Because Booking.com is a Dutch company, and the EU has GDPR, the incident cannot legally repeat itself. This was 2016 incident and GDPR become effective 2018.
This took place just before the EU-wide GDPR was introduced, but under the Dutch national laws applicable at the time Booking.com was obliged to notify its affected users. Because the impact of a foreign state actor spying on your hotel bookings can be quite high (something Booking.com cannot reasonably determine for their users themselves) disclosure should have happened then in 2016, and the Dutch Data Protection Authority should have been informed as well.
They are absolutely required to report this to the data protection agencies in all European countries. As the other comment mentioned, missing the 72 hour deadline on this is enough to get a fine as Booking.com did.
I'm curious to see the total in GDPR fines from this for Facebook. Will probably take a year or two before we know.
GDPR enforcement is severely lacking, not only in the UK but even in Europe even in case of blatant and obvious breaches (Facebook, Google, etc), so good luck getting the regulator to do anything about your "Your booking couldn't be processed, please try again later" error.
I remember back in the day when GDPR was announced this was an actual thing. Nowadays tho, 9/10 of the website that used that message caved and are serving EU without problems.
Are any of these apps used in the EU? If there’s no user consent for this privacy policy it strikes me that this isn’t GDPR compliant and these guys are just waiting to get fined. I wonder if they can get it around it by having their clients (Hotels.com, etc) essentially proxy this consent through their own privacy policies.
According to the article, end users still have not been notified.
The lack of timely and proper notification as well as the misleading website information can be taken into account by the data protection authority in determining if the company should be fined, and the fines in question can be quite substantial.
I don't know if this is the experience for European visitors, but as the Twitter thread states, this is in violation of both the spirit, and, importantly, the letter of GDPR. I really hope there are more than slap-on-the-wrist consequences for this blatant, deliberate attempt to side-step the requirements of GDPR.
reply