[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
DPC Ref:
DPC Complaint Ref:
Reference Number in National System:
Date: 14 June 2023
Complainant:
Data Controller: Airbnb Ireland UC
RE: v Airbnb Ireland UC
This document is a final decision of the Data Protection Commission of Ireland ("DPC") in relation to DPC complaint reference, ("Complaint"), submitted by ("Complainant"), against Airbnb Ireland UC ("Airbnb"), to the North Rhine-Westphalia Data Protection Authority ("North Rhine-Westphalia DPA") and thereafter transferred to the DPC in its capacity as lead supervisory authority. The Berlin Commissioner for Data Protection and Freedom of Information ("Berlin DPA") was later identified as the concerned supervisory authority.
The final decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General Data Protection Regulation ("GDPR").
### Communication of Draft Decision to "Supervisory Authorities Concerned"
In accordance with Article 60(3) of the GDPR, the DPC is obliged to communicate the relevant information and submit a draft decision, in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a draft decision in relation to the matter to the "supervisory authorities concerned". As Airbnb offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as lead supervisory authority identified that each supervisory authority is a supervisory authority concerned as defined in Article 4(22) of the GDPR. On this basis, the draft decision of the DPC in relation to this complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.
1
An Coimisiún um Chosaint Sonraí
Data Protection Commission
# Complaint Handling by the DPC – Timeline and Summary
1. The complaint was initially submitted to the North Rhine-Westphalia DPA on 27 April 2018 and thereafter transferred to the DPC on 18 June 2018, via the IMI to be handled by the DPC in its role as lead supervisory authority. The Berlin DPA was later identified as the relevant concerned supervisory authority. The Complainant stated that Airbnb failed to properly respond to a deletion request he submitted in April 2018. Further, the Complainant stated that when he submitted his request for deletion of his personal data, Airbnb requested that he verify his identity by providing a copy of his identity document ("ID"), which he had not previously provided to Airbnb. The Complainant made his deletion request to Airbnb on 21 April 2018 and Airbnb requested the Complainant to verify his identity using a copy of his ID on 25 April 2018. Airbnb's response to the Complainant stated: "We have installed an identification and verification process to prevent the erasure of data or the transfer of data to a person that just claims to be the account holder. If you want us to erase your personal data, please send us a new request together with a copy of an identification document in your name (passport, identity card or driver's licence). Without this document we will not be able to perform the process." There was no information in Airbnb's letter to the Complainant about other options in the event that he was not satisfied to provide a copy of an ID document. The Complainant did not provide a copy of his ID to Airbnb in response to that request nor did he respond to Airbnb to express any concerns about its request for a copy of ID. In his complaint to his local data protection authority he stated that he did not see any lawful basis in respect of Airbnb failing to give immediate effect to his deletion request.
2. The DPC contacted Airbnb about this complaint by letter dated 20 September, 2018 and it outlined a number of queries. By letter dated 05 October 2018, Airbnb set out its response to queries contained in the DPC's letter dated 20 September 2018. Within that letter Airbnb also suggested that it work directly with the complainant in this case to resolve their concerns and it stated that it was hopeful that such concerns could be quickly and amicably resolved.
3. The DPC wrote to the Complainant, by letter dated 11 December 2018 stating:-
"Airbnb have asked the DPC to provide you with the following contact details, so that you can contact Airbnb directly to discuss your concerns. The email address is: [email protected]. Please quote the complaint reference and your Airbnb User ID when contacting Airbnb. Please note that, where amicable resolution of the complaint cannot be reached, then in accordance with section 109(4) and 113(2) of the Act, we will write to you confirming the action that will be taken in relation to your complaint. In the event that the matter is resolved amicably, your complaint will be deemed to be withdrawn, as provided for by
2
An Coimisiún um Chosaint Sonraí
Data Protection Commission
section 109(3) of the Act. This means that your case file in this office will be closed."
4. By email to the DPC dated 13 March 2019, Airbnb stated that it had been in contact with the Complainant on a number of occasions since its previous correspondence with the DPC. Airbnb stated that the Complainant successfully completed Airbnb's identity verification process on 13 February 2019 and that it had commenced the deletion process. The Complainant queried when that process would be completed. Airbnb advised that, by email dated 4 March 2019, it explained that the deletion process itself happens over a period of time across Airbnb's systems and that, as a result, Airbnb was not in a position to confirm the exact date on which the deletion process completes for any given request. Airbnb informed the DPC that it had not received any further correspondence from the Complainant and that it would be grateful if the DPC could let Airbnb know if it could now consider the matter closed.
