In the event of a Compromised Data Event at a Crowne Plaza franchise, who is responsible for the cost of the independent investigation and forensics analysis?
Crowne_Plaza Franchise · 2025 FDDAnswer from 2025 FDD Document
- 4.4 Your Compromised Data Event. If a Compromised Data Event (as defined in Section 4.8) occurs or is suspected to have occurred, you must, at your own expense: (a) perform or cause to be performed an independent investigation, including a forensics analysis performed by a certified forensic vendor acceptable to us and the Card Organizations in accordance with Card Organization standards, of any data security breach of Cardholder data or Transaction Data; (b) provide a copy of the certified forensic vendor's final report regarding the incident to us and the Card Organizations; (c) perform or cause to be performed any remedial actions recommended by any such investigation; and (d) cooperate with us in the investigation and resolution of any security breach. Notwithstanding the foregoing, if required by a Card Organization, we will engage a forensic vendor approved by a Card Organization at your expense. You must cooperate with the forensic vendor so that it may immediately conduct an examination of your equipment and other Merchant Systems, and your and Merchant Providers' procedures and records, and so that it may issue a written report of its findings.
- 4.5 Our Data Security Event. If we are determined by a Card Organization to have breached our data security obligations under Applicable Law or the Card Organization Rules, resulting solely from our independent acts or omissions which results in the actual, unauthorized disclosure of personally identifiable consumer information, including but not limited to Cardholder data that is submitted to us by you hereunder, (a
Source: Item 23 — Receipts (FDD pages 100–424)
What This Means (2025 FDD)
According to Crowne Plaza's 2025 Franchise Disclosure Document, if a Compromised Data Event occurs or is suspected to have occurred, the franchisee is responsible for the cost of the independent investigation and forensics analysis. Specifically, the franchisee must, at their own expense, perform or cause to be performed an independent investigation, including a forensics analysis by a certified forensic vendor acceptable to Crowne Plaza and the Card Organizations.
This includes providing a copy of the forensic vendor's final report to Crowne Plaza and the Card Organizations, performing any recommended remedial actions, and cooperating with Crowne Plaza in the investigation and resolution of any security breach. However, if a Card Organization requires it, Crowne Plaza will engage a forensic vendor approved by the Card Organization, but the franchisee will still bear the expense.
In contrast, if Crowne Plaza is determined by a Card Organization to have breached its data security obligations due to its own independent acts or omissions, resulting in the unauthorized disclosure of consumer information, Crowne Plaza will be responsible for performing the actions outlined in subparts (a) and (c) of Section 4.4, which include performing the independent investigation and any remedial actions.