Andrew Dinsmore has been instructed to act on behalf of the claimants to bring a group action against the Marriott group following the disclosure of a large-scale, high-profile data breach affecting over 500 million people dating back to 2014. For over 327 million guests, the data collected by hackers included ‘some combination’ of name, address, phone number, email address, passport number, account information, date of birth and gender. Further, there is concern that encrypted card information and encryption keys may have been stolen. The case will raise issues under both the Data Protection Act 1998 (for those breaches prior to 25 May 2018) and under the GDPR and the Data Protection Act 2018 (for those after 25 May 2018) alongside breach of confidence, misuse of private information, negligence and breach of contract.

Media reports of the data breach can be found here.