Berlin Commissioner
for Data Protection
and Freedom of Information
521.15203.13
CR 69327
DD 475767
Berlin, 17.05.2023
# Final Decision
# Preliminary remarks
The complaint (ref. no. 521.15203) was raised before the Berlin DPA in October 2021. It was transferred to the supervisory authority Netherlands, which is the Lead Supervisory Authority (LSA) for the cross-border processing carried out by [REDACTED] in accordance with Article 56 GDPR. The LSA conducted the investigation and the cooperation procedure with all concerned supervisory authorities in accordance with Article 60 GDPR. The LSA proposed a Draft Decision and thereby the complaint was rejected. In accordance with Article 60 (8) GDPR, the Berlin DPA as the supervisory authority with which the complaint was lodged, hereby adopts the decision as it was agreed upon in the cooperation procedure and is included below:
# Summary of the Case
1. On 11 August 2021 the representative of the complainants, [REDACTED] left a review of an accommodation on the platform of [REDACTED]. On 3 September 2021 the complainant noticed that the
Berlin Commissioner for Data Protection
and Freedom of Information (BlnBDI)
Alt-Moabit 59-61, 10555 Berlin
Germany
Phone: +49 30 13889-0
Fax: +49 30 215 50 50
Office hours: Monday to Friday from 10 am
to 3 pm, Thursday from 10 am to 6 pm
E-mail: [email protected]
Website: www.datenschutz-berlin.de
BERLIN
accommodation provider had replied to the review. In this reply the accommodation provider mentioned the full name of the complainants. On the same day the representative of the complainants updated the review and objected to the publication of the complainants personal data. Also on 3 September 2021 the representative noticed that the reply of the accommodation provider was removed. On 4 September 2021 the representative contacted [REDACTED] to complain about the accommodation provider. On 4 September 2021 the accommodation provider posted an updated reply to the review which, again, contained the names of the complainants. The representative updated the review and pointed out that the names of the complainants should not be in the reply of the accommodation provider whilst referring to the data protection office of [REDACTED] The accommodation provider removed their reply on 6 September 2021 and posted an updated reply on 7 September 2021 in which the names of the complainants were not mentioned.
2. [REDACTED] sent an auto-reply to the representative on 4 September 2021 and another response on 1 October 2021. In this response [REDACTED] informed the representative that they have noted the complaint with the accommodation. [REDACTED] informed the representative that reviews are updated within 10 days and that she should not be able to see the review afterwards.
3. On 2 October 2021 the representative responded to the e-mail of [REDACTED] explaining that the reply of the accommodation partner has changed multiple times in the meantime and that she does not understand what [REDACTED] means by 'not being able to see the review'. The updated review, without personal data, is still visible according to the complainant. The representative also stated a second issue, that is that she was concerned that the monitoring mechanism used by [REDACTED] to prevent the publication of names on the platform does not seem to work considering that both the reply of 3 September 2021 and of 4 September 2021 did contain the names of the complainants.
4. On 2 October 2021 the representative filed a complaint at the Berliner Beauftragte für Datenschutz und Informationsfreiheit (hereinafter: Berlin SA) on behalf of the complainants. The complainants believe that there is an systematic failure with regard
Page 2 of 5
to the publication of names of data subjects in the reviews on the platform of
5. On 31 January 2022 the complaint was transferred to the NL SA.
# Investigation by the NL SA
6. On 19 August 2022 the NL SA requested additional information regarding this complaint from The NL SA asked to verify that they check the reviews on their platform for names of data subjects and how they monitor the reviews. On 8 September 2022 responded to this request.
7. confirms that it has systems in place that screen for names used in reviews submitted by users of its platform. All review submissions are reviewed by automated systems, which are configured (and updated from time to time) to assess each post for possible non- conformance with Content Moderation Guidelines and Policies. The Guidelines include the rule that the accommodation provider's response to a review posted by a guest may not mention any personal information not voluntarily disclosed in the guest's review. These automated systems distinguish between posts that can be published and posts that require manual review by a dedicated Content Moderation Team.
8. In this specific case, the response was published while certain names were still visible. When this happens, standard process is to promptly delete such posts when they are flagged, e.g. when a customer sends a related message to Customer Service. In this specific case, the accommodation provider on its own initiative removed its post on 6 September after the data subject updated her review on 3 September 2021. The post of the accommodation provider was visible on the platform from 12 August 2021 until 6 September 2021. This means that the data subject's personal data in the accommodation provider's response were removed within 3 days after the data subject updated her review to complain about it.
9. On 12 September 2022 the NL SA shared response with the Berlin SA. In this VMN the NL SA indicated that the information provided by the complainant and
Page 3 of 5
proves that the content moderating system is not flawless, but in our opinion, this does not indicate that the measures taken by to ensure that accommodation providers do not share personal data in their replies are insufficient. If a submission passes the review while still containing personal information, the data subject can flag the submission and will delete the posts. Further investigation would be required to gain a deeper understanding of the content moderating system and the exact steps and parameters.
10. The NL SA finds such an investigation disproportionate with regard to this specific complaint, considering that the personal data of the complainant were removed within 3 days after the representative updated her review to complain about it.
11. On 12 September 2022, the NL SA invited the Berlin SA to share the reply of with the complainant and to provide their feedback concerning the handling of this complaint. On 21 November 2022 the NL SA sent a reminder to the Berlin SA. The NL SA did not receive a response from the Berlin SA.
# Norm allegedly infringed
Articles 5, 6, 7, 12, 13, 14 and 17 GDPR.
# Proposed action by the NL SA
12. Considering the above the NL SA finds no infringement of the GDPR in this case.
13. The NL SA deems this matter investigated to the extend appropriate and rejects the complaint ex Article 60(8) GDPR. The supervisory authority with which the complaint was lodged (the regulatory authority in Berlin) shall adopt the decision and notify it to the complainant and shall inform the controller thereof.
# Appeal Notice to the complainant
Against this decision a lawsuit before the Verwaltungsgericht Berlin (administrative court of Berlin), Kirchstraße 7, 10557 Berlin is admissible. The lawsuit needs to be filed in written form within one month after the notification of this decision, it can also be filed as an electronic document with a qualified electronic signature (QES) or for the record of the clerk of the court.
Page 4 of 5
Please, note that in case of filing the lawsuit in writing the legal deadline is only met if the lawsuit reaches the administrative court within the deadline.
The Berlin Commissioner for Data Protection and Freedom of Information
Page 5 of 5
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)
\( \therefore m = \frac{3}{11} \)