Fine of 475,000 euros for late notification of a data protection incident

The Dutch data protection authority (Autoriteit Persoonsgegevens – AP) has imposed a fine of 475,000 euros on the accommodation and travel agency platform booking.com for failing to report a data protection incident in good time.

Already in 2019, hackers had managed to access the data of 4109 customers of booking.com(https://edpb.europa.eu/news/national-news/2021/dutch-dpa-fines-bookingcom-delay-reporting-data-breach_en). The data included names, addresses, telephone numbers and details of hotel bookings, as well as credit card information for 283 data subjects, including security numbers in 97 cases. The hackers gained access to the data through employee accounts at several hotels in the United Arab Emirates, presumably through “socialengineering” techniques or phishing. In addition, the hackers attempted to gain access to additional credit card data by contacting guests of the hotels via email or phone. This posed a high security risk even for those booking.com customers whose credit card data was not affected.

booking.com did not consider itself responsible for the data protection incident, as the data had not been accessed via its own IT infrastructure. The AP, on the other hand, saw evidence of shared responsibility on the part of the operator. However, the fine was issued regardless of this issue solely based on the fact that booking.com had reported the data protection incident to the affected customers only after 22 days and to the supervisory authority only after 25 days. A data breach of this magnitude should have been reported to the data protection authority pursuant to Art.33 Para.1 GDPR must be reported to booking.com at the latest within 72 hours of becoming aware of it.

The fine can still be appealed. However, booking.com has already had it stated that it will accept the fine. The booking.com database had not been compromised at any point, but the company said it was working to improve its internal processes.

What is remarkable about this fine decision is that the actual incident was not sanctioned. Rather, only the late reporting was penalized. This proves that the supervisory authorities do not only examine and sanction measures to prevent data protection incidents. Delayed reporting of incidents to the supervisory authorities and/or the data subjects also constitutes a violation in its own right and one that is subject to sanctions.

Responsible parties are therefore well advised to review their internal processes for reporting data protection incidents and ensure that any required notification can be made in a timely manner. In particular, it must be taken into account that the 72-hour period is a maximum period and – at least according to the German supervisory authorities – also runs on weekends or public holidays. Against the background of the fact-finding usually required in the company, appropriate organizational precautions must be taken for this purpose.