5 ms·

They have a $100B enterprise value, and make ~$4B/year in GAAP income. This is not even the yearly cost of a higher level lawyer. If you make $200k/year then th

They have a $100B enterprise value, and make ~$4B/year in GAAP income. This is not even the yearly cost of a higher level lawyer. If you make $200k/year then the fine would correspond to a $30 ticket. Lol, just lol.

matkoniecz 6y ago
Well, at least it is progress from no fines at all or 1000$ fines. Still, should be 10 or 100 times more.
- hyperman1 6y ago
  It's a number that will cause them to sit up and take notice, without starting a multi-year legal war. It signals to booking.com and other companies that the regulator is not asleep. The implicit threat is: fix your behaviour, everyone, or worse fines will follow. To be honest, I can live with that.
  - matkoniecz 6y ago
    I also would be fine as long as "or worse fines will follow" is true. I would consider as desirable that egregious, systematic and catastrophic security failures would be resulting in fines and penalties large enough to bankrupt companies[0]. But starting from that is rather not a good idea, I agree that some warning is a good idea. [0] for example 2000$ for every single leaked address that they deliberately collected (if company is scared: then they should not ask user for address data! Companies very rarely actually need it, and they still ask.).
    - zaarn 6y ago
      For catastrophic failures the fines certainly become very large very quickly. And follow up fines if behaviour isn't changed do go up as well. So far, it's usually the former as most companies adjust by their first fine.
  - kqvamxurcagg 6y ago
    The size of the fine will probably increase the value of the company and sector as it reduces model assumption for future regulatory penalties now that a precedent has been set.
kortilla 6y ago
> They have a $100B enterprise value That number is meaningless for how much a company is hurt by a fine. A market valuation is just based on the current stock price. It doesn’t mean that the company has access to that much cash or assets.
- rorykoehler 6y ago
  They could issue new stock if they needed.
- kqvamxurcagg 6y ago
  From an investor's perspective it's not meaningless. This is a one-off expense which can be safely ignored. This won't even impact the valuation of my investment, in fact the size of the fine will probably increase the value of the company as it will enable me to reduce my assumption for future regulatory penalties now that a precedent has been set.
  - Hamuko 6y ago
    Except that repeated violations of GDPR are a cause to increase the fine as per the text. >When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: >(e) any relevant previous infringements by the controller or processor;
    - kqvamxurcagg 6y ago
      Across the wider sector, the fine is a good data point for investors. Even if the fine was doubled or tripled next time, it will be a outcome that won't really change behaviors.
kvdveer 6y ago
This fine is just for their Dutch operations, which is far smaller than their global operation. I estimate this to be about 1% of their expenses in NL, so in your analogy, this'd be a $2k fine. Also: the crime isn't that bad. They did reported the breach on their own accord, and acted according to the laws at hand. The report may have been two weeks too late, but it was there. Their preventative measures and reaction were deemed good enough, just not timely. A crippling fine wouldn't have been appropriate, given the verdict. The company could have avoided the fine by doing exactly the same thing they did, just a little faster. The fine counterbalances the cost-savings they may have had by having fewer people work on this. A future manager will probably see the fine, and decide just to put a little more resources into this, so the report can be on time. When that happens, the fine has served its purpose.
- y7 6y ago
  I think this is the total fine for the entire EU. Usually one of the Data Protection Authorities takes charge of the investigations, and since Booking has their HQ in Amsterdam, it was the Dutch one in this case. They mention that they coordinated with other DPAs.
- dalbasal 6y ago
  Your are right, in the context lawyers/regulators/etc. are operating within. OTOH, in a wider context, you have to concede OP's "lol" perspective is true too. The money itself has little/no possible deterrent effect. "Just for their Dutch operations" is a lawyerly frame... it isn't a business frame. booking.com's Dutch business operations aren't really separate. Any security/transparency practices beyond "compliance" almost certainly exist across borders. I agree though that a fine (any amount) can be enough to adjust resources/practices on a small scale. On a bigger scale, the threat of a fine (any amount) probably is not enough to deter much. IE, if changes are strategic, costly or impact revenue... a fine will always be cheaper.
the-dude 6y ago
They used to make ~$4B/yr.
franciscop 6y ago
