Commercial organisations are holding and processing an ever-increasing amount of personal data. Policies and laws are continually changing to require these companies to be more transparent regarding the collection, storage, processing and sharing of this data. This paper reports our work of taking Booking.com as a case study to visualise personal data flows extracted from their privacy policy. By showcasing how the company shares its consumers' personal data, we raise questions and extend discussions on the challenges and limitations of using privacy policies to inform online users about the true scale and the landscape of personal data flows. This case study can inform us about future research on more data flow-oriented privacy policy analysis and on the construction of a more comprehensive ontology on personal data flows in complicated business ecosystems.

翻译：商业组织正在持有并处理日益增多的个人数据。政策与法律持续演变，要求这些公司在数据的收集、存储、处理与共享方面提高透明度。本文报告了以Booking.com为案例，从其隐私政策中提取个人数据流动并进行可视化的工作。通过展示该公司如何共享消费者的个人数据，我们提出了相关问题，并扩展了关于利用隐私政策告知在线用户个人数据流动真实规模与格局所面临的挑战与局限性的讨论。本案例研究可为未来更侧重于数据流动的隐私政策分析，以及在复杂商业生态系统中构建更全面的个人数据流动本体的研究提供参考。