An Coimisiún um Chosaint Sonraí
Data Protection Commission
DPC Ref:
DPC Complaint Ref:
Berlin DPA Ref:
Date: 09 January 2023
Complainant:
Data Controller: Airbnb Ireland UC
RE: v Airbnb Ireland UC
This document is a decision of the Data Protection Commission of Ireland ("DPC") in relation to DPC complaint reference, hereinafter referred to as the ("Complaint"), submitted by ("Complainant"), against Airbnb Ireland UC ("Airbnb"), to the Bavarian Commissioner for Data Protection ("Bavarian DPA") and forwarded to the Berlin Commissioner for Data Protection and Freedom ("Berlin DPA") in its capacity as the concerned supervisory authority and thereafter referred to the DPC in its capacity as lead supervisory authority.
This decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General Data Protection Regulation ("GDPR").
# Communication of draft decision to "supervisory authorities concerned"
In accordance with Article 60(3) of the GDPR, the DPC was obliged to communicate the relevant information and submit a draft decision, in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a draft decision in relation to the matter to the "supervisory authorities concerned". As Airbnb offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as lead supervisory authority identified that each supervisory authority is a supervisory authority concerned as defined in Article 4(22) of the GDPR. On this basis, the draft decision of the DPC in relation to this complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.
1
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# Complaint Handling by the DPC – Timeline and Summary
1. The complaint was initially submitted to the Bavarian DPA, who then forwarded the complaint to the Berlin DPA. The complaint was thereafter transferred to the DPC, on 03 May 2020, via the IMI to be handled by the DPC in its role as lead supervisory authority. The complainant, a registered Airbnb member and host, stated that in November 2019 Airbnb requested that she verify her identity by providing a copy of her official identification documentation (“ID”), which she had not previously provided to Airbnb: “My husband and I have been offering our holiday apartment on the platform for two years. Now, Airbnb requests to “verify” my identity by scanning/copying my ID and sending it to Airbnb by email. I find this problematic and disproportionate.” The complainant stated that Airbnb had asked her to verify her identity in an email of 27 November 2019. The complainant refused to provide a copy of her ID contending that it was not necessary. The complainant queried the need for the ID verification raising concerns with its lawfulness; she stated Airbnb requested her to verify her identity by scanning/copying her I.D. and sending it to Airbnb by email and that she was not willing to submit a digital copy of her I.D. She stated she had previously provided all necessary documentation at the beginning that was needed to set up an Airbnb account. The complainant stated that she contacted Airbnb in relation to the matter and provided a response she received from a “Community Expert” which appeared to give web links to reasons Airbnb has for requesting a copy of ID and informed her of how to verify her ID online, which she stated was an insufficient response.
2. The DPC notified Airbnb of receipt of the complaint by letter dated 28 May 2020. The DPC also provided Airbnb with a copy of the complaint and the supporting documentation/correspondence provided by the complainant.
3. Airbnb responded to the DPC by email dated 12 June 2020.
4. The DPC provided Airbnb’s response to the complainant, via the Berlin DPA, by email on 14 August 2020, in an attempt to amicably resolve the complaint. The DPC’s correspondence issued from the Berlin DPA to the complainant on 02 October 2020. The DPC invited the complainant to comment in relation to the information provided to the DPC by Airbnb and, in particular, whether she wished to explore the possibility of an alternative verification mechanism with Airbnb in order to regain access to her Airbnb account. The complainant responded by letter dated 12 October 2020 stating that she was not satisfied with Airbnb’s response and that she did not agree to the proposed alternative
2
An Coimisiún um Chosaint Sonraí
Data Protection Commission
procedure to verify her identity as a vacation homeowner. The complainant also advised that she did not agree with the practice of having her identity verified by means of providing a copy of her ID.
5. The DPC notified Airbnb by letter dated 03 August 2021 that attempts to facilitate the amicable resolution of the complaint had not proven successful and that the DPC was required to comply with section 113(2) of the Data Protection Act, 2018 which provides that the DPC shall "make a draft decision in respect of the complaint (or, as the case may be, part of the complaint) and, where applicable, as to the envisaged action to be taken in relation to the controller or processor concerned, and, in accordance with Article 60 [of the GDPR] and, where appropriate, Article 65, adopt its decision in respect of the complaint or, as the case may be, part of the complaint."
