiming to have reasonable and appropriate data security, when they in fact failed to deploy reasonable security to protect consumers’ personal information. These security failures resulted in at least three separate data breaches that enabled malicious actors to obtain vast amounts of personal information from hundreds of millions of consumers, including passport information, payment card numbers, and loyalty numbers, according to the complaint.

Under the order, Marriott and Starwood are required to establish a comprehensive information security program to help safeguard customers’ personal information, implement a policy to retain personal information only for as long is reasonably necessary, and establish a link on their website for U.S. customers to request for personal information associated with their email address or loyalty rewards account number to be deleted. The order also requires Marriott to review loyalty rewards accounts upon customer request and restore stolen loyalty points.

The companies are also prohibited from misrepresenting how they collect, maintain, use, delete or disclose consumers’ personal information; and the extent to which the companies protect the privacy, security, availability, confidentiality, or integrity of personal information.

After receiving two comments, the Commission voted 3-0-2to approve the final order and send responses to the commenters. Commissioner Ferguson and Commissioner Holyoak are recused from this matter.