Financial and Legal Repercussions
and will pay $52 million to 49 states and the , resolving claims related to data breaches affecting over 344 million customers.
The settlements, one with the FTC and another with state attorneys general, require Marriott to implement a comprehensive information security program and allow customers to request personal data deletions.
Security Enhancements and Customer Protections
Marriott and Starwood must establish a robust security program, undergo third-party assessments every two years, and limit data retention.
Customers will have new rights, including the ability to request the deletion of their personal information and to report unauthorized activity in their loyalty accounts.