6. In summary, therefore, the DPC was unable to arrange or facilitate within a reasonable time an amicable resolution of the complaint through the mechanism of its complaint handling process and the issues that remained unresolved in relation to this complaint following the DPC's complaint handling process were:
a) Whether Airbnb had a lawful basis for requesting a copy of the complainant's ID in order to verify her identity, in particular in circumstances where she, as a registered member/host with Airbnb, had not previously provided her ID to Airbnb; and
b) Whether Airbnb complied with the principle of data minimisation when requesting a copy of the individual's ID in order to verify their account.
# Conduct of Inquiry
7. Acting in its capacity as lead supervisory authority, the DPC issued a Notice of Commencement, including a request for information, to Airbnb on 28 January 2022.
8. The DPC notified Airbnb that the Inquiry would seek to examine and assess whether Airbnb had complied with its obligations as a data controller under the GDPR and the Act in respect of the relevant processing operations which are the subject matter of the complaint.
3
An Coimisiún um Chosaint Sonraí
Data Protection Commission
9. The DPC notified Airbnb that the scope of the Inquiry concerned an examination and assessment of the following:
a) Whether Airbnb had a lawful basis for requesting a copy of the complainant's ID in order to verify her identity, in particular in circumstances where she, as a registered member/host with Airbnb had not previously provided her ID to Airbnb; and
b) Whether Airbnb complied with the principle of data minimisation when requesting a copy of the individual's ID in order to verify their account.
10. The DPC notified the complainant, by email and letter sent to the Berlin DPA on 08 February 2022, that an Inquiry had commenced in relation to her complaint. The DPC provided the complainant the opportunity to withdraw any information previously provided during the course of the complaint handling procedure and afforded the complainant the opportunity to submit any new information she wished to submit regarding the complaint. The DPC's letter issued from the Berlin DPA to the complainant on 16 March 2022. The Berlin DPA advised the DPC, by email on 29 April 2022, that the complainant had no submissions to make.
11. On 25 February 2022, Airbnb provided the DPC with its response to the questions posed in the DPC's Commencement Notice. Airbnb did not indicate that it wished to withdraw any information previously provided during the course of the complaint handling process. However, Airbnb stated that certain information contained in its responses disclosed confidential and commercially sensitive information about Airbnb's internal security processes, with the effect that the dissemination of this information would compromise or undermine these processes. Airbnb stated that it therefore would welcome the opportunity to review and comment on any proposed sharing of the material in its response, including any proposed sharing with concerned supervisory authorities.
12. With respect to the legal basis relied upon by Airbnb for requesting a copy of the complainant's ID in order to verify her identity, Airbnb stated that it relied on the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform, in accordance with Article 6(1)(f) of the GDPR. Airbnb advised that the evidential value of an ID is not dependant or predicated on there being a pre-existing ID on the user's account. Airbnb stated that when it requests a copy of an ID document for verification purposes, the information on that ID document is then compared against the totality of information relating to the user that is available to Airbnb, including account
4
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
information. Airbnb stated that the authenticity of government-issued ID documentation can be assessed with reference to the design and layout of the ID document when compared against the typical ID produced by the issuing authority. Airbnb advised that this offers an additional layer of trust and security in the identity verification process.
