Booking.com fined €475k for reporting data breach too late

This fine is just for their Dutch operations, which is far smaller than their global operation. I estimate this to be about 1% of their expenses in NL, so in your analogy, this'd be a $2k fine.

Also: the crime isn't that bad. They did reported the breach on their own accord, and acted according to the laws at hand. The report may have been two weeks too late, but it was there. Their preventative measures and reaction were deemed good enough, just not timely. A crippling fine wouldn't have been appropriate, given the verdict.

The company could have avoided the fine by doing exactly the same thing they did, just a little faster. The fine counterbalances the cost-savings they may have had by having fewer people work on this. A future manager will probably see the fine, and decide just to put a little more resources into this, so the report can be on time. When that happens, the fine has served its purpose.

I guess the idea is to make it hurt, not ruin a business. How would 0.5M fine hurt a business with 4B revenue you may ask, but I think that it will hurt the people responsible for the leak since it will be known within the company that someone screwed up or someone is pure evil, two labels that you don't want to get in a workplace.

Companies spend a lot of money and energy on projecting an image, not only to the outsider but also to the insiders.

Unless they pride themselves for being evil and the cut-throat office politics, I bet this fine will make a dent in someones image and will trigger some policy change or similar.

Companies are not really monoliths, despite of their effort to be seen as such.

On GDPR, it seems HN has two completely opposing reactions depending on the time since a fine has made headlines. If it's been a while, the prevailing sentiment seems to be "the big bad EU will financially ruin me for my side project if I don't hire a full-time data protection lawyer", and when a fine is actually issued, it's "that's not even a slap on the wrist, who's going to care, lol". It's almost as if EU data protection agencies reacted proportionately to the severity of the misdeed. This is a leak affecting 4109 customers, after all, not a full compromise of booking's systems.

Is the fine a "EU fine" or a "Netherlands fine"? I'd expect the fine to be proportional to the territory issuing it, not to the total global value of the company. You would not expect this fine to be e.g. 10% of the company global valuation, and then when other 9 countries issue a similar fine and destroy the company.

Netherlands being 1% of the global GDP, this would be proportional to a $50B "global fine" or 50% of the company valuation. So in that sense, it even seems too big.

EU being 20% of the global GDP, this would be proportional to a $2.5B "global fine" or 2.5%, which IMHO seems small-to-fair for a data leak of this type.

Well, at least it is progress from no fines at all or 1000$ fines.

Still, should be 10 or 100 times more.

> They have a $100B enterprise value

That number is meaningless for how much a company is hurt by a fine. A market valuation is just based on the current stock price. It doesn’t mean that the company has access to that much cash or assets.

Keep in mind that if they do it again the fine will be much larger. This isn't the USA, and the Dutch DPA is not the FTC. If Booking.com does this again the next fine will be much larger.

They used to make ~$4B/yr.

> Interesting precedent. The platform is responsible not just for their own security practices, but also their users' security practices.

Well, not really. Booking didn't get fined over security practices. They got fined over not notifying of a breach of their users data within 72 hours.

So you're not really "responsible for users' security practices", you're "responsible for notifying users/authorities in time when you notice leaks/breaches". Seems rather different to me.

On the other hand, if we consider the hotels as just a "user", why would they have access to full CC details, including security code.

As someone booking a hotel on the site, I would expect booking.com to take responsibility for keeping my payment details secure (or, if they want to operate like a marketplace, make it clear that they're not taking responsibility, but in that case it looses a lot of value toe as an end user)

While the individuals themselves may be thought of as users, they are employees of 3rd party partners who act as data handlers and/or data processors. As such it is entirely appropriate that the platform is responsible for this compromise (although depending on the terms of the contract, they could seek restitution from the 3rd parties.

If you as a consumer give your booking.com login information to someone and your information is subsequently stolen, Booking.com would not be responsible for your security practices.

>but also their users' security practices.

Of course, as the leak would be traced to them as well. When it comes to GDPR you'd like to manage the expose and the liability associated with having the data. Normally it should that even the admin operators are not to be trusted with full account/payment/etc. details enmasse and very special care is taken to exports/reports.

The SEC has a whistleblower program. A material breach of a public US company is definitely of interest to them.

As far as I know there is no legal basis for them to contact the banks, at least under GDPR. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is there to enforce GDPR and will not add additional requirements.

I disagree. Even in a company the size of Booking, top management cannot think “it’s only half a million”.

I expect some manager will get a strongly-worded message about their department costing the company half a million because they waited too long before reporting the breach. That department, likely, will also see bad evaluations.

I also expect Booking will use this case as an example to all other departments.

And that’s ignoring the fact that, if Booking doesn’t change, and something similar were to happen again, the fine likely would be higher.

Well, it's better then nothing I guess?

This is a fine for failing to report a breach after 22 days (not for the breach itself), of around 4000 users.

Though I agree it could be higher for these organizations, it's also not a small fine just to fail to report.

The fine is about late report, not about lacking security practices/mechanism. It's the first fine - more like a warning - hire couple of people to deal with this as the next fine would be order(s) of magnitude larger.

According to Regulation 679/2016/EU, aka the GDPR, fines could be much higher. Up to 4% of the total worldwide revenues (revenues, not profits).

Moreover, repeated violations is expressly a parameter for higher fines. So non compliance as a strategy is not really viable.

As soon as the respective agencies analysed it and get to it. This doesn't happen over night, but is a more complex process which will quite certainly happen.

It may be a boring dystopia, but, you can't be fined for the same crime over and over again, can you? https://www.dw.com/en/facebook-data-on-millions-of-user-acco...

FB is being blocked by the Irish DPA, since EU FB is HQ'd there. Sadly this one loophole made it into the GDPR, so the other DPA's can only forward to the Irish agency for FB issues.

BCOM are not processing the payment here. They provide a "Hotel Login" which then let's the hotels view (upto N times) the raw card information of the guest for use internally on their own payment processes. There's various approaches that they make available, this is one of a few. More recently Booking.com started to move away from providing the raw card information and instead providing a virtual card which "Activiation" date only becomes enabled once the cancellation policy for the guest booking kicks in (allowing the hotel to charge before arrival). There's also an API approach, but the leading way to get access to the card/payment information __because__ BCOM are not merchants here is to provide this to the merchants/hotels through a BCOM login page. Reading between the lines, this is what I think was exposed.

I'd expect that the name and address will still be stored in their payment processor.

Then the invoice itself (containing your name/address/payment method) will need to be stored by the company in some form for accounting regulations.

> Once the transaction is done, the invoice mailed and the product shipped - there is 0 need for this data to still be stored in their database.

This data can often still be necessary for legal and/or tax purposes.

There's nothing wrong with storing customer purchase data as long as this is processed and stored in a legally compliant manner. This data is crucial for other things such as returns and refunds.

Companies must archive invoices for 10 years. But of course that doesn't necessarily require keeping an account for the customer.

Proportionality is a big concept in EU law, and it's explciitly written in to the GDPR.

Article 83 ("General conditions for imposing administrative fines") states that:

> Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article [...] shall in each individual case be effective, proportionate and dissuasive.

SAs can't just hand out big fines for the sake of big fines. If a fine is issued then the SA's ruling can be challenged on the basis of proportionality.

It can but it doesn't require the fines to be in the millions. AFAIK there are 21 GDPR fines that are in the millions of euro.