¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
CNIL.
COMMISSION NATIONALE
INFORMATIQUE & LIBERTÉS
# The President
Examination of the case:
Paris, on May 16th, 2019
Our Ref.: MLD/JLI/KKR/XD/DAU/CM191523
Case no. 18021443
(to be referenced in all correspondence)
Dear Mr. Chief Executive Officer,
This is further to the investigation carried out under decision no. 2018-268C on the premises of the company on December 18th and 19th, 2018, whose purpose was in particular to examine the complaint transmitted to the French data protection authority ("CNIL") by the data protection authority of Hamburg according to provisions of Article 56.1 of the General Data Protection Regulation (GDPR) of April 27th, 2016.
Indeed, a complaint has been lodged with this authority against the company concerning the fraudulent use of information relating to a room booked through on September 1st, 2018, at the for the night of September 8th/9th, 2018.
The elements resulting from this investigation lead me, in agreement with other European data protection authorities concerned by the processing carried out for the purposes of reservation management, to proceed to the closure of this complaint.
Indeed, first of all, it is observed that the company was acting as a data processor for its hoteliers clients. provides them tools for ensuring the management of their bookings, payments and issuing price recommendations. Agreements concluded with its hoteliers clients specifically indicate that data are "owned" by these hoteliers clients. Besides security measures, adjusts the means of the processing it carries out in accordance with its clients' directives.
Secondly, the investigation revealed that the booking containing the personal data of the complainant (surname, first name and telephone number only) and addressed to different hotels was obviously false.
To begin with, several hoteliers clients have noticed a booking clearly received on behalf of the complainant, but the e-mail address of the sender of this booking is not the one. In addition, the type of access link to banking data contained in this booking is not consistent with the usual practice.
RÉPUBLIQUE FRANÇAISE
3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07 - 01 53 73 22 22 - www.cnil.fr
Les données personnelles nécessaires à l'accomplissement des missions de la CNIL sont traitées dans des fichiers destinés à son usage exclusif. Les personnes concernées peuvent exercer leurs droits informatique et Libertés en s'adressant au délégué à la protection des données (DPO) de la CNIL via un formulaire en ligne ou par courrier postal. Pour en savoir plus : www.cnil.fr/donnees-personnelles.
As a result, a phishing attempt aiming to obtain credentials to [REDACTED] extranet remains the most probable hypothesis, although it cannot be ascertained.
The elements obtained during the investigation on your premises by the delegation of the CNIL did not allowed establishing circumstances under which the personal data of the complainant could have been collected for being used in this operation. In view of the date of the facts, it is indeed not possible to ascertain these circumstances, but it remains likely that the [REDACTED] - with whom the complainant's booking was made - has been victim of a data breach. In this regard, I observe that you have used the procedure for modifying this hotel's password, on September 3rd, 2018, for it to keep on accessing to your services.
Furthermore, it is noted that on September 4th, 2018, the website hosting the false login pages for recovering login and password has been rendered inaccessible on [REDACTED] request.
Accordingly, the [REDACTED] company's liability for the facts reported in the complaint cannot be established under the findings established during the onsite investigations.
Yours Sincerely,