13. In respect of the DPC's query as to why Airbnb considers it necessary and proportionate to request a copy of a member's/host's ID to verify their identity, Airbnb stated that the Airbnb platform is built on the concept of trust and safety, with real world interaction between its users being a fundamental feature of the Airbnb service. Airbnb stated that this marked difference, relative to many other services where real world harm may not be a likely risk, requires it to take steps to ensure that Airbnb hosts and guests can engage and interact with one another in a safe and secure manner. Airbnb advised that it also needs to address the risk of fraudulent activity by bad actors, who often use sophisticated methods to attempt to deceive and defraud Airbnb and its users. Airbnb stated that it believes that the myriad of risks associated with identifying users on a platform such as Airbnb justifies the exercise of diligence, due care and caution when verifying users' identities. Airbnb advised that, in the first instance, it will attempt to verify a user's identity without requesting a copy of an ID document. Airbnb advised that this involves using the existing account information or requesting supplemental information, such as the user's legal name and address, and verifying this information against reliable external databases. Airbnb advised that, where verification through this method cannot be achieved, Airbnb will then ask the user to verify their identity by way of an ID document. Airbnb stated that providing a copy of an ID document is a reliable form of proof of identity that does not impose a disproportionate burden on the individual. Airbnb submitted that its approach is similar to the approach taken by numerous other businesses, such as airlines and international hotels, who request ID because it is a reasonable and straightforward identification method, and who do so independently of any comparison with a previously-held copy ID on file. Airbnb asserted that verification using an ID document is an evidential bridge between online and offline identity and is a reliable method of establishing that the individual behind the online presence is indeed the individual that they claim to be. Airbnb advised that, in terms of probative value of ID documentation, government-issued ID documentation is less likely to be illegitimately obtained or accurately reproduced by counterfeit means when compared with information such as login credentials, which are more susceptible to access/exposure risks and third-party manipulation and misuse, for example misappropriation online. Airbnb stated that the possession of a valid ID document that can be attributed to the Airbnb account holder in question is not only a solid basis on which to conclude that the end-user is who they say they are, but also strengthens trust
5
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
on the platform. Airbnb stated that, for example, bad actors are generally reluctant to provide information about their identity and background as they seek to carry out illegitimate activities, with the result that the provision of an ID document helps to foster trust between Airbnb and its users and indeed between users themselves. Airbnb stated that given that it is necessary for Airbnb to design, implement and maintain robust safety and security measures, in compliance with its responsibilities towards its users and society more generally, it believes that its identity verification processes are a necessary and proportionate means of achieving the purpose of protecting the Airbnb community and indeed the broader community, in compliance with its obligations under the GDPR.
14. With respect to the reasonable doubts, if any, it had concerning the complainant's identity such that Airbnb considered it necessary to request a copy of the complainant's ID, Airbnb advised that it understood this question to be referring to Article 12(6) of the GDPR. Airbnb stated that Article 12(6) is inapplicable in the current case as the request for ID was made to verify the complainant's identity generally, as part of ensuring the security of the platform, and was not made in the context of Articles 15 to 21 of the GDPR. Airbnb stated that, as part of its ongoing efforts to safeguard the Airbnb platform and those connected with it, Airbnb seeks to carry out and enhance verification on accounts, where appropriate. Airbnb advised that, in the complainant's case, Airbnb initially attempted to verify the complainant's identity, without requesting an ID document, on the basis of comparing the existing information on the complainant's account against reliable external databases. Airbnb advised that when this step was unsuccessful, Airbnb offered the complainant the option to provide an ID, or alternatively to submit her legal name and address in order to verify her details against these databases. Airbnb stated that the complainant opted to submit her legal name and address for verification, however, Airbnb was ultimately unsuccessful in verifying the complainant's identity in this manner, resulting in the need to request the submission of a copy of the complainant's ID document through a secure portal.
15. In response to the DPC's query as to whether Airbnb provides a member/host with other methods by which to verify their identity, Airbnb advised that it generally seeks to verify a user's identity without requesting a copy of an ID document, for example verifying account information against reliable external databases. Airbnb advised that in cases where this is not successful, Airbnb may ask the user to submit additional information, for example their legal name and address, to be verified. Airbnb stated that these methods of verification were deployed in the complainant's case but were unfortunately unsuccessful in verifying her identity.
