It has been a tough week for Marriott International. In a matter of hours on Tuesday, the company was hit with a multimillion-dollar fine by the United Kingdom's Information Commissioner's Office (ICO) for a November 2018 data breach that exposed the information of millions of guests, and then it was sued by the District of Columbia over allegedly deceptive "drip pricing" practices that tacked on hidden fees to hotel bills.
The U.K.'s ICO said it plans to impose a fine of 99.2 million British pounds (roughly US$124 million) against the Bethesda, Md.-based hotel conglomerate over the hacking of subsidiary Starwood's central guest-reservation database, which exposed the data of up to 383 million Marriott guests, including 7 million related to British residents.
Though discovered last November, the breach was traced back to 2014, several years before Marriott's acquisition of Starwood in 2016. Marriott later pulled the hacked system from its operations. The ICO in a statement said its investigation found that Marriott "failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems."
ICO's information commissioner, Elizabeth Denham, said in the statement, "Personal data has a real value, so organizations have a legal duty to ensure its security, just like they would do with any other asset. If that doesn't happen, we will not hesitate to take strong action when necessary to protect the rights of the public."
"We are disappointed with this notice of intent from the ICO, which we will contest," Marriott CEO Arne Sorenson said in a separate statement. "We deeply regret this incident happened. We take the privacy and security of guest information very seriously and continue to work hard to meet the standard of excellence that our guests expect."
Hours later, Marriott International was sued by the District of Columbia over allegedly deceptive "drip pricing" practices that tacked on hidden fees to hotel bills.
According to the complaint, which included actual screen shots of Marriott hotel online booking sites, Marriott failed for more than a decade to disclose certain fees when advertising room prices. These hidden fees, which can add as much as $95 a day to the daily room price, applied to listings on Marriott's own website as well as online travel agency sites such as Expedia and Priceline, the complaint charged.
"By charging consumers resort fees in addition to the daily amounts consumers must pay for their rooms, Marriott makes hundreds of millions of additional dollars in revenue without appearing to increase the price for which it initially offers its rooms," the suit claimed. "Marriott's unlawful trade practice has affected District consumers, as Marriott has charged resort fees to tens of thousands of District consumers over the years, charging those consumers well in excess of $1 million."
According to the complaint, which identified 189 Marriott properties worldwide that allegedly engaged in deceptive pricing, the charges for hotel rooms were sometimes grouped as "taxes and fees" and not presented until after customers had already entered their credit card information. In other cases, the fees were advertised as covering amenities, such as parking, that were either complimentary or that guests had to pay for when they got to the hotel even after paying a resort fee, according to the complaint.
The lawsuit cited a 2017 Federal Trade Commission report that said, "Separating mandatory resort fees from posted room rates without first disclosing the total price is likely to harm consumers by artificially increasing the search costs and the cognitive costs of finding and booking hotel accommodations."
The District of Columbia's lawsuit against Marriott International came out of an ongoing investigation conducted by the attorneys general of all 50 states and D.C. into industrywide practices regarding fees. Karl A. Racine, attorney general for D.C., cited timing as a factor contributing to why the District chose to move forward with its own lawsuit while discussions among state attorneys general and the hotel industry continue.
When contacted for this story, Marriott said it does not comment on pending litigation.