What happened
The European Commission has opened a formal investigation into Booking.com. The question it is asking is not whether the platform suffered a breach, but whether it did enough to reduce the risk of fraud on it. Specifically, the Commission will assess whether the online travel agency breached the security and transparency provisions of the EU Digital Services Act. Proceedings were announced on October 21, following an earlier preliminary investigation.
Four things are in scope. First, whether Booking.com diligently assessed and mitigated phishing risks, including how reservation and guest data is shared with accommodation providers and what stops that data being misused to phish guests or extract fraudulent payments. Second, the design of the platform's messaging service and how easily it can be abused. Third, whether it properly assessed systemic risks tied to illegal content, including impersonation fraud and non compliant listings. Fourth, whether its advertising meets the DSA's transparency obligations.
If the Commission finds a failure to comply it can impose a fine of up to 6 percent of global annual turnover and require corrective measures. The DSA took effect in November 2022 and applies to Very Large Online Platforms. The Commission noted that opening proceedings does not prejudge the outcome, and that it can accept commitments offered by the company to remedy the matters under investigation. Henna Virkkunen, the Commission's executive vice president for tech sovereignty, security and democracy, said Europeans should be able to book holidays without fear of being scammed, and that the DSA sets clear responsibilities for platforms.
Why this is a GRC story
Security has become a supervisory relationship. Most topics in scope, threat modelling, abuse detection, data sharing controls, are things security teams already do. What is new is a regulator with a process for asking them to demonstrate it. The deliverable is not a fix but a defensible account of how risk was assessed and what was done.
The named failures are design decisions. Reservation data gets passed to property owners because the business model requires it. A messaging feature exists so guests and hosts can talk. Both are reasonable. Both create an abuse channel that a threat model should have surfaced before launch, and the DSA turns that expectation into an obligation.
The fine is percentage based, which makes it a board item. Six percent of global turnover is the kind of number that moves a risk register entry from medium to critical overnight. Third party data sharing, an internal feature, and a marketing practice are now in the same regulatory envelope.
Commitments are a remediation path, and they need evidence. If the Commission accepts commitments, the organisation commits to a documented programme with dates. That is an audit trail, and it is judged on delivery rather than intent.
What to watch
Whether commitments are offered and accepted, and whether the case becomes the reference point for how DSA security duties are read. A finding here would tell every online platform that phishing losses on their own messaging channel count as a governance failure, not just a fraud problem.
The quieter signal is for practitioners outside Europe. Percentage of turnover penalties for inadequate abuse controls are spreading, and the question of who signed off on the risk assessment, and when, is the one that gets asked first.
Attribution: Analysis based on Infosecurity Magazine and related public reporting. This article is original commentary, not a repost of the source material.