6
An Coimisiún um Chosaint Sonraí
Data Protection Commission
16. With regard to the DPC's query regarding any data minimisation efforts made by Airbnb, Airbnb stated that it will initially attempt to verify a user's identity without requesting a copy of an ID document. Airbnb advised that where ID is required, it processes the copy of the ID documentation in accordance with the safety and security purposes outlined in its Terms of Service and Privacy Policy and the resources referred to within. Airbnb advised that, aside from specific compliance with legal obligations, for example anti-money laundering legislation, the relevant purposes for requesting a copy of a user's ID can be described as follows: (1) verifying the identities of Airbnb users for safety and security purposes and (2) using the ID document for related safety and security purposes, for example investigating incidents on the Airbnb platform that may be linked with IDs previously provided to Airbnb (these processing activities are constituent elements of the overarching purpose of protecting the Airbnb platform and those associated with it). Airbnb advised that when IDs are uploaded to the Airbnb platform, it uses end-to-end encryption measures for the relevant transfer and storage processes, and that it restricts access to these documents to specific authorised personnel for the specific safety and security purposes described above.
17. In response to the DPC's query as to how it first notified the complainant of its Terms of Service and Privacy Policy, Airbnb provided the DPC with copies of the Terms of Service and Privacy Policy which were in place when the complainant joined the Airbnb platform on 01 November 2017. Airbnb advised that links to these documents were made available to the complainant at the beginning of the sign-up flow to create an Airbnb account. Airbnb stated that Section 2.4 of the Terms of Service and Sections 1.1, 1.3 and 2.2 of the Privacy Policy inform individuals about Airbnb's identity verification processes. Airbnb also provided the DPC with copies of the Terms of Service and Privacy Policy that applied when the complainant was asked to verify her identity in November 2019, together with a copy of the email notification it had sent to the complainant regarding the updated Terms and Policy. Airbnb stated that Section 2.4 of the Terms of Service and Sections 2.1.1, 2.1.3, 2.1.5 and 3.2 of the Privacy Policy inform individuals about Airbnb's identity verification processes.
18. In respect of any retention of personal data following the identity verification process, in circumstances where a member/host does provide a copy of ID, Airbnb advised that it typically retains ID documents for the duration of the user's account, for the purposes outlined above, in accordance with the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform. Airbnb advised that in certain circumstances, ID
7
An Coimisiún um Chosaint Sonraí
Data Protection Commission
documents may be retained following the deletion of an Airbnb account, for example to comply with Airbnb's and its affiliate's legal obligations, such as under anti-money laundering legislation, or where necessary in relation to legal claims.
19. With regard to any further processing of personal data by Airbnb, in circumstances where a member/host does provide a copy of ID and/or where the data is retained following the verification process, Airbnb advised that its processing of user's IDs for further safety and security purposes is carried out in pursuit of the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform, in accordance with Article 6(1)(f) of the GDPR. Airbnb again advised that in certain circumstances ID documents may also be processed to comply with anti-money laundering legislation or other legal obligations to which Airbnb and its affiliates are subject, in accordance with Article 6(1)(c) of the GDPR.
20. In response to the DPC's query as to whether Airbnb still requires members/hosts to provide a copy of their ID in order to verify their identity, Airbnb advised that ID verification takes place on the Airbnb platform in a number of contexts, and forms a legitimate part of its safety, security and legal compliance measures.
21. The DPC issued further correspondence to Airbnb, including additional queries, on 08 July 2022.
22. On 22 July 2022, Airbnb provided the DPC with its response. Regarding the precise date in November 2019 that Airbnb requested a copy of the complainant's ID, Airbnb advised that it asked the complainant to verify her identity in an email sent on 27 November 2019 at 9.01pm GMT and it provided the DPC with a copy of the correspondence. Airbnb stated that the complainant was ultimately required to provide a copy of her ID when the verification checks failed.
23. Regarding the DPC's request for any evidence to support Airbnb's assertion that it had initially attempted to verify the complainant's identity, without requesting a copy of ID, Airbnb stated that it had attempted to verify the complainant's identity on the basis of information (name, address and date of birth) submitted by the complainant in the identity verification flow by comparing these details against reliable external databases.