5. By letter dated 15 March 2019, the DPC notified the Complainant of Airbnb's email and sought confirmation from the Complainant whether he considered this complaint to be amicably resolved. The DPC explained that absent a reply from the Complainant within a two-month time frame it would consider the matter to have been resolved.
6. The Complainant, by submission to the Berlin DPA dated 10 June 2019, outlined his dissatisfaction with the response from Airbnb and sought more updated information in relation to the completion of his deletion request.
7. The DPC, by email dated 14 January 2020, notified Airbnb of the Complainant's outstanding concerns, indicating that he sought further clarification/s prior to him considering the matter resolved. In particular, the Complainant sought information in respect of the precise date his data was deleted and where / how he would receive confirmation of his erasure request. He also stated, in respect of Airbnb's request for provision of his ID, that he was only later informed that alternative methods were available for identity verification. He queried what reasonable doubts, as per Article 12(6) of the GDPR, Airbnb had which necessitated the identity verification process in his case.
8. By email of 28 January 2020, Airbnb reiterated to the DPC that it could not provide a precise date on which the Complainant's data was deleted as the deletion process happens over a period of time across multiple systems. It said that when it informed the complainant of this on 4 March, 2019 he failed to respond. Airbnb confirmed that the Complainant's personal data had been
3
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
deleted in accordance with his Article 17 right of erasure.
9. Airbnb stated that, in respect of identity verification, as outlined in its letter of 5 October 2018, when a user requests that their account be deleted, Airbnb's starting point is that an account is a valuable resource and the fraudulent deletion of an account could create a risk of harm, both financial and physical, to a user. Therefore Airbnb seeks to verify the identity of the person requesting the deletion of an account. It stated that providing a copy of ID is one of the most practical and easily accessible methods for users to verify their identity.
10. Airbnb noted that, in general, alternative methods of identity verification are applied on an exceptions only basis as verification by ID is the most standard, efficient and secure method of identity verification.
11. Airbnb stated that when the Complainant submitted his deletion request in April 2018, he did not raise any concerns directly to Airbnb when it responded requesting that he provide ID for identity verification purposes. Airbnb stated that the Complainant did not respond at all and that as such Airbnb was not given the opportunity to offer the Complainant an alternative method of verification.
12. Airbnb stated that it only became aware of the Complainant's concern in relation to the request for the provision of his ID once the DPC had become involved in the matter. Airbnb at that point engaged with the Complainant directly to explore other verification solutions and arrange for the deletion of this account. Airbnb stated that as it complied with its obligations in respect of the Complainant's rights in accordance with the GDPR, it trusted that it could consider the matter resolved / closed.
13. By letter of 29 January 2020, the DPC wrote to the Complainant noting that he was unwilling to consider the matter resolved without explicit confirmation that his personal data had been erased by Airbnb. The letter set out that, following his correspondence with the DPC, it engaged in further contact with Airbnb and that Airbnb explicitly confirmed to the DPC that the Complainant's personal data had been deleted. The letter stated that it appeared that this resolved his complaint and that the DPC would therefore review his file for closure and his complaint would be deemed to be withdrawn (as per section 109(3) of the Data Protection Act 2018). The letter stated that if the Complainant remained dissatisfied, he should set out the reasons for his dissatisfaction within one month of the date of the letter.
14. The Berlin DPA wrote to the DPC, by letter received on 03 June 2020. It
4
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection Commission
stated that the deletion of the Complainant's data began on 04 March 2019, almost one year after the request was submitted to Airbnb. It stated that the Complainant was not informed about the final deletion by Airbnb and therefore the data may have only been completely deleted later than 04 March 2019. It stated that according to the reading of Article 17(1) in conjunction with Article 12(3) of the GDPR, the deletion must take place immediately, i.e. without the possibility of extending the deadline in accordance with Article 12(3) of the GDPR. It stated that there are serious doubts that the deletion process at Airbnb was carried out without delay. It stated that due to the intention to regard the procedure as an amicable resolution, the legal violations in question, Articles 12(3) and (6) GDPR in conjunction with Article 17 of the GDPR, are not conclusively assessed and that moreover, no reply was given to the Complainant's questions and it can therefore be assumed that the request of the data subject concerned was not sufficiently addressed. It stated that consequently it cannot be assumed that an amicable resolution has been reached and it asked the DPC to publish a draft decision according to Article 60(3) of the GDPR so that it can express its relevant and reasoned objection according to Article 60(4) of the GDPR. The DPC notes by way of clarification that in its communication of 28 January, 2020 Airbnb did respond to the DPC in relation to the Complainant's questions (as outlined above in paragraphs 8 to 12 inclusive) and that Airbnb's response was not confined to the matter of the date of deletion.
