XML 25 R11.htm IDEA: XBRL DOCUMENT v3.22.1
Commitments and Contingencies
3 Months Ended
Mar. 31, 2022
Commitments and Contingencies Disclosure [Abstract]  
Commitments and Contingencies COMMITMENTS AND CONTINGENCIES
Guarantees
We present the maximum potential amount of our future guarantee fundings and the carrying amount of our liability for our debt service, operating profit, and other guarantees (excluding contingent purchase obligations) for which we are the primary obligor at March 31, 2022 in the following table:
($ in millions)
Guarantee Type
Maximum Potential Amount of Future FundingsRecorded Liability for Guarantees
Debt service$20 $
Operating profit182 112 
Other17 
$219 $121 
Our maximum potential guarantees listed in the preceding table include $45 million of guarantees that will not be in effect until the underlying properties open and we begin to operate the properties or certain other events occur.
Contingent Purchase Obligation
Sheraton Grand Chicago. In 2017, we granted the owner a one-time right to require us to purchase the leasehold interest in the land and the hotel for $300 million in cash (the “put option”). In the 2021 third quarter, we entered into an amendment with the owner to move the exercise period of the put option from the 2022 first half to the 2024 first half. If the owner exercises the put option, the closing is expected to occur in the 2024 fourth quarter, and we have the option to purchase, at the same time the put transaction closes, the fee simple interest in the underlying land for an additional $200 million in cash. We account for the put option as a guarantee, and our recorded liability was $300 million at March 31, 2022 and December 31, 2021.
Starwood Data Security Incident
Description of Event
On November 30, 2018, we announced a data security incident involving unauthorized access to the Starwood reservations database (the “Data Security Incident”). Working with leading security experts, we determined that there was unauthorized access to the Starwood network since 2014 and that an unauthorized party had copied information from the Starwood reservations database and taken steps towards removing it. The Starwood reservations database is no longer used for business operations.
Litigation, Claims, and Government Investigations
Following our announcement of the Data Security Incident, approximately 100 lawsuits were filed by consumers and others against us in U.S. federal, U.S. state and Canadian courts related to the incident. All but one of the U.S. cases were consolidated and transferred to the U.S. District Court for the District of Maryland, pursuant to orders of the U.S. Judicial Panel on Multidistrict Litigation (the “MDL”). The plaintiffs in the U.S. and Canadian cases, who generally purport to represent various classes of consumers, generally claim to have been harmed by alleged actions and/or omissions by the Company in connection with the Data Security Incident and assert a variety of common law and statutory claims seeking monetary damages, injunctive relief, costs and attorneys’ fees, and other related relief. Among the U.S. cases consolidated in the MDL proceeding was a putative class action lawsuit that was filed on December 1, 2018 against the Company and certain of our current and former officers and directors, alleging violations of the federal securities laws in connection with statements regarding our cybersecurity systems and controls, and seeking certification of a class of affected persons, unspecified monetary damages, costs and attorneys’ fees, and other related relief (the “Securities Case”). We filed motions to dismiss in connection with all of the U.S. cases. Our motions to dismiss the Securities Case and three shareholder derivative complaints (two included in the MDL proceeding and one filed in the Delaware Court of Chancery) were granted in 2021. The plaintiff in the Securities Case appealed the dismissal and the dismissal was affirmed by the U.S. Court of Appeals for the Fourth Circuit in April 2022. Motions to dismiss in the other MDL cases have been denied in part or in
whole and these cases remain at varying stages. On May 3, 2022, the U.S. District Court for the District of Maryland granted in part and denied in part class certification of various U.S. groups of consumers and we are evaluating how to proceed. The Canadian cases have effectively been consolidated into a single case in the province of Ontario. We dispute the allegations in the lawsuits described above and are vigorously defending against such claims. In April 2019, we received a letter purportedly on behalf of a stockholder of the Company (also one of the named plaintiffs in the Securities Case described above) demanding that our Board of Directors take action against certain of the Company’s current and former officers and directors to recover damages for alleged breaches of fiduciary duties and related claims arising from the Data Security Incident. In October 2021, we received a letter purportedly on behalf of another stockholder of the Company (also one of the named plaintiffs in one of the dismissed MDL Derivative Cases described above) demanding that our Board of Directors take action against certain of the Company’s current and former officers and directors to recover damages for alleged breaches of fiduciary duties and other claims related to the Data Security Incident or associated disclosures. The Board of Directors has constituted a demand review committee to investigate the claims made in these demand letters, and the committee has retained independent counsel to assist with the investigations. The committee has completed its investigation and reported its findings and recommendations to our Board of Directors, which thereafter resolved, in February 2022, to reject the demands in their entirety. In addition, on August 18, 2020, a purported representative action was brought against us in the High Court of Justice for England and Wales on behalf of an alleged claimant class of English and Welsh residents alleging breaches of the General Data Protection Regulation and/or the U.K. Data Protection Act 2018 (the “U.K. DPA”) in connection with the Data Security Incident. On November 5, 2020, the court issued an order with the consent of all parties staying this action pending resolution of another case raising similar issues, but not involving the Company. That other case was decided by the U.K. Supreme Court on November 10, 2021. The plaintiffs have informed us that they have decided not to pursue this case and the parties are in the process of preparing formal dismissal papers.
In addition, numerous U.S. federal, U.S. state and foreign governmental authorities made inquiries, opened investigations, or requested information and/or documents related to the Data Security Incident and related matters, including Attorneys General offices from all 50 states and the District of Columbia, the Federal Trade Commission, the Securities and Exchange Commission, certain committees of the U.S. Senate and House of Representatives, the Information Commissioner’s Office in the United Kingdom (the “ICO”) as lead supervisory authority in the European Economic Area, and regulatory authorities in various other jurisdictions. With the exception of the ICO proceeding, which was resolved in October 2020, these matters generally remain open. We are in discussions with the U.S. state Attorneys General, the U.S. Federal Trade Commission, and certain regulatory authorities in other jurisdictions to resolve their investigations and requests.
While we believe it is reasonably possible that we may incur additional losses associated with the above described proceedings and investigations related to the Data Security Incident, it is not possible to estimate the amount of loss or range of loss, if any, in excess of the amounts already incurred that might result from adverse judgments, settlements, fines, penalties or other resolution of these proceedings and investigations based on the current stage of these proceedings and investigations, the absence of specific allegations as to alleged damages, the uncertainty as to the certification of a class or classes and the size of any certified class, if applicable, and/or the lack of resolution of significant factual and legal issues.