24. The DPC issued further queries to Airbnb on 17 August 2022.
8
An Coimisiún um Chosaint Sonraí
Data Protection Commission
25. Airbnb responded to the DPC's queries on 31 August 2022. With regard to the DPC's query as to the "reliable external databases" Airbnb was referring to, Airbnb advised that it instructs third-party vendors to assist it in its identity verification processes, which includes such third-party vendors reviewing Airbnb information against, what Airbnb considers to be, "reliable external public databases" as part of Airbnb's identity verification processes. In response to the DPC's query as to how Airbnb verifies the accuracy of the information contained on these "reliable external public databases", Airbnb stated that as part of its engagement with these third-party vendors, Airbnb carries out due diligence and ensures that these third parties' processes, including their findings, are satisfactory. The DPC also asked Airbnb why it does not consider it more appropriate to compare information provided by users, for the purposes of verifying their identity, to information they have previously provided to Airbnb e.g. at account set up stage. Airbnb responded stating that the purpose of this initial verification check is to verify the user's identity using existing account information and therefore avoid the need to request additional personal data, in accordance with the data minimisation principle under Article 5(1)(c) of the GDPR. Airbnb stated that where this initial check fails, additional information will then be requested from the user.
26. The DPC has carefully considered Airbnb's submissions in making this decision.
27. In brief, the complaint on which this inquiry by the DPC was initiated concerns a German-based user of the Airbnb platform who signed up as a member and as a host on that platform in November 2017 and who, two years later, received a request from Airbnb to provide a copy of her photo ID. The complainant refused to comply with this request and, as a result, she advised that she no longer has access to the Airbnb platform that she was previously permitted by Airbnb to use as a member and as a host for a two-year period without any requirement to provide a copy of photo ID.
# Notification of the Preliminary Draft Decision to the Data Controller
28. The DPC provided a copy of the preliminary draft decision to Airbnb on 12 September 2022 and requested that Airbnb provide submissions in relation to the content of the preliminary draft decision by close of business 3 October 2022. Airbnb made no submissions on the content of the preliminary draft decision.
9
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# Notification of the Preliminary Draft Decision to the Complainant
29. The DPC provided the complainant with a copy of the preliminary draft decision, via the Berlin DPA on 7 October 2022. In its letter the DPC requested that the complainant provide their submissions in relation to the preliminary draft decision within two weeks of the date of receipt of the letter following its provision by the Berlin DPA.
30. Following the passage of one month without having received submissions from the complainant, the DPC wrote to the Berlin DPA, via the IMI, on 9 November 2022. The DPC explained that it had provided the complainant with a specific timeframe of two weeks of the date of receipt of its letter and the preliminary draft decision to make submissions following its provision by the Berlin DPA and that if we did not hear from the data subject within this timeframe, the DPC would proceed to finalising the draft decision and would provide it to the CSAs in accordance with Article 60 of the GDPR. The DPC also noted that, to date, the DPC had not received any submissions from the data subject on the content of the preliminary draft decision and that as over four weeks had then passed since the cover letter and preliminary draft decision was provided to the Berlin DPA, the DPC intended to finalise and circulate the draft Decision to the CSAs in accordance with Article 60 of the GDPR on 21 November 2022.
31. The DPC received no response to this correspondence to the Berlin DPA and no submissions were received from the complainant concerning the preliminary draft decision in the seven weeks period since the DPC issued it to them.
# Relevant and Reasoned Objections and Comments from “supervisory authorities concerned”
32. Having transmitted the draft decision on 28 November 2022 to the “supervisory authorities concerned” in accordance with Article 60(3) of the GDPR, the DPC did not subsequently receive any relevant or reasoned objections under Article 60(4). A comment, which was not expressed as a formal objection, in relation to the draft decision was received from the Datailsynet (“Danish DPA). The Danish DPA stated:-
The Danish SA agrees that the controller can validly rely on article 6(1)(f) in this situation. We have no further comments in relation to the draft decision.”
33. The DPC gave careful consideration to the comment of the Danish DPA. However, the DPC did not consider that it was necessary to revise the draft decision in light of its comment.