15. The DPC received an email from the Complainant dated 01 March 2020, stating his view that the contradictions in the statements made by Airbnb showed that the requirements of the GDPR were not sufficiently observed or taken into account.
16. The DPC received a further email from the Complainant, which was dated 21 March 2021, wherein he stated that he would not be agreeing to an amicable resolution.
17. The DPC notified Airbnb by letter dated 03 December 2021 that it had not proven possible to reach an amicable resolution of this complaint and that the DPC was required to comply with section 113(2) of the Data Protection Act, 2018 which provides that the DPC shall "make a draft decision in respect of the complaint (or, as the case may be, part of the complaint) and, where applicable, as to the envisaged action to be taken in relation to the controller or processor, and, in accordance with Article 60 [of the GDPR] and, where appropriate, Article 65, adopt its decision in respect of the complaint or, as the case may be, part of the complaint".
5
[LOGO]
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
18. In summary, therefore, the DPC was unable to facilitate within a reasonable time an amicable resolution of the complaint through the mechanism of its complaint handling process.
## Conduct of Inquiry
19. Acting in its capacity as lead supervisory authority, the DPC issued a Notice of Commencement of Inquiry, including a request for information, to Airbnb on 13 July 2022.
20. The DPC notified Airbnb that the Inquiry would seek to examine and assess whether Airbnb had complied with its obligations as a data controller under the GDPR and the Act in respect of the relevant processing operations which are the subject matter of the complaint.
21. The DPC notified Airbnb that the scope of the Inquiry concerned an examination and assessment of the following:
a) Whether Airbnb's handling of the Complainant's erasure request complied with the GDPR and the Act;
b) Whether Airbnb had a lawful basis for requesting a copy of the Complainant's ID in order to verify his identity in order to give effect to his erasure request, which he had not previously provided to Airbnb and whether Airbnb complied with the principle of data minimisation when requesting a copy of a data subject's ID in order to verify their account;
c) Whether Airbnb complied in this case with the requirements of Article 12 concerning transparent information, communication and modalities for the exercise of the rights of a data subject.
22. The DPC notified the Complainant, by email and letter sent to the Berlin DPA on 14 July 2022, that an Inquiry had commenced in relation to his complaint. The DPC provided the Complainant with the opportunity to withdraw any information previously provided during the course of the complaint handling procedure and afforded the Complainant the opportunity to submit any new information he wished to submit regarding the complaint. The Complainant responded by email dated 11 September, 2022 and he confirmed his understanding that the DPC had all the relevant information
6
An Coimisiún um Chosaint Sonraí
Data Protection Commission
in relation to his complaint. The Complainant included a copy of all his correspondence with Airbnb.
23. On 25 August 2022, Airbnb provided the DPC with its response to the questions posed in the DPC's Commencement Notice. Airbnb did not indicate that it wished to withdraw any information previously provided during the course of the complaint handling process. However, Airbnb stated that certain information contained in its responses disclosed confidential and commercially sensitive information about Airbnb's internal security processes, with the effect that the dissemination of this information would compromise or undermine these processes. Airbnb stated that its responses to the DPC dated 5 October 2018, 13 March 2019 and 28 January 2020 contain similar information that should be treated as confidential and commercially sensitive. Airbnb stated it would welcome the opportunity to review and comment on any proposed sharing of the material in its letter and the previous responses to the underlying complaint, including any proposed sharing with concerned supervisory authorities.
