Slashdot Mirror
Hilton Paid a $700K Fine For 2015 Breach; Under GDPR, It Would Be $420 Million (digitalguardian.com)
chicksdaddy writes from a report via Digital Guardian: If you want to understand the ground shaking change that the EU's General Data Protection Rule (GDPR) will have when it comes into force in May of 2018, look no further than hotel giant Hilton Domestic Operating Company, Inc., formerly known as Hilton Worldwide, Inc (a.k.a. "Hilton."). On Tuesday, the New York Attorney General Eric T. Schneiderman slapped a $700,000 fine on the hotel giant for two 2015 incidents in which the company was hacked, spilling credit card and other information for 350,000 customers. Schneiderman also punished Hilton for its response to the incident. The company first learned in February 2015 that its customer data had been exposed through a UK-based system belonging to the company, which was observed by a contractor communicating with "a suspicious computer outside Hilton's computer network." Still, it took Hilton until November 24, 2015 -- over nine months after the first intrusion was discovered -- to notify the public. That kind of lackluster response has become pretty typical among Fortune 500 companies (see also: Equifax). And why not? The $700,000 fine from the NY AG is a palatable $2 per lost record -- and a mere rounding error for Hilton, which reported revenues of $11.2 billion in 2015, the year of the breach. That means the $700,000 fine was just %.00006 of Hilton's annual revenue in the year of the breach. Schneiderman's fine was less "bringing down the hammer" than a butterfly kiss for Hilton's C-suite, board and shareholders.
But things are going to be different for Hilton and other companies like it come May 2018 when provisions of the EU's General Data Protection Rule (or GDPR) go into effect, as Digital Guardian points out on their blog. Under that new law, data "controllers" like Hilton (in other words: organizations that collect data on customers or employees) can be fined up to 4% of annual turnover in the year preceding the incident for failing to meet the law's charge to protect that data. What does that mean practically for a company like Hilton? Well, the company's FY 2014 revenue (or "turnover") was $10.5 billion. Four percent of that is a cool $420 million dollars -- or $1,200, rather than $2, for every customer record lost. Needless to say, that's a number that will get the attention of the company's Board of Directors and shareholders.
But things are going to be different for Hilton and other companies like it come May 2018 when provisions of the EU's General Data Protection Rule (or GDPR) go into effect, as Digital Guardian points out on their blog. Under that new law, data "controllers" like Hilton (in other words: organizations that collect data on customers or employees) can be fined up to 4% of annual turnover in the year preceding the incident for failing to meet the law's charge to protect that data. What does that mean practically for a company like Hilton? Well, the company's FY 2014 revenue (or "turnover") was $10.5 billion. Four percent of that is a cool $420 million dollars -- or $1,200, rather than $2, for every customer record lost. Needless to say, that's a number that will get the attention of the company's Board of Directors and shareholders.
The fines are one thing, but there needs to be criminal liability for senior management too. They want the big money, well the risk, responsibility and liability comes with it. Dont want the risks etc then get a Job like the rest of us.
$700,000 is small change for a corporation as big as Hilton, but make no mistake, the guy or team that cost Hilton $700,000 felt the pain, when it filters down to the IT managers and what kind of money they represent to Hilton and what they cost, $700,000 error is big. No bonus for the IT team this year!
If you want news from today, you have to come back tomorrow.
See Subject
Well, if companies just decide to put data on UK servers and have UK HQs, and I am predicting a brexit that will allow most companies there to do business with the rest of Europe but still not abide to the EU court, I can already imagine the loopholes most companies are gonna abuse for simply ignoring that problem. Then again, I am hoping my elected representatives in the EU parliament won't be that fool.
Imagine if you and I could do crimes like corporations.
Rule 1: You NEVER go to prison. Period. Shutting down a company? Unthinkable!
Rule 2: You, at worst, pay fines, that are relative to your yearly income!
Rule 3: The files will be limited to silly meaningless amounts like 4%. So, what, like $1600-3200? Not the usual fines that easily swallow more than the average person makes in a year, up to many millions.
Yeah. How much does a company get for murder?
Well, let's use Microsoft as an example.
