4 ms·

Why wouldn't they stay silent? That is the norm unfortunately and congress is more concerned about being able to enact more anti-privacy and anti-encryption law

Why wouldn't they stay silent? That is the norm unfortunately and congress is more concerned about being able to enact more anti-privacy and anti-encryption laws than they are of actually holding companies liable for poor cybersecurity. I definitely encourage everyone to watch the hearing with Colonial Pipeline to see what I'm talking about.

miohtama 5y ago
Because Booking.com is a Dutch company, and the EU has GDPR, the incident cannot legally repeat itself. This was 2016 incident and GDPR become effective 2018.
- sweaty 5y ago
  GDPR isn't a be-all and end-all, Dutch laws already incorporated a lot of aspects of it such as having to notify their customers prior to GDPR becoming effective.
- daenney 5y ago
  Of course it can repeat itself. Dutch laws already mandated disclosure of a breach like this before the GDPR. The company simply didn’t give a fuck and found a legal firm that gave it license not to. As the article noted the company operates on a “if we don’t see it and it doesn’t hurt us we don’t care” principle. Even with the GDPR, the company can still chose to not give a fuck. It just becomes a more risky gamble assuming anyone ever finds out.
Freak_NL 5y ago
This took place just before the EU-wide GDPR was introduced, but under the Dutch national laws applicable at the time Booking.com was obliged to notify its affected users. Because the impact of a foreign state actor spying on your hotel bookings can be quite high (something Booking.com cannot reasonably determine for their users themselves) disclosure should have happened then in 2016, and the Dutch Data Protection Authority should have been informed as well.
consp 5y ago
> Why wouldn't they stay silent? Booking.com is required to follow Dutch law and originates from the Netherlands, which at that time required informing customers if the hack could have negative consequences for them. They ignored it and did nothing.
- tromp 5y ago
  They did something; they found someone else to blame: "The management claims it was not legally required to do so at the time, based on advice it received from the law firm Hogan Lovells." Although a company the size of booking.com should have its own qualified legal department, so that may not shield them from being liable...
  - eganist 5y ago
    > Although a company the size of booking.com should have its own qualified legal department, so that may not shield them from being liable... How does retaining outside counsel as opposed to employing internal counsel have any bearing on liability? Asking genuinely. I'm not an attorney.
    - jc01480 5y ago
      From a legal perspective, internal counsel may not be able to shield certain things as attorney work product. If an outside counsel is representing the firm the attorney work product privilege is almost impenetrable (in US law). And the privilege can be asserted across all dealings around the investigation and the results. Any firm relying solely on internal counsel needs new counsel. Retainers are a thing.
    - edwardwatson 5y ago
      Even if they have internal counsel (I haven't checked but I'm sure a company as large as Booking.com does), for decisions which have for reputational harm, it's useful to lean on advice from X prestigious third party. The same goes for using consultants. It's not just about deferring blame for a backlash but lending an air of objectivity and professionalism to the decision(s) made by management.
midasuni 5y ago
They operate in he EU, doesn’t the GDPR mandate rapid disclosure of security breaches?
- Freak_NL 5y ago
  This is before the GDPR, but precursor Dutch national laws already mandated disclosure.

miohtama 5y ago

Because Booking.com is a Dutch company, and the EU has GDPR, the incident cannot legally repeat itself. This was 2016 incident and GDPR become effective 2018.

sweaty 5y ago
GDPR isn't a be-all and end-all, Dutch laws already incorporated a lot of aspects of it such as having to notify their customers prior to GDPR becoming effective.
daenney 5y ago
Of course it can repeat itself. Dutch laws already mandated disclosure of a breach like this before the GDPR. The company simply didn’t give a fuck and found a legal firm that gave it license not to. As the article noted the company operates on a “if we don’t see it and it doesn’t hurt us we don’t care” principle. Even with the GDPR, the company can still chose to not give a fuck. It just becomes a more risky gamble assuming anyone ever finds out.

Freak_NL 5y ago

This took place just before the EU-wide GDPR was introduced, but under the Dutch national laws applicable at the time Booking.com was obliged to notify its affected users. Because the impact of a foreign state actor spying on your hotel bookings can be quite high (something Booking.com cannot reasonably determine for their users themselves) disclosure should have happened then in 2016, and the Dutch Data Protection Authority should have been informed as well.

consp 5y ago

> Why wouldn't they stay silent? Booking.com is required to follow Dutch law and originates from the Netherlands, which at that time required informing customers if the hack could have negative consequences for them. They ignored it and did nothing.

tromp 5y ago
They did something; they found someone else to blame: "The management claims it was not legally required to do so at the time, based on advice it received from the law firm Hogan Lovells." Although a company the size of booking.com should have its own qualified legal department, so that may not shield them from being liable...
- eganist 5y ago
  > Although a company the size of booking.com should have its own qualified legal department, so that may not shield them from being liable... How does retaining outside counsel as opposed to employing internal counsel have any bearing on liability? Asking genuinely. I'm not an attorney.
  - jc01480 5y ago
    From a legal perspective, internal counsel may not be able to shield certain things as attorney work product. If an outside counsel is representing the firm the attorney work product privilege is almost impenetrable (in US law). And the privilege can be asserted across all dealings around the investigation and the results. Any firm relying solely on internal counsel needs new counsel. Retainers are a thing.
  - edwardwatson 5y ago
    Even if they have internal counsel (I haven't checked but I'm sure a company as large as Booking.com does), for decisions which have for reputational harm, it's useful to lean on advice from X prestigious third party. The same goes for using consultants. It's not just about deferring blame for a backlash but lending an air of objectivity and professionalism to the decision(s) made by management.

midasuni 5y ago

They operate in he EU, doesn’t the GDPR mandate rapid disclosure of security breaches?

Freak_NL 5y ago
This is before the GDPR, but precursor Dutch national laws already mandated disclosure.