Is the fine a "EU fine" or a "Netherlands fine"? I'd expect the fine to be proportional to the territory issuing it, not to the total global value of the company. You would not expect this fine to be e.g. 10% of the company global valuation, and then when other 9 countries issue a similar fine and destroy the company. Netherlands being 1% of the global GDP, this would be proportional to a $50B "global fine" or 50% of the company valuation. So in that sense, it even seems too big. EU being 20% of the global GDP, this would be proportional to a $2.5B "global fine" or 2.5%, which IMHO seems small-to-fair for a data leak of this type.
- Hamuko 6y ago
  GDPR maximum fines are dictated by global revenue. >Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
- lorenzhs 6y ago
  Your numbers are off by 3 orders of magnitude, the fine is just under half a million, not half a billion.
  - Aeolun 6y ago
    The problem being, if you fine them 500M for a crime they reported, the next time they won’t report anything.
lorenzhs 6y ago
On GDPR, it seems HN has two completely opposing reactions depending on the time since a fine has made headlines. If it's been a while, the prevailing sentiment seems to be "the big bad EU will financially ruin me for my side project if I don't hire a full-time data protection lawyer", and when a fine is actually issued, it's "that's not even a slap on the wrist, who's going to care, lol". It's almost as if EU data protection agencies reacted proportionately to the severity of the misdeed. This is a leak affecting 4109 customers, after all, not a full compromise of booking's systems.
- MaxBarraclough 6y ago
  > "the big bad EU will financially ruin me for my side project if I don't hire a full-time data protection lawyer", and when a fine is actually issued, it's "that's not even a slap on the wrist, who's going to care, lol" The relevant question, then: what is the history of GDPR enforcement against small companies? Personally I have no idea, as typically only the big cases make the front-page.
  - Hamuko 6y ago
    https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ For example, a police officer was fined 48 euro for accessing "personal data in a police database for private research activities", a housing association was fined 500 euro for "publishing photos showing members of the association without their consent" and Borjamotor, S.A. (which appears to be a Spanish Opel dealership) was fined 4000 euro for "sending commercial advertisements to the data subject via email and SMS, even though the data subject had previously revoked his/her consent to receive advertisements and submitted a request to delete his/her data".
    - Nextgrid 6y ago
      Seems like enforcement appears to be fair and the million-dollar fines that were supposed to bankrupt individuals & small businesses didn't actually happen.
    - elliekelly 6y ago
mrtksn 6y ago
I guess the idea is to make it hurt, not ruin a business. How would 0.5M fine hurt a business with 4B revenue you may ask, but I think that it will hurt the people responsible for the leak since it will be known within the company that someone screwed up or someone is pure evil, two labels that you don't want to get in a workplace. Companies spend a lot of money and energy on projecting an image, not only to the outsider but also to the insiders. Unless they pride themselves for being evil and the cut-throat office politics, I bet this fine will make a dent in someones image and will trigger some policy change or similar. Companies are not really monoliths, despite of their effort to be seen as such.
- candiodari 6y ago
  It looks like the idea is to be very selective about who gets fined. CPS Utrecht ("Veilig Thuis") also got a data leak. Everything got leaked: from files on children, medical files on children and adults, phone calls, emails, ... the works. The fine? It wasn't even mentioned that a fine would be forthcoming. Until city hall took steps to replace the organisation they refused to modify their systems and stop the still-in-progress leak. It got to be a scandal. So clearly: the idea is to fine only people they feel like fining. Anything even tangentially related to the government (this is a private for-profit organization (running quite a decent profit I might add, as well as paying management very nicely) that merely works for the government) does not get fined, even for leaking much, much more sensitive information. Needless to say, CPS has still not changed their processes to better secure medical files. They are still being sent, without any encryption or authentication, over email. So it's not just that they weren't fined: the whole purpose of the data protection law, actually keeping the data safe, was ignored entirely even when they got caught spreading extremely sensitive information around and storing it without encryption. https://www.rtlnieuws.nl/tech/artikel/4672826/jeugdzorg-datalek-dossiers-kinderen-utrecht-email https://www.rtlnieuws.nl/tech/artikel/4672826/jeugdzorg-data...
  - Aeolun 6y ago
    How in the actual fuck are they still operating? If the government doesn’t do anything about it I’d very quickly expect a mob with pitchforks outside their office. > Dit is het ergste wat ons kan overkomen Sounds like they think it’s some sort of natural disaster that happened to them. I have no words. Thank god it was two good guys registering the domain.
AndyMcConachie 6y ago
Keep in mind that if they do it again the fine will be much larger. This isn't the USA, and the Dutch DPA is not the FTC. If Booking.com does this again the next fine will be much larger.