10
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
# Applicable Law
34. For the purposes of its examination and assessment of this complaint, the DPC has considered the following Articles of the GDPR:
Article 5
Article 6
Article 13
# Findings of Inquiry
Issue A - Whether Airbnb had a lawful basis for requesting a copy of the complainant's ID in order to verify her identity, in particular in circumstances where she, as a registered member/host with Airbnb had not previously provided her ID to Airbnb
35. The complainant asserted that Airbnb wrongfully requested a copy of her ID in order to verify her identity and without a legal basis to do so.
36. The complainant created her Airbnb account on 01 November 2017 and had been a registered user, being a member and host, on the Airbnb platform since then. The complainant had been listing and renting a rental property to customers on the Airbnb platform between 01 November 2017 and 27 November 2019. The complainant submitted that she registered as a user using information which did not include or require a copy of her ID, and that Airbnb should have been able to verify her identity by using alternative methods, which did not involve or require requesting a copy of her ID, including using/confirming the personal data it already had collected in relation to her.
37. During the course of the Inquiry, Airbnb stated that it relied on legitimate interest, in accordance with Article 6(1)(f) of the GDPR, as the legal basis for requesting a copy of the complainant's ID in order to verify her identity. Airbnb stated that the safety and security of its users is of paramount importance to Airbnb and that Airbnb requests that users verify their identity in order to enable Airbnb to confirm that they are who they say they are. Airbnb advised that it is in the legitimate interest of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform that Airbnb verify the identity of users. Airbnb
11
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
asserted that its verification procedures are a necessary and proportionate means of achieving the purpose of protecting the Airbnb community, in compliance with its obligations under the GDPR. Airbnb stated that in November 2019, the complainant was contacted by Airbnb in order to verify her identity, and that when the complainant expressed concerns about the legality and safety of providing ID to verify her identity, Airbnb agents sought to reassure the complainant about the legitimacy and secure nature of the process. Airbnb stated that it had been unable to verify the complainant's identity with the information she had provided and that it was at that point that Airbnb sought a copy of the complainant's ID.
38. Article 5(1)(a) of the GDPR states that personal data shall be "processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency')".
39. During the DPC's handling of the complaint, Airbnb stated that as part of the complainant's registration with Airbnb the complainant agreed to Airbnb's Terms of Service and was made aware of Airbnb's Privacy Policy. Airbnb also stated that Section 2.4 of the Terms of Service (last updated 19 June 2017) ("Terms of Service 2017") and Sections 1.1, 1.3 and 2.2 of the Privacy Policy (last updated dated 19 June 2017) ("Privacy Policy 2017") inform individuals about Airbnb's identity verification processes and that links to these documents were made available to the complainant at the beginning of the sign-up flow used to create an Airbnb account. Airbnb stated that Section 2.4 of the Terms of Service for European Users (last updated 1 November 2019) ("Terms of Service 2019") and Sections 2.1.1, 2.1.3, 2.1.5 and 3.2 of the updated Privacy Policy last updated dated 1 November 2019 ("Privacy Policy 2019") inform individuals about Airbnb's identity verification processes and that these applied when the complainant was asked to verify her identity in November 2019.
Information available to the complainant at the time of account creation
40. Section 2.4 of the Terms of Service 2017 states:-
"User verification on the Internet is difficult and we do not assume any responsibility for the confirmation of any Member's identity. Notwithstanding the above, for transparency and fraud prevention purposes, and as permitted by applicable laws, we may, but have no obligation to (i) ask Members to provide a form of government identification or other information or undertake additional checks designed to help verify the identities or backgrounds of Members, (ii) screen Members against third party databases or other sources and request reports from service providers, and (iii) where we have sufficient information to
12
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
identify a Member, obtain reports from public records of criminal convictions or sex offender registrations or an equivalent version of background or registered sex offender checks in your local jurisdiction (if available)."
41. Section 2.3 of Airbnb's Terms of Service 2017 states that "Airbnb may make the access to and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform, subject to certain conditions or requirements, such as completing a verification process".
42. Section 4.2 of the Terms of Service 2017 states that a person "can register an Airbnb Account using an email address and creating a password, or through your account with third-party social networking services".
