The Dutch data protection authority, Autoriteit Persoonsgegevens, fined Booking.com 450,000 euros for violations related to a 2018 breach. The AP alleges the reservation service provider did not report a breach involving more than 4,100 customers until 22 days after the incident came to light. The delay fell outside of the 72-hour breach notification requirement. AP Vice President Monique Verdier said breaches can "happen anywhere" despite "good precautions," however,  she added that "you have to report this in time" to protect customers.