Enforcement · Autoriteit Persoonsgegevens EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Booking.com B.V.: Insufficient fulfilment of data breach notification obligations

€475,000 Fine
Booking.com B.V.
THE NETHERLANDS
Art. 33 GDPR
Notification Obligation Data Breaches Notified Body Reporting and Notification Obligations Article 19 GDPR - Notification of Rectification, Erasure or Restriction Security Controllers Healthcare Processing Agreement
Dec 10, 2020 Source

How it connects

Related across sources

Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 01/2021 EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Guidance Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review

Full text

The Dutch DPA (Autoriteit Persoonsgegevens) has fined Booking.com EUR 475,000 for not reporting a data breach to the DPA in a timely manner. In December 2018, criminals gained access to the data of 4,109 people who had booked a hotel room through the booking site. That included their names, addresses and phone numbers, as well as details about their booking. The criminals also accessed the credit card data of 283 people and managed to access the credit card's security code in 97 cases. Furthermore, they tried to get other victims' credit card details by pretending to be Booking.com employees via email or phone. Booking.com was notified of the data breach on January 13, 2019, but did not report it to the DPA until February 7, 2019. The controller was thus 22 days late in reporting the data breach, as it is required to report a data breach to the DPA within 72 hours.

Industry: Accomodation and Hospitality

Original document at the source autoriteitpersoonsgegevens.nl

Similar Content