Ok, gladly. It wasn't "good customer service" to give out clientele information. That alone should create some liability, who knows how much, but enough to stop this type of behavior. When you contract with a hotel, especially one that holds itself out like Mariott, you should have your information protected.
This becomes more obvious and important when the person is likely to be sought after, like a celebrity. Also, the celebrity's injury is going to be worth more, as their image value/business value/whatever is much higher in financial terms.
Lastly, giving out that information in such a way that a known stalker would be able use it in this way is reckless and deserving of even higher punishment. Marriot put the guy in charge of this information and therefore entrusted him to protect that information. Either they allowed this shit to happen, knowingly or recklessly, or they didn't oversee or maybe screen their people enough. All reasons for them to be liable.
And then the punishment should seek to address the injury, which considers the value to Andrews, but also the amount necessary to make Mariott change their practices.
To answer your simplistic question: yes, there is enough for me o say that he should have known giving out her information could lead to harming her, even if he might claim he didn't know it would quite be nudie/video bad.
