What to Expect From Class-Action Lawsuits Against Marriott
You might get some compensation for the data breach, but it will probably be small
In an all-too-familiar scenario, Marriott announced last week that 500 million consumers had their information compromised in a data breach of the company’s Starwood hotel properties, including Westin, W, and Sheraton. (Marriott acquired Starwood in 2016.)
The breach involved unauthorized access to Starwood guest information going back to 2014. Marriott caught on to the hack in September of this year but didn't announce the breach until last week.
The information that hackers gathered included customers' names, mailing addresses, phone numbers, email addresses, passport numbers, Starwood Preferred Guest account information, dates of birth, gender, and reservation dates. Some customers may have had their payment card numbers and payment card expiration dates hacked.
Given the massive size of the breach, it’s no surprise that multiple lawsuits seeking class-action status have already been filed on behalf of consumers affected by the breach.
“To miss a data breach of this scope makes you wonder if Marriott was doing its due diligence when it acquired Starwood,” says Amy Keller, a partner at DiCello Levitt & Casey, a Chicago law firm that filed one of the class-action suits.
Marriott said it doesn't comment on pending litigation.
For Marriott and Starwood customers, the waiting game begins. It's still not clear which guests had their data compromised; Marriott is only beginning to notify affected customers. For those whose personal information has been hacked, you may find yourself automatically included in a class-action suit. (You can opt out, as we note below.)
Be aware that if you suffered serious financial, physical, or other harm and you participate in a class-action lawsuit, you give up your right to sue a company on your own.
What to Consider
If you’re thinking about joining one of the suits in connection with the Marriott breach, there isn’t much you can do right now. A class-action lawsuit can’t proceed without approval of the courts, and these multiple class actions could be consolidated into one or just a few larger cases.
But here’s what you should keep in mind as details of these suits emerge:
There are many ways to find out about class actions. As a potential member, you might hear about a class-action suit when it's filed. "In a case like Marriott, where the company has email addresses and other contact information for every single person affected by the data breach, notice should be straightforward," says Gilles.
You don’t need to do anything to be covered. Class-action lawsuits automatically cover everyone the court determines to be part of the class. So if your data was breached, you’ll automatically be included and entitled to any benefits once the case is resolved. Because the legal fees come out of the settlement, you won’t be asked to pony up any money.
You can opt out of a class action seeking damages. If you do, you’ll preserve your right to sue on your own, says Jeff Sovern, a professor at St. John’s University School of Law in New York. If you suffered serious harm, you should consult an attorney to discuss your options, Slover advises.
You’ll have to decide whether it’s worth filing a claim. In some cases, you may have a choice of accepting either a default payment or applying for a higher amount based on any proof you have that your losses were higher. “Many consumers find it more of a bother to fill out the forms to get payment than the compensation is worth, depending on how much money they would receive," says Sovern.
You’ll also have another opportunity to opt out or file an objection with the court if you think the settlement is too little, Gilles says.