43. Section 1.1 of Airbnb's Privacy Policy 2017 states that Airbnb "collects information when a person uses the Airbnb Platform including Account information, such as name, email address and date of birth, when a person signs up for an Airbnb account and that it may collect identification, such as a photo of government issued ID and that it collects financial information, such as bank account or credit card information, when user uses Payment Services to process payments."
44. Section 2.2 of Airbnb's Privacy Policy 2017 states that Airbnb "uses, stores and processes information about a person to create and maintain a trusted and safer environment, including to detect and prevent fraud, verify or authenticate information or identifications provided by a person (such as to verify person's Accommodation address or compare a person's identification photo to another photo a person provides), comply with legal obligations and enforce Terms of Service, Payments Terms and other policies."
45. With respect to the above notices available on Airbnb's website at the time the complainant created her account, the DPC is of the view that the complainant was on notice that she may be required to verify her identity, including by providing a copy of photographic ID.
Information available to the complainant at the time of Airbnb's request for ID
46. Section 2.4 of the Terms of Service 2019 states:-
"User verification on the internet is difficult and we do not assume any responsibility for the confirmation of any Member's identity. Notwithstanding the above, for transparency and fraud prevention purposes, and as permitted by applicable laws, we may, but have no obligation to (i) ask Members to provide a form of government identification or other information or undertake additional
13
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
checks designed to help verify the identities or backgrounds of Members, (ii) screen Members against third party databases or other sources and request reports from service providers, and (iii) where we have sufficient information to identify a Member, obtain reports from public records of criminal convictions or sex offender registrations or an equivalent version of background or registered sex offender checks in your local jurisdiction (if available)."
47. Section 2.3 of the Terms of Service 2019 states that “Airbnb may make access to and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform, subject to certain conditions or requirements, such as completing a verification process”.
48. Section 4.2 of the Terms of Service 2019 states that a person “can register an Airbnb Account using an email address and creating a password, or through your account, or through your account with certain third-party social networking services”.
49. Section 2.1.1 of Airbnb’s Privacy Policy 2019 states that “when a person signs up for an Airbnb Account, Airbnb requires certain information such as person’s first name, last name, email address and date of birth, and that Airbnb may collect identity verification information, such as images of government issued ID, passport national ID card, or driving licence as permitted by applicable laws, or other authentication information, to help create and maintain a trusted environment.”
50. Section 3.2 of Airbnb’s Privacy Policy 2019 states that “Airbnb may use, store, and process personal information to create and maintain a trusted and safer environment, such as to detect and prevent fraud, security incidents and other harmful activity; to verify or authenticate information or identifications provided by a person; to verify the accommodation address; to compare the identifications photo to another photo the person provides; to conduct checks against databases and other information sources to the extent permitted by applicable laws and with a person’s consent where required”. Section 3.2 of Airbnb’s Privacy Policy 2019 states that “Airbnb processes this personal information for these purposes given its legitimate interest in protecting the Airbnb Platform, to measure the adequate performance of its contract with the person, and to comply with applicable laws”.
51. With respect to the above notices available on Airbnb’s website at the time the complainant was requested to provide her ID in order to verify her identity, the DPC is of the view that the complainant was on notice that she may be required to verify her identity including by providing a copy of photographic ID.
14
An Coimisiún um Chosaint Sonraí
Data Protection Commission
52. Having reviewed Airbnb's privacy policies and terms of service that were in place both at the time the complainant created her account and separately at the time when Airbnb sought a copy of her photo ID, the DPC is satisfied that there was sufficient information within those documents to inform members that Airbnb may seek a copy of photographic ID to verify identity. In that regard, therefore, and in the circumstances of this complainant's case, the DPC finds that Airbnb complied with the requirements set out in Article 13(1) of the GDPR with regard to the provision of information to the data subject.
# Existence of a lawful basis
53. Article 4(2) of the GDPR defines processing as "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".
54. Article 6(1)(f) of the GDPR states "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child".
55. The DPC considers that Airbnb's request for a copy of the complainant's ID as part of an identity verification process, for the purposes of achieving its legitimate interests, and which made the complainant's use of and access to the Airbnb platform subject to the provision of her ID constituted the collection of personal data and processing as per the definition set out in Article 4(2) of the GDPR.
