Re:Booking.com fined €475k for reporting data breach too late
by chrisacky on Tuesday April 06, 2021 @05:58AM
(#26710015)
BCOM are not processing the payment here. They provide a "Hotel Login" which then let's the hotels view (upto N times) the raw card information of the guest for use internally on their own payment processes. There's various approaches that they make available, this is one of a few. More recently Booking.com started to move away from providing the raw card information and instead providing a virtual card which "Activiation" date only becomes enabled once the cancellation policy for the guest booking kicks in (allowing the hotel to charge before arrival). There's also an API approach, but the leading way to get access to the card/payment information __because__ BCOM are not merchants here is to provide this to the merchants/hotels through a BCOM login page. Reading between the lines, this is what I think was exposed.
Re:Booking.com fined €475k for reporting data breach too late
by 02thoeva on Tuesday April 06, 2021 @05:25AM
(#26709814)
I'd expect that the name and address will still be stored in their payment processor.
Then the invoice itself (containing your name/address/payment method) will need to be stored by the company in some form for accounting regulations.
Re:Booking.com fined €475k for reporting data breach too late
by nodamage on Tuesday April 06, 2021 @05:38AM
(#26709903)
> Once the transaction is done, the invoice mailed and the product shipped - there is 0 need for this data to still be stored in their database.
This data can often still be necessary for legal and/or tax purposes.
Re:Booking.com fined €475k for reporting data breach too late
by freebuju on Tuesday April 06, 2021 @06:04AM
(#26710053)
There's nothing wrong with storing customer purchase data as long as this is processed and stored in a legally compliant manner. This data is crucial for other things such as returns and refunds.
Re:Booking.com fined €475k for reporting data breach too late
by CodesInChaos on Tuesday April 06, 2021 @06:04AM
(#26710056)
Companies must archive invoices for 10 years. But of course that doesn't necessarily require keeping an account for the customer.
Any purchase I make, the shop needs my address and my payment info. It's always the same. Every browser can autofill it, if they bothered using the correct forms. Once the transaction is done, the invoice mailed and the product shipped - there is 0 need for this data to still be stored in their database.
-> Address and payment info - browser auto fill
-> purchase history - invoice via mail
I used to be heavily biased to buy from Amazon, since it is basically one click. But lately, I'm more and more buying from smaller online shops which provide checkout without user account.
I'm sure there is many things where you need to store user data, but also, there is definitely more things were user data is stored although it is not needed.
And ultimately, that is the spirit of GDPR - ask yourself if you really need to store that data.