Booking.com is required to follow Dutch law and originates from the Netherlands, which at that time required informing customers if the hack could have negative consequences for them. They ignored it and did nothing.
"The management claims it was not legally required to do so at the time, based on advice it received from the law firm Hogan Lovells."
Although a company the size of booking.com should have its own qualified legal department, so that may not shield them from being liable...
How does retaining outside counsel as opposed to employing internal counsel have any bearing on liability?
Asking genuinely. I'm not an attorney.
The same goes for using consultants. It's not just about deferring blame for a backlash but lending an air of objectivity and professionalism to the decision(s) made by management.
"But your honor, Joe McLawyer told me it's perfectly legal for me to shoot my neighbor. I can't be held responsible!"
> A person's appropriation of property belonging to another is not to be regarded as dishonest if he appropriates the property in the belief that he has in law the right to deprive the other of it, on behalf of himself or of a third person
Pure ignorance of the law doesn't provide you such a belief (IIRC), but seeking legal advice may do so. I'm can't think of any other examples, but I wouldn't be surprised if they exist (for example, if your conduct must be reasonable, following legal advice may lend weight to the argument that it was).
It would also be relevant to explaining the conduct, even if it does not provide a legal defence.
Depending on how much of a grey area you’re operating in the law firm may or may not issue an opinion letter. So if you’re really pushing the boundary of what is reasonable to the point outside counsel won’t put it in writing you know you’re taking a pretty aggressive legal position. Some of the big law firms/practice groups have a reputation for being willing to be more aggressive in their written opinions than others. Large multinational companies often have several big law firms on retainer and their in house legal team will know who to go to for more conservative legal advice and who to go to for cover on a risky legal position. So I’ve heard, at least, I definitely would never participate in such ethically dubious behavior.
As the article noted the company operates on a “if we don’t see it and it doesn’t hurt us we don’t care” principle. Even with the GDPR, the company can still chose to not give a fuck. It just becomes a more risky gamble assuming anyone ever finds out.