[CodesInChaos]

This case is rather complex, because the customers have a contractual relationship both with booking.com and directly with the hotel. This makes it difficult to tell whose responsibility the breach notification is. I would have said that it's the responsibility of the individual hotels here.