¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
535.1764
Berlin Commissioner for
631.283 Data Protection and
CR 160663 Freedom of Information
DD 160668 Friedrichstr. 219
FD 189177 10969 Berlin
Visitors’ entrance:
Puttkamer Str. 16-18
Berlin, 24 March 2021
The building is fully accessible to
disabled members of the public.
Final Decision Contact us
Phone: +49 (0)30 13889-0
The Berlin DPA closes the case Fax: +49 (0)30 215 50 50
Use our encrypted contact form
for registering data protection
1. Facts concerning the data breach complaints:
www.datenschutz-berlin.de/be-
- Controller: Hotel Lützow schwerde.html
- Incident: Employee revealed the log-in data for booking.com For all other enquiries, please
- Date of occurrence: 13 May 2020 send an e-mail to:
[email protected]
- Date of acknowledgement of the incident: 13 May 2020
- EU/EEA Member States concerned, with the number of data Fingerprint of our
PGP-Key:
subjects concerned:
o Belgium: 23 D3C9 AEEA B403 7F96 7EF6
C77F B607 1D0F B27C 29A7
o Bulgaria: 6
o Denmark: 40
Office hours
o Germany: 882
o Estonia: 11 Daily from 10 am to 3 pm,
Thursdays from 10 am to 6 pm
o Finland: 25 (or by appointment)
o France: 101
o Greece: 25 How to find us
o UK: 192
The underground line U6 to
o Ireland: 20 Kochstraße / Bus number M29
o Italy: 185 and 248
o Croatia: 2
o Latvia: 14 Visit our Website
o Lithuania: 12 https://privacy.de
o Malta: 12
o Netherlands: 81
o Norway: 11
o Austria: 31
o Poland: 55
o Portugal: 31
o Romania: 19
o Sweden: 26
o Slovakia: 2
o Slovenia: 20
o Spain: 167
o Czech Republic: 10
o Hungary: 21
o Cyprus: 1
-2-
Total: 2033
- Category of data subjects: Customers with bookings for the
timespan between 15 May 2019 and 31 May 2021
- Category of the data types/data records concerned: First name,
last name, telephone no., nationality, date of arrival and departure,
partially credit card no. (without security number)
- Likely consequences of the violation of the protection of per-
sonal data:
2. Description of the data breach from a technical-organizational per-
spective
An attacker was given access to the booking.com account of the controller
person for about 4 hours. The access data was obtained by a call from the
attacker to an employee of the controller, whereby the attacker pretended
to be an employee of booking.com. The employee provided the access
data by telephone.
3. Description and analysis of the effectiveness of the measures taken
to address the personal data breach or to mitigate its adverse effects
(Art. 33 (3) (d) GDPR)
- Blocking of the account by boooking.com within 4 hours after the
access data has been obtained.
- Changing the access data
- Training of the controller’s employees by booking.com.
- Data protection audit by the company’s data protection officer
The Berlin DPA considers the measures taken to be sufficient.
4. Communication to the data subjects concerned or public communi-
cation (Art. 34(1) or Art. 34(3) (c) GDPR)
The data subjects concerned were notified in writing, some of them initially
by e-mail. Finally, the controller published a data protection notice on his
homepage (German, English, Italian).
5. Technical and organisational security measures that the controller
had already taken when the incident occurred, e.g. encryption (Article
34 (3) (a) GDPR)
Booking.com has a system that attempts to detect potentially problematic
account accesses. This system has also resulted in the prompt verification
and blocking of the account.
6. Subsequent measures by which the controller has ensured that a
high risk to the data subjects concerned is no longer likely to materi-
alise (Article 34 (3) (b) GDPR)
See 3.
7. Taken measures by the LSA Berlin DPA
7.1 Taken measures regarding Articles 33, 34 GDPR
In the light of the above-mentioned considerations regarding Articles 33,
34 GDPR, the Berlin DPA proposes to close the case.
-3-
7.2 Taken measures regarding data protection violations beyond
Articles 33, 34 GDPR
Furthermore, the Berlin DPA has also not identified any data protection
violations beyond Articles 33, 34 GDPR.