6 ms·

This is an effective non-fee for an entity their size. I'd assume we see the associated negative pattern - there's little real legislation impact, meaning there

by cik 6y ago

This is an effective non-fee for an entity their size. I'd assume we see the associated negative pattern - there's little real legislation impact, meaning there's little value in reporting, when examined economically. Were the fine larger, or more severe the reverse message would be sent. From a certain (not my) point of view poor compliance was just incentivized.

libertine 6y ago
Well, it's better then nothing I guess? This is a fine for failing to report a breach after 22 days (not for the breach itself), of around 4000 users. Though I agree it could be higher for these organizations, it's also not a small fine just to fail to report.
ghego1 6y ago
According to Regulation 679/2016/EU, aka the GDPR, fines could be much higher. Up to 4% of the total worldwide revenues (revenues, not profits). Moreover, repeated violations is expressly a parameter for higher fines. So non compliance as a strategy is not really viable.
Someone 6y ago
I disagree. Even in a company the size of Booking, top management cannot think “it’s only half a million”. I expect some manager will get a strongly-worded message about their department costing the company half a million because they waited too long before reporting the breach. That department, likely, will also see bad evaluations. I also expect Booking will use this case as an example to all other departments. And that’s ignoring the fact that, if Booking doesn’t change, and something similar were to happen again, the fine likely would be higher.
- cik 6y ago
  One can easily think it's only half a million. That number while large for many organizations, isn't for others. Simply put, it's cheaper to pay this fine than build out the (likely) necessary compliance team. Were the fine commensurate with income I think it would go further.
  - Someone 6y ago
    Half a million here, half a million there and before you know we’re talking real money. Also, if this article is correct, they have everything in place to handle this kind of breach. In the handling, the only thing that went wrong was that they informed the authority too late. It took them 3 weeks, while it has to happen within 3 days. Booking states they contacted affected customers before that.
- TheCoelacanth 6y ago
  I think it depends. If the behavior they were fined for was strategically useful to the company, then they will definitely think “it’s only half a million” and keep doing it unless they think the fine will be much larger next time. If it was just a fuck-up, then what you're describing will happen.
xxs 6y ago
The fine is about late report, not about lacking security practices/mechanism. It's the first fine - more like a warning - hire couple of people to deal with this as the next fine would be order(s) of magnitude larger.

by cik 6y ago

libertine 6y ago

Well, it's better then nothing I guess? This is a fine for failing to report a breach after 22 days (not for the breach itself), of around 4000 users. Though I agree it could be higher for these organizations, it's also not a small fine just to fail to report.

ghego1 6y ago

According to Regulation 679/2016/EU, aka the GDPR, fines could be much higher. Up to 4% of the total worldwide revenues (revenues, not profits). Moreover, repeated violations is expressly a parameter for higher fines. So non compliance as a strategy is not really viable.

Someone 6y ago

I disagree. Even in a company the size of Booking, top management cannot think “it’s only half a million”. I expect some manager will get a strongly-worded message about their department costing the company half a million because they waited too long before reporting the breach. That department, likely, will also see bad evaluations. I also expect Booking will use this case as an example to all other departments. And that’s ignoring the fact that, if Booking doesn’t change, and something similar were to happen again, the fine likely would be higher.

cik 6y ago
One can easily think it's only half a million. That number while large for many organizations, isn't for others. Simply put, it's cheaper to pay this fine than build out the (likely) necessary compliance team. Were the fine commensurate with income I think it would go further.
- Someone 6y ago
  Half a million here, half a million there and before you know we’re talking real money. Also, if this article is correct, they have everything in place to handle this kind of breach. In the handling, the only thing that went wrong was that they informed the authority too late. It took them 3 weeks, while it has to happen within 3 days. Booking states they contacted affected customers before that.
TheCoelacanth 6y ago
I think it depends. If the behavior they were fined for was strategically useful to the company, then they will definitely think “it’s only half a million” and keep doing it unless they think the fine will be much larger next time. If it was just a fuck-up, then what you're describing will happen.

xxs 6y ago

The fine is about late report, not about lacking security practices/mechanism. It's the first fine - more like a warning - hire couple of people to deal with this as the next fine would be order(s) of magnitude larger.