matkoniecz 6y ago

Well, at least it is progress from no fines at all or 1000$ fines. Still, should be 10 or 100 times more.

hyperman1 6y ago
It's a number that will cause them to sit up and take notice, without starting a multi-year legal war. It signals to booking.com and other companies that the regulator is not asleep. The implicit threat is: fix your behaviour, everyone, or worse fines will follow. To be honest, I can live with that.
- matkoniecz 6y ago
  I also would be fine as long as "or worse fines will follow" is true. I would consider as desirable that egregious, systematic and catastrophic security failures would be resulting in fines and penalties large enough to bankrupt companies[0]. But starting from that is rather not a good idea, I agree that some warning is a good idea. [0] for example 2000$ for every single leaked address that they deliberately collected (if company is scared: then they should not ask user for address data! Companies very rarely actually need it, and they still ask.).
  - zaarn 6y ago
    For catastrophic failures the fines certainly become very large very quickly. And follow up fines if behaviour isn't changed do go up as well. So far, it's usually the former as most companies adjust by their first fine.
- kqvamxurcagg 6y ago
  The size of the fine will probably increase the value of the company and sector as it reduces model assumption for future regulatory penalties now that a precedent has been set.

kortilla 6y ago

> They have a $100B enterprise value That number is meaningless for how much a company is hurt by a fine. A market valuation is just based on the current stock price. It doesn’t mean that the company has access to that much cash or assets.

rorykoehler 6y ago
They could issue new stock if they needed.
kqvamxurcagg 6y ago
From an investor's perspective it's not meaningless. This is a one-off expense which can be safely ignored. This won't even impact the valuation of my investment, in fact the size of the fine will probably increase the value of the company as it will enable me to reduce my assumption for future regulatory penalties now that a precedent has been set.
- Hamuko 6y ago
  Except that repeated violations of GDPR are a cause to increase the fine as per the text. >When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: >(e) any relevant previous infringements by the controller or processor;
  - kqvamxurcagg 6y ago
    Across the wider sector, the fine is a good data point for investors. Even if the fine was doubled or tripled next time, it will be a outcome that won't really change behaviors.

kvdveer 6y ago

This fine is just for their Dutch operations, which is far smaller than their global operation. I estimate this to be about 1% of their expenses in NL, so in your analogy, this'd be a $2k fine. Also: the crime isn't that bad. They did reported the breach on their own accord, and acted according to the laws at hand. The report may have been two weeks too late, but it was there. Their preventative measures and reaction were deemed good enough, just not timely. A crippling fine wouldn't have been appropriate, given the verdict. The company could have avoided the fine by doing exactly the same thing they did, just a little faster. The fine counterbalances the cost-savings they may have had by having fewer people work on this. A future manager will probably see the fine, and decide just to put a little more resources into this, so the report can be on time. When that happens, the fine has served its purpose.

y7 6y ago
I think this is the total fine for the entire EU. Usually one of the Data Protection Authorities takes charge of the investigations, and since Booking has their HQ in Amsterdam, it was the Dutch one in this case. They mention that they coordinated with other DPAs.
dalbasal 6y ago
Your are right, in the context lawyers/regulators/etc. are operating within. OTOH, in a wider context, you have to concede OP's "lol" perspective is true too. The money itself has little/no possible deterrent effect. "Just for their Dutch operations" is a lawyerly frame... it isn't a business frame. booking.com's Dutch business operations aren't really separate. Any security/transparency practices beyond "compliance" almost certainly exist across borders. I agree though that a fine (any amount) can be enough to adjust resources/practices on a small scale. On a bigger scale, the threat of a fine (any amount) probably is not enough to deter much. IE, if changes are strategic, costly or impact revenue... a fine will always be cheaper.

the-dude 6y ago

They used to make ~$4B/yr.

franciscop 6y ago

Is the fine a "EU fine" or a "Netherlands fine"? I'd expect the fine to be proportional to the territory issuing it, not to the total global value of the company. You would not expect this fine to be e.g. 10% of the company global valuation, and then when other 9 countries issue a similar fine and destroy the company. Netherlands being 1% of the global GDP, this would be proportional to a $50B "global fine" or 50% of the company valuation. So in that sense, it even seems too big. EU being 20% of the global GDP, this would be proportional to a $2.5B "global fine" or 2.5%, which IMHO seems small-to-fair for a data leak of this type.

