Booking.com B.V.

Booking.com failed to report a personal data breach to the AP within the mandatory 72-hour window under GDPR Art. 33, delaying notification by more than three weeks. In late 2018, fraudsters using phishing attacks against hotel partners compromised employee accounts and accessed the personal and payment card data of approximately 40,000 customers. The AP found Booking.com's internal escalation procedures failed to trigger timely regulatory reporting and that customers were also not promptly informed.