24. Under the title of "Overarching comments" Airbnb set out its position in relation to its identity verification policy, stating that the policies and procedures are designed and implemented to protect the Airbnb platform and its users, in accordance with its obligations under the GDPR and in a manner that facilitates and safeguards the rights of data subjects under the GDPR. Airbnb stated it diligently reviews its policies and procedures to ensure that they comply with all applicable laws, reflect best industry practice and are consistent with the ever changing legal, social and technological landscape within which Airbnb operates. Airbnb stated that at the time the Complainant submitted his deletion request, ID verification represented the preferred method of authentication¹, given the probative value of ID verification and the safety and security issues relating to the nature of the Airbnb platform. Airbnb stated however, that in accordance with its commitment to updating its practices in alignment with best practice and regulatory expectations in the data protection space, Airbnb has since revised its practices. It stated that Airbnb's "manage your data" tool, incorporating two-factor authentication, is now the primary method of authenticating deletion requests. Airbnb stated that it is moving towards a practice of only using ID authentication in circumstances where it is necessary because other methods are unsuitable or unavailable². Airbnb
¹ In its submission on the Preliminary Draft Decision Airbnb stated "...IDs are no longer used for data subject right authentication purposes".
² Ibid
7
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection Commission
stated that while it has endeavoured to respond to the DPC in as comprehensive a manner as possible, difficulties arise in investigating certain parts of the underlying factual and contextual issues in a historical case such as this where the relevant account no longer exists.
25. With respect to the Complainant's deletion request, Airbnb stated that on 21 April, 2018 the Complainant submitted his deletion request and on 25 April, 2018 the Complainant was asked to authenticate his request by providing a copy of his ID. Airbnb stated that the Complainant did not respond. Airbnb stated that these events occurred before the GDPR was applicable. Airbnb stated that when it received the complaint via the DPC in September 2018, it engaged with the Complainant and authenticated his deletion request by alternative means, namely a manual account login check. Airbnb stated that had the Complainant raised issues with ID verification, alternative verification options could have been explored.
26. Airbnb stated it received the Complainant's erasure request on 21 April 2018 and it provided an internal administrative log evidencing this communication to the DPC.
27. Airbnb first responded to the Complainant's erasure request on 25 April 2018 and again it provided an internal administrative log evidencing this communication to the DPC.
28. Airbnb stated that the Complainant ultimately authenticated his deletion request on 13 February 2019 and his account was deleted, with its records indicating that deletion was completed on 04 March 2019.
29. In response to the DPC's query regarding the reason for the delay in processing the Complainant's erasure request, Airbnb stated that while the Complainant originally requested deletion on 21 April 2018, he disengaged with the process once he was asked to authenticate his request. Airbnb stated that when it received the complaint in September 2018, it engaged with the Complainant to authenticate the request through an alternative verification method which led to the successful authentication of his request and ultimately the deletion of his account.
30. Regarding the date on which Airbnb first requested a copy of the Complainant's ID in the context of processing his erasure request and the dates of any subsequent requests by Airbnb for a copy of the Complainant's ID if/where such requests were made, Airbnb stated that it requested the Complainant's ID on 25 April 2018.
8
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection Commission
31. In response to the DPC's query as to whether the Complainant's erasure request was completed without the need for the Complainant to provide a copy of their ID / whether the Complainant ever provided Airbnb a copy of their ID for the purpose of the processing of their erasure request, Airbnb stated that the Complainant's deletion request was authenticated without him having to provide a copy of his ID, through a manual account login check.
32. With respect to the legal basis relied upon by Airbnb for requesting a copy of the Complainant's ID in order to verify his identity in order to process his erasure request, in circumstances where the Complainant had not previously provided ID to Airbnb, Airbnb stated that when it requested a copy of the Complainant's ID, it relied on the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform, in accordance with Article 6(1)(f) of the GDPR. Airbnb stated that with reference to the DPC's comments regarding the fact that the Complainant had not provided a copy of an ID document previously, the corroborative value of requesting ID is not dependent or predicated on there being a pre-existing ID on the user's account, and instead forms part of a holistic approach to identity verification, carried out with reference to the totality of information available to Airbnb that can be compared against the information in the ID.
33. In response to the DPC's query whether Airbnb considered it both necessary and proportionate to request a copy of a data subject's ID to verify their identity, in particular in circumstances where they had not previously provided their ID to Airbnb and therefore, Airbnb had nothing to verify it against, Airbnb stated that at the time the Complainant submitted his deletion request, ID verification represented the preferred method of authentication, given the probative value of ID verification and the safety and security issues relating to the nature of the Airbnb platform. Airbnb stated that if the Complainant had responded to its email dated 25 April 2018 raising issues with the requirement to provide ID, it could have facilitated an alternative verification method, which it ultimately did in February 2019. Airbnb stated that given it is necessary for Airbnb to design, implement and maintain robust safety and security measures, its believes that its identity verification processes are a necessary and proportionate means of achieving the purpose of protecting the Airbnb community and indeed the broader community, in compliance with its obligations under the GDPR.