What do you get for regularly having sex with people, injecting your pathogen into them, eating them out from the inside, and impersonating them, by wearing their skins?
Well, the "fine" of being allowed to ejaculate crack "licenses" over schoolchildren of a school, that cost you absolutely zero to produce, but hooks more children to your crack.
Yeah, if corporations were actually people ... SAW and The Devil's Rejects would be what happens everywhere, every day, all day.
%.00006 of $11.2B is $7,000.
Every country has their own instance of the company. So in this case there will be a Hilton that owns Hilton USA, Hilton UK, Hilton Canada, etc. The data breach took place in the UK so the maximum fine would be based on revenue of the previous fiscal year of Hilton UK, not Hilton (Worldwide). Unless they propose on fining companies that aren't responsible for the data breach.
And if they do decide to go after the global entities then all they will do is create separate companies to handle all of the customer data processing that are paid just enough to keep things running. Then Hilton will say the data breach will the fault of Hilton Customer Data Processing Company and the fine will be minimal.
I'm not saying how these companies have acted is right. I think that there should be jail time involved for the CxOs instead of large fines for their inept handling of customer data (and especially those that brought about the global financial crisis).
I don't see a link to the law in the article so I have to assume its language is correct. "can" isn't "will". I doubt we'll ever see a company hit with a 4% fine.
Also, since NY settled, I'd guess they didn't take as much as they might have either. I see no indication in the article as to what they could have gotten.
> After 100 years. In a similar fashion businesses that are a 100 years old should also become public domain. That means the Hilton Hotel is now a public domain business.
Uhm, Hilton is less than 100 years old.
It is, however, publicly owned
https://finance.yahoo.com/quot...
> So feel free to book a free Hilton hotel room for yourself, friends and family.
You realize most hotels with a Hilton sign aren't owned by Hilton, right? Individual hotel owners pay the brands a monthly fee to use the sign and get booking referrals from hilton.com
>. get a Job like the rest of us.
That's precisely what any intelligent person would do if any mistakes by any of the thousands of employees at the company could cause the executives to go to prison. Only stupid or extremely ignorant people would accept an executive title. A company could either hire morons to actually run the company, meaning your job and your 401k would soon be gone, or have a string of puppets, where the moron who holds the title of CEO is controlled by people whose involvement is well hidden. The really stupid and desperate person, probably a crack head who had recently been homeless, would have the title "CEO". A crooked and easily influenced person, called the DWS, would relay orders to them from the person actually in control.
I may be completely wrong, but it seems to me a company has to be fined in proportion to its profits, not its turnover.
While it can be really hard to maximize profits for some businesses, it's extremely easy for every business to reduce profits. If the fine was tied to profits, all a bad-faith corporation would have to do is to ensure it posted low/zero/negative profits in a year when a breach occurred to minimize its penalty. Recall that it's the business reporting the breach in the first place, so timing a loss quarter with a breach could also be quite easy.
The point of a fine is to ensure the business performs all due diligence to avoid the issue. If the amount is 0.006% of revenue like the Hilton fine, it's easily swept under the rug as a cost of doing business. If it presents a real threat to the business, there's actually a chance the fine might be taken seriously and affect the change it is intended to. It's good that a business could go under as the result of running afoul of the law.
The key part of the fine provision (Article 83) is that there is an opportunity to fine €20 million (reduced from €100 million in earlier drafts) or 4% of global annual turnover (whichever is higher), for Tier 2 violations (e.g. violations of data subject rights), while this is halved for Tier 1 violations (breach of data controller/processor obligations). Given that the organisation was hacked and data leaked, they are perhaps at most guilty of negligence in their obligations as data controllers, which would imply a Tier 1-style fine. Similarly, provided they took adequate provisions to meet their obligations as data controllers, it's difficult to imagine that the higher end of the fine would be sought, either (as opposed to a more willful violation, as per Equifax). The fine would still be likely to be higher than the $700k outlined, but would never approach anything near the fantastical $420 million suggested.