Hamuko 6y ago
GDPR maximum fines are dictated by global revenue. >Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
lorenzhs 6y ago
Your numbers are off by 3 orders of magnitude, the fine is just under half a million, not half a billion.
- Aeolun 6y ago
  The problem being, if you fine them 500M for a crime they reported, the next time they won’t report anything.

lorenzhs 6y ago

On GDPR, it seems HN has two completely opposing reactions depending on the time since a fine has made headlines. If it's been a while, the prevailing sentiment seems to be "the big bad EU will financially ruin me for my side project if I don't hire a full-time data protection lawyer", and when a fine is actually issued, it's "that's not even a slap on the wrist, who's going to care, lol". It's almost as if EU data protection agencies reacted proportionately to the severity of the misdeed. This is a leak affecting 4109 customers, after all, not a full compromise of booking's systems.

MaxBarraclough 6y ago
> "the big bad EU will financially ruin me for my side project if I don't hire a full-time data protection lawyer", and when a fine is actually issued, it's "that's not even a slap on the wrist, who's going to care, lol" The relevant question, then: what is the history of GDPR enforcement against small companies? Personally I have no idea, as typically only the big cases make the front-page.
- Hamuko 6y ago
  https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ For example, a police officer was fined 48 euro for accessing "personal data in a police database for private research activities", a housing association was fined 500 euro for "publishing photos showing members of the association without their consent" and Borjamotor, S.A. (which appears to be a Spanish Opel dealership) was fined 4000 euro for "sending commercial advertisements to the data subject via email and SMS, even though the data subject had previously revoked his/her consent to receive advertisements and submitted a request to delete his/her data".
  - Nextgrid 6y ago
    Seems like enforcement appears to be fair and the million-dollar fines that were supposed to bankrupt individuals & small businesses didn't actually happen.
  - elliekelly 6y ago

mrtksn 6y ago

I guess the idea is to make it hurt, not ruin a business. How would 0.5M fine hurt a business with 4B revenue you may ask, but I think that it will hurt the people responsible for the leak since it will be known within the company that someone screwed up or someone is pure evil, two labels that you don't want to get in a workplace. Companies spend a lot of money and energy on projecting an image, not only to the outsider but also to the insiders. Unless they pride themselves for being evil and the cut-throat office politics, I bet this fine will make a dent in someones image and will trigger some policy change or similar. Companies are not really monoliths, despite of their effort to be seen as such.

candiodari 6y ago
It looks like the idea is to be very selective about who gets fined. CPS Utrecht ("Veilig Thuis") also got a data leak. Everything got leaked: from files on children, medical files on children and adults, phone calls, emails, ... the works. The fine? It wasn't even mentioned that a fine would be forthcoming. Until city hall took steps to replace the organisation they refused to modify their systems and stop the still-in-progress leak. It got to be a scandal. So clearly: the idea is to fine only people they feel like fining. Anything even tangentially related to the government (this is a private for-profit organization (running quite a decent profit I might add, as well as paying management very nicely) that merely works for the government) does not get fined, even for leaking much, much more sensitive information. Needless to say, CPS has still not changed their processes to better secure medical files. They are still being sent, without any encryption or authentication, over email. So it's not just that they weren't fined: the whole purpose of the data protection law, actually keeping the data safe, was ignored entirely even when they got caught spreading extremely sensitive information around and storing it without encryption. https://www.rtlnieuws.nl/tech/artikel/4672826/jeugdzorg-datalek-dossiers-kinderen-utrecht-email https://www.rtlnieuws.nl/tech/artikel/4672826/jeugdzorg-data...
- Aeolun 6y ago
  How in the actual fuck are they still operating? If the government doesn’t do anything about it I’d very quickly expect a mob with pitchforks outside their office. > Dit is het ergste wat ons kan overkomen Sounds like they think it’s some sort of natural disaster that happened to them. I have no words. Thank god it was two good guys registering the domain.

AndyMcConachie 6y ago

Keep in mind that if they do it again the fine will be much larger. This isn't the USA, and the Dutch DPA is not the FTC. If Booking.com does this again the next fine will be much larger.