34. With respect to the reasonable doubts, if any, that Airbnb had concerning the Complainant's identity such that Airbnb considered it necessary to request a copy of the complainant's ID, Airbnb stated that the Complainant's Airbnb
9
[LOGO]
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
account has been deleted, rendering it very difficult for Airbnb to comment on the specific doubts, held by Airbnb at that time, about the identity of the Complainant.
35. In response to the DPC's query whether Airbnb provides data subjects with other methods by which to verify their identity, Airbnb referred to its earlier responses in respect of describing its authentication methods.
36. With respect to any data minimisation efforts made by Airbnb, Airbnb stated that the "manage your data" tool and two-factor authentication is now the preferred method of identity verification, with ID verification forming a fall-back option in a suite of measures designed to accommodate the different circumstances in which the right to erasure under Article 17 of the GDPR may be exercised. Airbnb stated that if the user is unwilling or unable to provide an ID document, it will engage with the user in an attempt to verify his or her identity by alternative authentication methods. Airbnb stated that where IDs are used to authenticate deletion requests, they are solely used for authentication purposes and deleted once authentication is achieved.
37. In response to the DPC's query whether Airbnb notified the Complainant of Airbnb's Terms of Service and Privacy Policy which were in place when the Complainant joined the Airbnb platform on 11 February 2018 (both dated 19 June 2017) and was requested to verify his identity on 25 April 2018 (Terms dated 19 June 2017, Privacy Policy dated 16 April 2018). Airbnb stated that links to these documents were made available to the Complainant at the beginning of the sign-up flow to create an Airbnb account. Airbnb provided screenshots in this regard and also provided a copy of the email notification that would have been sent to the Complainant (In German) regarding the updated Privacy Policy. Airbnb stated that Section 2.4 of the Terms of Service informed individuals about Airbnb's identity verification processes, while similar disclosures were contained within sections 1.1, 2.2, 3.4, 3.8, 6.3 and 6.4 of policy dated 19 June 2017 and within sections 1.1, 2.2, 3.6, 3.7 and 6 of policy dated 16 April 2018.
38. In response to the DPC's query as to whether any personal data is processed further by Airbnb, in circumstances where a data subject provides a copy of their ID to Airbnb to facilitate the processing of an erasure request and / or where the data is retained following the verification process / completion of an erasure request, Airbnb stated that IDs are deleted after authentication.
39. In response to the DPC's query regarding whether the process of requesting
10
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection Commission
a copy of a data subject's ID in order to verify their identity for the purpose of processing erasure requests is still being utilised by Airbnb, Airbnb referred to its earlier "overarching comments" where it explained the circumstances in which ID are still used to authenticate deletion requests.
40. With respect to how Airbnb complied with relevant provisions under Article 12 of the GDPR, in particular Article 12(2), (3), (4), (6) and (7), Airbnb stated that when the Complainant submitted his deletion request in April 2018, prior to the GDPR coming into effect, Airbnb had measures in place to facilitate rights under the applicable data protection law, including the right to have personal data deleted. Airbnb stated that section 6 of its readily-accessible and user-friendly Privacy Policy (dated 16 April 2018, and provided with its response), which was accessible through both its website and Airbnb communication such as emails, explained to individuals how they could exercise their rights, including the right to erasure, by emailing Airbnb's data protection office email account. Airbnb stated that in the opening paragraph of section 6, individuals were informed that they may be asked to verify their identity before any further action was taken on their request, which aligns with the broader identity verification practices set out in the Privacy Policy. Airbnb stated that in section 10 of the Privacy Policy, it provided individuals with additional contact information, including the physical addresses of its offices for written correspondence purposes. Airbnb stated that these Privacy Policy disclosures were supplemented by Airbnb Help Centre articles which explained Airbnb's identity verification practices in more detail. Airbnb stated that when the deletion process was commenced, Airbnb informed the Complainant that this process was underway but that it would not be in a position to provide a specific date on which the process would be completed, although a one-month deletion period was specified. Airbnb stated that it is not aware of an interpretation of Article 12 of the GDPR which imposes an obligation on data controllers to inform data subjects when the deletion process has completed. Airbnb stated that its records indicate that the deletion of the Complainant's account completed in or around 4 March 2019, less than one month after his request was authenticated.
