March 9th, 2016
Law360
Erin Andrews Verdict Exposes Danger Of Lax Privacy Policies
By Cara Salvatore
Law360, New York (March 8, 2016, 11:02 PM ET) — Erin Andrews’ $55 million jury verdict on Monday against a hotel where she was stalked and videotaped shows that hotels with weak privacy practices need to get their houses in order by locking in written guest-confidentiality policies, experts say.
A Nashville jury awarded sports reporter Andrews $55 million of the $75 million she had sought against the Nashville Marriott at Vanderbilt University, a franchise owned by West End Hotel Partners and operated by Windsor Capital Management. It attributed 49 percent of the fault to them and the other 51 percent to Andrews’ stalker Michael David Barrett, who in 2008 stalked and filmed at least 10 women at hotels all over the country, according to various testimony from both sides.
Andrews accused the hotel of giving out her room number to Barrett and granting his request to be placed in a room adjoining hers. Barrett told a conflicting story at trial about how he got her room number.
But privacy experts say that what was so strange about this case is that the hotel didn’t have written training materials regarding guest confidentiality.
Hotels need written guidelines telling employees exactly what to do if they get phone calls asking for guest information, said Stephen Ma of Early Sullivan Wright Gizer & McRae LLP.
“The world is filled with dangerous situations … and at some point, there’s got to be some sort of guidelines established internally to make sure that people staying with the hotel are protected,” he said. “I mean, what if this is a person who showed up with a gun or something?”
At trial, Andrews’ attorneys grilled staff on the hotel’s privacy policy and argued that its lax guidelines on guest information allowed Barrett to get Andrews’ room number.
Former front desk supervisor Naina Rivera-Keen testified that the Nashville Marriott had no written policies on giving out guest information.
“In terms of any written policies or procedures, they gave you nothing about privacy policy for guests, right?” Bruce Broillet, Andrews’ co-lead attorney, asked.
“Correct,” Rivera-Keen said.
And Marriott International reservations executive Renee Buonincontri testified that in 2008, if Barrett called and requested a room next to Andrews, it wouldn’t have been required for the hotel to call Andrews and make sure that was OK. Marriott International was dropped as a defendant months before trial.
All this shows how important a properly written privacy protocol is, according to Neil Ray of One LLP .
“[It] confirms to guests how hotels collect, use, and disclose personal data of their guests; how they ensure that that data is stored safely and securely; and … how they protect against any intrusion of seclusion that guests can reasonably expect in their hotel room,” Ray said.
This helps hotels avoid liability, given that the kind of information they may have on a guest goes far beyond their room number.
“Hotels have a lot of sensitive information about their guests. It could include vehicle information; sometimes you have to give your passport information,” he noted.
Andrews broke down repeatedly while testifying about the video, describing sleeplessness and depression, as well as then-employer ESPN’s refusal to allow her back on the air until she had agreed to be interviewed by Oprah. She said the Nashville Marriott never warned her that a man had requested the room next to hers.
“Did anybody from the hotel call you and tell you that a man called?” Andrews’ lawyer asked her at one point.
“No one ever called me. No one ever checked with me and told me that he asked to be put next to me,” she said.
Attorneys for the hotel owner and operator said in their closing that staffers were trained in privacy protocol and that the hotel was on guard against every foreseeable harm. But Barrett’s ends could never have been predicted, they said.
“It was not foreseeable that some criminal would go to the steps that he did,” said Marc Dedman of Spicer Rudstrom. “And by the way, he also did it to Ms. Andrews at [two other hotels]. He also did it to 10 or 15 women at other hotels around this country.”
He added: “That someone would take that and upload it to the Internet, is that foreseeable?”
It’s not clear what the franchise’s policies are these days or whether Marriott has added strict franchise requirements to the extensive franchisee standards it imposes in other areas. Representatives for Marriott were not immediately available for comment.
Even though Marriott International was dropped as a defendant, the case still should serve as a cautionary tale for franchisors, said Randy Sabett, vice chair of the privacy practice at Cooley LLP.
“You have a publicly known and a significantly valuable brand,” Sabett said. Companies like that “need to carefully negotiate those provisions in their agreements that deal with privacy, data breaches, security — all the way through the supply chain. Obviously, the brand tarnish you can never get away from. Emblazoned on the top of the building, I am sure, is a huge Marriott symbol.”
Franchisors take a risk when they lend their names to other corporations, Sabett said. But there are steps they can and should take to protect themselves. They may not be able to write into a contract that they can have recourse for “the brand hit you might take,” Sabett said, but they should be able to lock down compensation for costs incurred because of a breach or subsequent litigation.
And there are a lot of companies still out there that are more exposed than they may realize, he said.
“In the past couple of years, I have seen an increased sophistication on a number of levels with a variety of companies in all different types of business with respect to cybersecurity,” Sabett said. “Could there be companies that are behind? Sure. And we see them all the time.”
Andrews is represented by Bruce Broillet, Scott Carr, Tobin Lanzetta and Molly McKibben of Greene Broillet & Wheeler LLP and Randall Kinnard of Kinnard Clayton & Beveridge.
The hotel is represented by Aubrey Harwell III of Neal & Harwell and Brent Usery and Marc Dedman of Spicer Rudstrom.
The case is Erin Andrews v. Marriott International Inc. et al., case number 11C4831, in the Circuit Court for Davidson County, Tennessee.