You are wrong. 20 M Euro is not a ceiling, it's a floor. A lot of other arm-chair advocates here are also wrong. This legislation, as written, has quite a bit of teeth in it and is extremely hostile to big business. Outsourcing only works if you do your due diligence very thoroughly and then there shouldn't be a breach, should there. It will be very interesting to see some of the pilot cases come through the legal system over the next two years. I assume Google, Microsoft Apple and Amazon will all be targeted early on. The site below has a lot of information. http://www.eugdpr.org/key-chan... ” Under GDPR organizations in breach of GDPR can be fined up to 4% of annual global turnover or €20 Million (whichever is greater). This is the maximum fine that can be imposed for the most serious infringements e.g.not having sufficient customer consent to process data or violating the core of Privacy by Design concepts. There is a tiered approach to fines e.g. a company can be fined 2% for not having their records in order (article 28), not notifying the supervising authority and data subject about a breach or not conducting impact assessment. It is important to note that these rules apply to both controllers and processors -- meaning 'clouds' will not be exempt from GDPR enforcement.”
Shrug. So Hilton shut down and we all use one of the other 99.97% of hotels available.
No loss.
Fines can be up to 4% of annual turnover, but if your turnover is less than 800m then your fine can be up to 20m anyway. Yes, it's possible to receive a fine that's four times your annual turnover if you're a small business.
Those are explicitly stated though as the maximum fines. The legislation does allow for lower fines and in the UK the ICO has indicated that they'd prefer to avoid fines where possible and impose substantially smaller fines where needed.
I may be completely wrong, but it seems to me a company has to be fined in proportion to its profits, not its turnover.
Profit is manipulable, turnover far less so without actual fraud.
To have a right to do a thing is not at all the same as to be right in doing it
So this regulation is hostile to small business while it wonâ(TM)t affect big business. Great, exactly what we need.
Custom electronics and digital signage for your business: www.evcircuits.com
More than that, all the hotels would be open the next day under new ownership so there would be zero loss of anything.
To be honest, I'm not ever sure that Hilton could shut down as its really just a franchise. The hotels are not generally owned by Hilton, who are simply paid a franchise fee for the brand and booking systems. Shutting down 'Hilton' in the EU would just lead to multiple lawsuits from the franchisees for breach of contract.
Against whom, and for what?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Was thinking this myself.
It's all nice and good that someone wants to give companies the [additional] impetus they need to "do the right thing" and shore up their data security, but being greedy bastards along the way (talking about the government greedy bastards this time) without any information as to how that money would be spent, that's just wrong.
If a government is going to fine a company for their data breach so heavily, shouldn't they be making themselves responsible for helping the consumers that were injured in that breach using the windfall they just made for themselves with the fine?
But, knowing the way things work, they will not only fine the company, but also require the company to provide identity theft remediation for those affected, effectively a double hit for the offending company.
So many different thoughts on this... I can see it from too many directions. As a consumer, if my data gets stolen, I would want to be sure that I was somehow taken care of. But if the government levies a fine that is so egregious as to prevent that company from having sufficient funds to even be able to take care of the consumers that have had their personal data compromised, where is the benefit in that?
Again the issue is WHO benefits from the fine? If it's not the consumer, but some greedy government body, then perhaps the consumers should sue the government for their share of the fines.
Against Hilton Worldwide Holdings, Inc for breach of the franchise contract. I imagine they have contractual obligations to supply services to franchisees (bookings, etc) and franchisees have a license to use the name and business processes.
They don't own the hotels - they license the name and business model/services. Its a franchise - http://www.franchisedirect.com.... To shut down they would have to have the agreement of all the businesses that have a franchise. Why would a local business with a Hilton Hotel in Little Uppington agree to destroy their business because of some dispute between Hilton Worldwide Holdings, Inc and the EU?
Good luck suing a US company from outside. You wouldn't stand a cat in hells chance of collecting even if you won.
And if the contract is with a local subsidiary, good luck suing a business when it doesn't exist any more.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
You're talking like its Jimmy's Breaks and Shocks and his 3 franchisees in Belize. Many of these franchisees are also multi-national companies, with hotels across the world. You'd need to be some crazy ass cowboy executive to give away all your European assets, trademarks and current and future income as well as your goodwill across the world (how are your other franchisees going to feel about you simply abandoning your European franchisees out of spite). And you would still owe the fine, still have to go through the lawsuits (no matter how sure you are they'd win), face diplomatic pressure and have to explain it to the shareholders.