## Sequence of Key Events as Established By Inquiry
41. The following is the sequence of key events regarding this case:
- 21 April, 2018: Deletion Request sent to Airbnb by Complainant.
- 25 April, 2018: Airbnb responded to Complainant asking for a copy of his ID in order to confirm that he was the owner of the account. The Complainant did not respond to Airbnb.
11
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
- 27 April, 2018: Complainant sent complaint to North Rhine-Westphalia DPA concerning Airbnb.
- 25 May, 2018: GDPR became applicable.
- 27 May, 2018: Complainant sent a further complaint to the Berlin DPA concerning Airbnb as GDPR had become applicable.
- 11 September, 2018: Translated complaint sent to DPC as Lead Supervisory Authority for Airbnb.
- 20 September, 2018: DPC notified Airbnb of receipt of the complaint. Prior to this date Airbnb had not been notified by the Complainant, by the North Rhine-Westphalia DPA or by the Berlin DPA that the Complainant had complained to those data protection authorities about Airbnb's request to him to provide a copy of an identity document.
- 5 October, 2018: Airbnb replied to DPC. It suggested direct engagement with the Complainant to resolve matters amicably.
- 16 December, 2018: DPC wrote to Complainant to provide him with contact details of Airbnb's DPO in order to enable direct contact.
- 23 January, 2019: Complainant commenced written dialogue with Airbnb and provided his Airbnb username.
- 23 January, 2019: Airbnb replied to the Complainant stating its understanding that he wished to exercise one of the GDPR rights, namely the right of erasure. As an alternative to submitting any further personal information to verify his request, Airbnb offered him a log-in verification as an alternative and that it would activate his deactivated account in order for him to log-in. Airbnb sought the complainant's consent to proceed.
- 23 January, 2019: The Complainant replied to Airbnb seeking information on what he needed to do.
- 4 February, 2019: Airbnb notified the Complainant of the steps he needed to take to proceed with the deletion request.
- 4 February, 2019: Complainant replied to Airbnb confirming steps to proceed.
- 12 February, 2019: Airbnb notified Complainant that his account had been reactivated and advised him to log in. It stated that as soon as it traced a successful log within the following three days that it would process his deletion request immediately.
- 14 February, 2019: Airbnb notified Complainant that it was able to verify his deletion request on 13 February, 2019 and that it had started to implement his deletion request.
- 4 March, 2019: Airbnb notified Complainant that the deletion of his data began on 4 March, 2019.
12
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
## Notification of the Preliminary Draft Decision to the Data Controller
42. The DPC provided a copy of the preliminary draft decision to Airbnb.
43. In its subsequent submissions Airbnb sought for paragraph 24 of the preliminary draft decision to be supplemented reflecting its clarification that IDs are no longer used for data subject right authentication purposes. It stated that "the use of IDs has been completely phased out of data subject rights authentication". Airbnb also sought for paragraph 50 of the preliminary draft decision (now paragraph 56 below of the decision) to be supplemented reflecting its clarification about the timelines for deletion and its interpretation that Article 12 of the GDPR does not require that a date on which deletion is completed be communicated to data subjects.
44. The DPC has carefully considered the submissions of Airbnb in making this decision. Footnotes have been inserted at paragraphs 24 and 56 to address the points made in Airbnb's submissions.
## Notification of the Preliminary Draft Decision to the Complainant
45. The DPC provided the Complainant with a copy of the preliminary draft decision, via the Berlin DPA, on 03 April 2023. The Complainant, by correspondence dated 27 April 2023, submitted:-
"I have received and read your letter including the DPC's Draft
Decision. I will not lodge an objection or file a response to the
DPC's decision.
The result of the procedure is not optimal, as the previous business actions by Airbnb are still not acceptable in my view!
It is to be considered positively that Airbnb had to adapt their processes towards an improved data protection and that my data were ultimately erased..."
