It’s been over a year and the proposed GDPR fines against Marriott and British Airways haven’t been finalized yet. Lawyers argue the delay stems from the challenge of setting a precedent that puts a bite into regulators’ actions but doesn’t get dismantled in court for overreach. 

In early July 2019, the United Kingdom’s Information Commissioner’s Office (ICO) announced an intention to fine British Airways for $230 million, citing General Data Protection Regulation (GDPR) violations after the airline’s site was compromised. The breach exposed the personal data of hundreds of thousands of customers.