56. The DPC notes that Airbnb has claimed legitimate interests pursued by the controller as the lawful basis for requesting a copy of ID in order to verify a user's identity to confirm they are who they say they are in order to protect the safety and security of the users of the Airbnb platform, in accordance with Article 6(1)(f) of the GDPR. Noting that the platform that Airbnb operates brings hosts and members who are unknown to each other into a situation where they may actually meet in person at the host's premises, or elsewhere, the DPC agrees that a legitimate interest exists in Airbnb ensuring it has adequate safety and security measures in place to protect users of the platform. The service operated by Airbnb is, therefore, significantly different to a purely online service such as a social media platform. Given that Airbnb members stay at the premises of a
15
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
host “in the real world”, the DPC recognises the importance of verifying the identity of hosts to ensure that they are who they say they are. Given that other means of validating this host’s identity failed, the DPC finds that it was necessary to process the photo ID in pursuit of the legitimate interest. Finally, it finds that in a balancing test, the rights of the host are not prejudiced by this verification process.
57. In those circumstances, therefore, the DPC finds that Airbnb validly relied on Article 6(1)(f) as the legal basis for processing this complainant’s photographic ID once all other efforts that it had deployed to verify her identity were unsuccessful.
# Issue B - Whether Airbnb complied with the principle of data minimisation when requesting a copy of the individual’s ID in order to verify their account.
58. Article 5(1)(c) of the GDPR states “personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”)”.
59. The DPC notes, having regard to the data minimisation principle, Airbnb’s submission that in the first instance it initially attempted to verify the complainant’s identity without requesting a copy of her ID, involved using the existing account information and verifying it against reliable external databases. The DPC notes Airbnb’s submission that when this step was unsuccessful, Airbnb offered the complainant the option to provide her ID, or alternatively to submit her legal name and address in order to verify her details against these databases. The DPC notes Airbnb’s submissions that the complainant opted to submit her legal name and address for verification, however Airbnb was ultimately unsuccessful in verifying the complainant’s identity in this manner, resulting in the need to request submission of the complainant’s ID document through a secure portal. Supporting evidence has been submitted to this Inquiry to demonstrate that Airbnb did make initial attempts to verify the complainant’s identity without requesting a copy of photo ID in the first instance.
60. In the circumstances of this complainant’s case, therefore, the DPC is satisfied that Airbnb gave adequate consideration to the principle of data minimisation when it sought from the complainant a copy of her photographic ID only after all other attempts to verify her identity had proven unsuccessful. Once those attempts failed, it became necessary to seek a copy of the complainant’s photographic ID in order to complete the identity verification process.
16
An Coimisiún um Chosaint Sonraí
Data Protection Commission
61. The DPC finds, therefore, that in the particular situation that arose in this complainant's case, Airbnb's requirement that the complainant verify her identity by submitting a copy of her photographic ID did not infringe the principle of data minimisation that is set out in Article 5(1)(c) of the GDPR.
# Decision on infringements of the GDPR
62. Following the investigation of the complaint made against Airbnb Ireland UC, the DPC is of the opinion that in the circumstances of this complainant's case, Airbnb Ireland UC
- validly relied on Article 6(1)(f) as the legal basis for processing this complainant's photographic ID once all other efforts that it had deployed to verify her identity were unsuccessful;
- did not infringe the principle of data minimisation that is set out in Article 5(1)(c) of the GDPR by requiring the complainant to verify her identity by submitting a copy of her photographic ID.
- complied with the requirements set out in Article 13(1) of the GDPR with regard to the provision of information to the data subject concerning the submission of photographic ID.
# Exercise of Corrective Power by the DPC
63. As the decision has not identified any infringements of the GDPR, the matter of exercising corrective powers does not arise in this case.
# Judicial remedies with respect to decision of the DPC
64. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a
17
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of receipt of notification of such decision. An appeal may also be taken by a data controller within 28 days of notification; under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under Section 142, against any imposition upon it of an administrative fine by the DPC.
Signed:
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
18