And the EU hotels would now have free reign to use the Hilton name without any need to pay.
All consumers benefit when companies start taking security seriously. This is a deterrent, not a tax. If companies just pay up then it's not working and something more onerous will be created.
It could be 420 Million, but I very much doubt it would be. So the subject is incorrect.
I'm looking over the CRA/FCA handbook and I don't immediately see anything relevant to this discussion. Perhaps you can point out what you're talking about?
https://www.handbook.fca.org.u...
I see if a company criminally defrauds the government, the people involved in perpetrating that crime can (of course) be held criminally liable.
I don't see anything about "all the executives go to prison if a sysadmin doesn't a do a good job patching or a server, or any other security mistake". Can you help me find that?
> If I am booking Hilton I expect to be staying at Hilton
Which is precisely the benefit of franchising.
With franchising, when you travel to a new city you'll see these options in hotels and food:
Hilton
Super 8
McDonald's
Wendy's
Though you've never been to that city before, you can make a reasonable choice because you know what to expect from a Hilton, from a Super 8, and from a McDonald's.
Without franchising, when you visited a new city you'd see these choices:
Bob's Hotel
Hotel Mary
Frank's Burgers
Jeff's burgers
Which hotel is better? Which burger place will also have baked potatoes? No telling.
The franchise system means you, the consumer, can know more or less what you're going to get, by looking at the sign, though you've never been to that person's restaurant or hotel before. You know a McDonald's, any McDonald's, is going to offer certain menu choices, at a certain level of quality. You know what to expect from any hotel with a "Hilton" sign, without needing to know what particular owner ahead of time.
Thank you for that link. I see the first half of the speech discusses the age-old problem of determining who is responsible, the specific people who did the crime vs the company they work for. That is, of course, fact-dependent, but the question posed is "is the human person who actually, physically did the crime responsible, or the company" - there is no mention of "all the executives who work at the company" being imprisoned. That idea is found only on Slashdot, not in any law anywhere in the world (because it's a stupid idea).
The paper/speech then goes on to discuss the new UK law and the regulator is careful to clearly point out to facts, to avoid any confusion: ...
----
First, the duty of responsibility does not create a
separate and independent basis for senior
management liability.
Secondly, a senior manager is not liable just because
the firm has breached a requirement
-----
He's careful to point out it does NOT create a new liability and does NOT make an executive liable every time an employee, or the organization as a whole, commits a criminal act.
He explains:
-----
In enforcing this duty, the FCA must establish:
first that the firm committed a relevant contravention of our requirements;
secondly that the defendant was the senior person responsible for the activities in question, and
thirdly the defendant failed to take such reasonable steps to avoid or prevent the firm from contravening.
-----
So it applies to specific criminal violations of Financial Conduct Authority requirements, not just any random screw up, so the appropriate senior managers can know exactly what they are responsible for.
Secondly, the requirements are divided up among specific senior manager roles, so again one specific executive, such as the CFO, has a list of the specific compliance items he is expected to make an effort on.
Thirdly, he's required to make a reasonable effort, no more or less. If an employee, or several employees, don't follow the law despite his reasonable effort to formulate appropriate policy, he's not liable.
So each person in an executive management role has their list of things for which they must make a reasonable effort toward compliance. That's quite different from:
> if any mistakes by any of the thousands of employees at the company could cause the executives to go to prison
Umm Hilton is 100 years old and that whole idea is stupid. If I own a house thatâ(TM)s been in my family 99 years does that mean next year I have to give it to the public? What about a ring? Should I sell it and make sure my neighbors split the profit? What if my house is used to house antiques from my family and I charge an entry fee? Next year itâ(TM)s not mine but yours? Itâ(TM)s my familyâ(TM)s house and antiques. Iâ(TM)m just the lucky one to have it the 100 mark. How about you start something big to pass down to your own. Socialism at its finest. BTW I am just a plain Jane Joe shmo like you. Believe in working for what I have. But if I had anything from my ancestors I believe it should be mine.