46. The DPC has carefully considered the submissions of the Complainant in making this decision.
13
[LOGO]
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
# Relevant and Reasoned Objections and Comments from “supervisory authorities concerned”
47. Having transmitted the draft decision on 12 May 2023 to the “supervisory authorities concerned” in accordance with Article 60(3) of the GDPR, the DPC did not subsequently receive any relevant or reasoned objections under Article 60(4). As no objections were received within the prescribed time limits, the DPC did not revise the draft decision.
# Applicable Law
48. For the purposes of its examination and assessment of this complaint, the DPC has considered the following Articles of the GDPR:
- Article 5
- Article 6
- Article 12
- Article 17
# Findings of Inquiry
# Issue A – An examination of whether Airbnb’s handling of the Complainant’s erasure request was compliant with the GDPR and the Act
49. The Complainant asserted that upon submitting a request for erasure Airbnb requested that he provide a copy of his photographic ID in order to verify his identity. The Complainant contends that Airbnb’s handling of his erasure request was not compliant with Article 17 of the GDPR and that it failed to properly comply with the erasure request he had submitted, in particular that it failed to give effect to the erasure of personal data concerning him without undue delay.
50. Airbnb asserted that while the Complainant originally requested deletion on 21 April 2018, he disengaged with the process once asked to authenticate his request on 25 April 2018. When Airbnb received notification of the complaint from the DPC on 20 September 2018, it subsequently engaged with the Complainant to authenticate the request through an alternative verification method, namely a manual account login check which led to the successful authentication of his request and ultimately the deletion of his account. Airbnb also stated that, had the Complainant raised an issue with Airbnb over the ID verification request alternative verification options could
14
An Coimisiún um Chosaint Sonraí
Data Protection Commission
have been explored.
51. During the handling of the complaint, Airbnb advised the DPC that the Complainant successfully completed its identity verification process on 13 February 2019. It confirmed to him by email that it had commenced the deletion process on this date. Airbnb advised the DPC that the Complainant queried when that process would be completed and that it explained to him by email on 4 March 2019 that the deletion process itself happens over a period of time across its systems and that, as a result, it was not in a position to confirm the exact date on which the deletion process completes for any given request as it did not have that information. It also stated that it had not received any further correspondence from the Complainant.
52. By letter dated 5 October 2018 Airbnb stated the following :-
"In certain cases Airbnb can waive the ID production requirement on account deletion. In particular this may be done where there is no suspicious activity and we can engage directly with the user and take other steps to verify their identity (e.g. having a call with the user and asking for account details that in principle should only be known to them). We have specific policies in place to address this issue. Therefore, we would suggest that Airbnb works directly with the complainant in this case to resolve their concerns...[...]...We would be grateful if your Office [the DPC] could notify the complainant that alternatives to the provision of an ID may be available and if possible, provide us with the identity of the complainant so that we can address their concerns directly."
53. By email dated 10 December 2018, the DPC sought information from Airbnb regarding how best the Complainant might contact Airbnb. Airbnb responded by email dated 11 December 2018 providing the relevant contact and communication details. The DPC forwarded this information to the Complainant on 11 December 2018.
54. The DPC sought an update from Airbnb on 8 March 2019. Airbnb indicated that as of 13 March 2019, it had been in contact with the Complainant on a number of occasions and that the Complainant successfully completed its identity verification process on 13 February 2019. Airbnb confirmed to the Complainant by email that it had commenced the deletion process.
55. By correspondence dated 4 March 2019, the Complainant stated that he wanted confirmation of deletion and that he should have been notified of and given the option of alternative methods to verify his identity so as to
15
An Coimisiún um Chosaint Sonraí
Data Protection Commission
progress his erasure request.
56. Airbnb again confirmed, by email to the DPC dated 28 January 2020, that it cannot provide a precise date on which the data was deleted as the deletion process happens over a period of time across it systems$^{3}$. It stated that the Complainant failed to respond to its correspondence dated 4 March 2019 wherein it had set out this information. In its email of 28 January 2020 it confirmed that the Complainant's personal data had been deleted.
57. Airbnb submitted, in its letter dated 25 August 2022, that the Complainant ultimately authenticated his erasure request on 13 February 2019 and that his account was deleted, with Airbnb's records indicating that deletion was completed on 4 March 2019.
