Dutch DPA
- Country
- Netherlands
- Fine
- 475,000 EUR
- Date
- 2021-05-11
- Sector
- Business Sector
- Articles
- Art. 33(1) GDPR
Reporting a data breach 22 days to late.
On February 7, 2019, Booking notified the AP of a personal data breach (data breach) done. An unknown third party had gained access to a Booking system by pretending to be an employee of Booking at multiple accommodations. Here are the personal data of several parties involved. Booking.com was informed of the data breach on 13 January 2019, but did not report the breach to the DPA until 7 February, which is 22 days too late: data breaches must be reported within 72 hours where feasible. On 4 February 2019 Booking.com informed the affected customers of the breach. The company also took other measures to limit the damage, such as offering to compensate any losses.