29 June 2023
J.No. 2021-7329-0061
Doc.no. 608183
Caseworker
Final Decision in CR 191470, DD475750
The Danish Data
Protection Agency
1. Summary of the Case Carl Jacobsens Vej 35
The Danish Data Protection Agency, Datatilsynet (“Danish DPA”), refers the complaint against 2500 Valby
Denmark
Booking.com B.V. (“Booking.com”) you submitted on 7 September 2020 concerning the fact
T 3319 3200
that, on 17 July 2020, you made a reservation at a hotel in Aarhus. On 13 August 2020 an [email protected]
acquaintance of you ( ) wanted to make a reservation with the app of Booking.com after datatilsynet.dk
which she saw your reservation. On 14 August 2020 you contacted Booking.com to inform VAT No. 11883729
them about the issue. On 2 September 2020 you received an e-mail from Booking.com claim-
ing that your booking of 17 July 2020 was made on the computer of the husband of
.
It follows from your statements that you do not believe the explanation of Booking.com which
led to you filing a complaint to the Danish DPA.
After having reviewed your complaint, the Danish DPA concluded that your complaint con-
cerned a cross-border processing of personal data (within the meaning of Article 4(23) of the
General Data Protection Regulation (GDPR))1, which meant that the case had to be processed
in cooperation with the supervisory authorities of other EU/EEA Member States in accordance
with Article 60 GDPR.
In cases that concern a cross-border processing of personal data, the supervisory authority of
the main establishment or of the single establishment of the relevant company – which in this
case is located in the Netherlands – shall be competent to act as lead supervisory authority.
Thus, in the present case, the Dutch Data Protection Agency, Autoriteit Persoonsgegevens
(“Dutch DPA”), acted as lead supervisory authority.
Following the finding that the Dutch DPA was the leading supervisory authority, on 6 April
2021, the Danish DPA shared your complaint with the Dutch DPA for the further handling of
the case.
1 REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the pro-
tection of natural persons with regard to the processing of personal data and on the free movement of such data, and repeal-
ing Directive 95/46/EC (General Data Protection Regulation
2. Investigation by the Dutch DPA Page 2 of 3
While handling the case, on 19 august 2022, the Dutch DPA requested Booking.com for addi-
tional information regarding your complaint from Booking.com. More specifically, the Dutch
DPA asked Booking.com to provide evidence for their claim that the booking of 17 July 2020
was made with the computer of ’s husband . On 8 September 2022 Booking.com
responded to the request.
In its response Booking.com showed a screenshot of their reservation system. In this system
the account of shows that your reservation of 17 July 2020 was created with the account
of , but with your e-mail address. Booking.com suspects, based on their correspondence
with you, that and you are acquaintances. Booking.com suspects that you have used the
same device as was used by to make another reservation in 2018. To support this
Booking.com provided a screenshot from their reservation system showing that the ‘user
agent’ of a reservation of in 2018 matches the ‘user agent’ of you of 17 July 2020.
Therefore Booking.com believes that the most reasonable explanation remains that you made
the reservation of 17 July 2020 using a device that was also used by and while being
logged into ’s Booking.com account. Booking.com notes that there are no indications that
would suggest a data breach with Booking.com.
On 12 September 2022 the Dutch DPA shared the response from Booking.com with the Dan-
ish DPA. The Danish DPA shared the response with you on 19 September 2022, asking
whether you had any remarks to the response. On 6 October 2022 you shared your remarks
with the Danish DPA. The Danish DPA shared your remarks with the Dutch DPA on 24 October
2022.
It follows from your remarks that you acknowledge that on 4 May 2018 has booked a
hotel on your iPad. You find it confusing that you received a confirmation for your booking of
17 July 2020 on your own e-mail address. Furthermore, it follows from your remarks, that you
find it unlikely that you were logged into ’s account to book something for yourself in 2020.
3. Decision
The Dutch DPA found that there isn’t an infringement of Article 32 of the General Data Protec-
tion Regulation (GDPR) based on the complaint and the response of Booking.com.
The Dutch DPA deemed this matter investigated to the extend appropriate and rejects the
complaint ex Article 60(8) GDPR.
The Danish SA hereby rejects the compliant.
4. The reasons for the decision
After examining the case, the Dutch DPA did not find that the information shared by you gave
the Dutch DPA any reason to doubt the explanation provided by Booking.com.
The Dutch DPA stated, that they did not find any evidence which would make them question
the explanation given by Booking.com.
The Dutch DPA asked the Danish DPA whether they agreed with this assessment. The Danish
DPA informed the Dutch DPA that the Danish DPA agreed with the Dutch DPA’s assessment
that Booking.com has not violated GDPR.
The Dutch DPA’s conclusion of which Booking.com has not infringed Article 32 of the GDPR Page 3 of 3
was based on your complaint and Booking.com’s response. This led the to the Dutch DPA’s
rejection of your complaint.
The Dutch DPA stated, that they do not believe that the e-mail you received on your e-mail
address leads to doubts concerning Booking.com’s statement. This is based on the fact that
Booking.com has shown that the e-mail address of you was used to make the reservation in
the account of , and that this would result in an e-mail confirmation being sent to your e-
mail address.
5. Final remarks
The Danish DPA notes that the supervisory authority’s decisions cannot be challenged be-fore
another administrative authority, cf. Section 30 of the Danish Data Protection Act. However,
the Danish DPA’s decisions may be brought before the courts, cf. section 63 of the Constitu-
tion.
The Danish DPA will take no further action regarding the case and considers it to be closed.
The Danish DPA apologizes for the lengthy processing time.