58. As the sequence of key events above outlines, the erasure request was submitted to Airbnb on 21 April 2018; a request for a copy of ID was made to the Complainant on 25 April, 2018 in response the erasure request; the Complainant did not respond to Airbnb; and Airbnb was unaware until the DPC informed it on 20 September, 2018 on foot of receiving the complaint that the Complainant had any objection to providing a copy of photo ID in order to verify his identity. As a result of the engagement that occurred involving the DPC, Airbnb and the Complainant, the erasure request was eventually completed in March 2019 after the Complainant completed Airbnb's verification process (without providing a copy of ID) on 13 February, 2019.
59. On the basis of the above, in circumstances where Airbnb was unaware until notified by the DPC on 20 September 2018 that the Complainant had any concerns about its response of 25 April, 2018 to his erasure request and where Airbnb subsequently engaged with the DPC shortly thereafter in relation to re-establishing contact with the Complainant and verifying his identity by alternative means the DPC considers that there was no undue delay on the part of the controller, Airbnb, in relation to handling the erasure request of the Complainant.
60. The DPC finds that Airbnb did not infringe Article 12(1) of the GDPR in this case.
³ In its submissions on the Preliminary Draft Decision Airbnb stated- "We have processes in place for deleting Airbnb accounts within 1 month, but given that the deletion process is a highly technical process sequenced across a number of systems, it is not standard practice to attempt to point to a specific end-date for deletion in any given engagement with a deletion request...[...]... we are not aware of an interpretation of Article 12 of the GDPR that requires such an end-date to be provided."
16
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
Issue B – Whether Airbnb had a lawful basis for requesting a copy of the Complainant's ID in order to verify his identity to give effect to his erasure request, which he had not previously provided to Airbnb and whether Airbnb complied with the principle of data minimisation when requesting a copy of a data subject's ID in order to verify their account
61. The request from Airbnb that the data subject provide additional information in the form of his ID to verify his identity was made prior to the commencement of the GDPR. This event occurred once only, namely on 25 April 2018, and on the basis of the information and evidence submitted to the DPC's inquiry, it was not requested of the Complainant by Airbnb on any other further occasion either prior to or after the GDPR became applicable. Airbnb subsequently engaged with the Complainant in early 2019 to authenticate his erasure request, without requiring additional information, using an alternative method. Therefore, the conduct and element of this complaint in respect of the controller's request for ID as part of the authentication process cannot be considered continuing conduct, and cannot be considered a potential continuing infringement. The enhanced powers of GDPR cannot be applied in that respect.
62. In light of the fact that there is no evidence that Airbnb made a request of the Complainant, at any time on or after 25 May, 2018 when the GDPR became applicable, to provide a copy of his ID in order for it to process his erasure request, it follows that no infringement of the GDPR occurred with regard to this specific matter.
Issue C – Whether Airbnb complied with its obligations in accordance with Article 12 of the GPDR with respect to its handling of the Complainant's erasure request
63. Article 12(3) of the GDPR states that "[t]he controller shall provide information on action taken on a request under Article 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. The period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject".
17
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
64. The DPC notes that the Complainant submitted his request to Airbnb on 21 April 2018. Airbnb then responded to the Complainant on 25 April 2018 advising that it required the Complainant to provide a copy of an identification document in order to progress his erasure request. Therefore, Airbnb met the requirements of Article 12(3) of the GDPR in terms of responding to the data subject without undue delay and within one month of receipt of his erasure request. The matter of extending the period by two further months and of informing the data subject thereof did not arise in circumstances where Airbnb provided information to the data subject within four days of receipt of the erasure request. In any event, the requirements of Article 12 did not apply at the time of the making of the erasure request in April 2018 as the GDPR was not applicable until 25 May, 2018.
65. The DPC finds that Airbnb did not infringe Article 12(3) of the GDPR with respect to its handling of the data subject's erasure request.
### Decision on Infringements of the GDPR
66. Following the investigation of the complaint against Airbnb Ireland UC, the DPC is of the opinion that in the circumstances of this Complainant's case, Airbnb Ireland UC did not infringe the GDPR with respect to its handling of the data subject's erasure request.
### Exercise of Corrective Power by the DPC
67. As the decision has not identified any infringements of the GDPR, the matter of exercising corrective powers does not arise in this case.
### Judicial remedies with respect to the decision of the DPC
68. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of receipt of notification of such decision. An appeal may also be taken by a data
18
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
controller within 28 days of notification; under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under Section 142, against any imposition upon it of an administrative fine by the DPC.
Signed: Tony Delaney
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
19
1