An Coimisiún um Chosaint Sonraí
Data Protection Commission
DPC Ref:
DPC Complaint Ref:
Date: 20 July 2023
Complainant:
Data Controller: Airbnb Ireland UC
RE: v Airbnb Ireland UC
# DECISION
This document is a decision of the Data Protection Commission ("DPC") in relation to DPC Complaint reference hereinafter referred to as the ("Complaint"), submitted by ("Complainant") against Airbnb Ireland UC ("Airbnb") to the Berlin Commissioner for Data Protection and Freedom of Information ("Berlin SA"), in its capacity as the concerned supervisory authority. The Complaint was thereafter referred to the DPC in its capacity as lead supervisory authority (LSA).
This decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General Data Protection Regulation ("GDPR").
# Communication of Draft Decision to "supervisory authorities concerned"
In accordance with Article 60(3) GDPR, the DPC was obliged to communicate the relevant information and submit a draft decision in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a draft decision in relation to the matter to the "supervisory authorities concerned". As Airbnb offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as LSA identified that each supervisory authority is a supervisory authority concerned as defined in Article 4(22) GDPR. On this basis, the draft decision of the DPC in relation to this Complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.
# Complaint Handling by the DPC – Timeline and Summary
1. The Complaint that is the subject of this decision was originally submitted to the Berlin SA on 1 January 2019. The Complaint concerns Airbnb's handling of a subject access request and an erasure request made by the Complainant on 6 July, 2018 as well as Airbnb's initial response to those data protection rights requests by seeking a copy of ID from the Complainant.
1
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
2. The background was as follows: the Complainant claimed that Airbnb had failed to comply with two erasure requests he submitted on 18 September 2015 and 12 October 2015 (prior to the application of the GDPR on 25 May 2018). When the Complainant logged back into his Airbnb account on 9 June 2018, the Complainant discovered his account was still active. The Complainant submitted an access request on 6 July 2018 by email, requesting for Airbnb to provide access to his personal data as well as any further information about the processing of his personal data.
"I hereby make use of my right according to the GDPR and demand full access to information.
I am particularly interested
a) what data you have stored about me
b) where you got this data from,
c) if they were not entered by me when registering, on what legal basis you obtained the data and
d) to whom you have transferred them.
I expressly object a transfer to third parties."
3. In addition to the email requesting access to his personal data, the Complainant also asked why his previous erasure requests had not been carried out in 2015, and in addition requested the erasure of his Airbnb account. "Furthermore, I expect an explanation as to why you have not deleted my account, despite two requests (on 18.09.2015 and on 12.10.2015), both by email to [email protected]). To avoid misunderstandings: the account should be DELETED, not DISABLED."
4. On 6 July 2018, Airbnb sent an email to the Complainant acknowledging receipt of his email. On 17 July 2018, Airbnb contacted the Complainant via email acknowledging receipt of the Complainant's access request and erasure request. "You've informed us that you would like to exercise two of the rights provided by the GDPR, namely the right of access to your data and the right to have your data erased." Airbnb requested a copy of the Complainant's proof of identity in order to verify that the person making the requests was actually the person entitled to do so.
5. On 18 July 2018, in response to Airbnb's email of 17 July 2018, the Complainant refused to provide a copy of his identity. "What I find is unacceptable, however, is that I should send you a copy of my ID. Neither for the initial registration, nor for bookings or the deletion of the account is or was the sending of a copy of an ID required."
6. Upon refusal by the Complainant to provide a copy of his ID, Airbnb contacted the Complainant on 19 July 2018. It acknowledged that he would not like to give a copy of his proof of identity and it went on to say that "since we still have to authenticate your request via the contact from the e-mail address on file, I can offer you that we can call you. Would it be possible to do so under the telephone number provided?" On 23 July 2018 the Complainant agreed to this. Airbnb conducted a telephone call with the Complainant on 31 July 2018 to authenticate his requests.
2
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
7. On 30 August 2018, Airbnb responded to the Complainant's access request providing a copy of specific elements of the Complainant's personal data. In its response to the Complainant, Airbnb did not mention or provide details in relation to the handling of the erasure request.
8. On 11 September 2018, the Complainant contacted Airbnb noting his dissatisfaction with Airbnb's response, claiming it to be incomplete and noting Airbnb's failure to contain certain information sought concerning the data processing in accordance with Airbnb's obligations under GDPR. "I requested full information (i.e. everything that a data subject can request in accordance with GDPR). In addition the Complainant noted the response lacked clarity (the Complainant alleged the email attaching his personal data was written in English and contained unsorted table columns with incomprehensible column headings). "Your answer is limited to the transmission of allegedly all data stored with you. All other information is missing. In addition, the data compilation is incomplete: At least credit card information is missing, as well as information on the computers used for logins." The Complainant noted the obligation for Airbnb, in accordance with the GDPR, to provide information "in a form which is "transparent, concise, easily accessible and easy to understand, and that clear and plain language".
9. On 13 September 2018, Airbnb acknowledged receipt of the Complainant's email.
10. On 7 February 2020, the Berlin SA transferred the Complaint to the DPC in its capacity as LSA. The DPC notified Airbnb of the Complaint by letter dated 13 May 2020 and raised certain queries in respect of Airbnb's obligations pursuant to the GDPR relating thereto.
11. On 27 May 2020 Airbnb responded to the DPC, providing a screenshot of its response to the Complainant which had been sent on the same date. In its response, Airbnb stated it believed that the two 2015 pre-GDPR erasure requests had been identified as spam and as such were not properly delivered due to there being no text contained in the body of the emails. It stated in respect of the access and erasure requests of 6 July 2018, that following confirmation of the Complainant's identity, the access file was provided on 28 August 2018 and the erasure of the Complainant's account was "commenced on 29 August 2018." In response to the Complainant's queries regarding further information in relation to the data processing, Airbnb stated it was "not in a position to answer your specific queries with reference to the access file provided in 2018, due to the fact that we no longer hold a copy of this access file and [the Complainant's] Airbnb account has been deleted." As regards the communication in English, Airbnb stated its automatic processes are "set up to provide the cover email in English; however, if a data subject requests a translation into a language such as German, [Airbnb] can facilitate this request."
12. Airbnb apologised for any difficulties the Complainant experienced with the form and layout of the access file provided, noting that it was "an early iteration of our access file production following the introduction of the GDPR." Airbnb stated it was in the process of amending the production of access files, "to refine the clarity and navigability". Airbnb stated it had no record of credit card data having been added to the Complainant's account and that it does not store descriptions of devices used to log into user accounts. In response to the Complainant's queries
3
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
on "Which data? From where? On what legal basis? Transferred to whom?", Airbnb referred the Complainant to the sections 2, 3, 4 and 7 of its Privacy Policy providing a link thereto, stating that it could not provide specificity due to the deletion of the account.
13. The Complainant was dissatisfied by Airbnb's response of 27 May 2020, and made various comments and raised queries relating thereto by email of 3 August 2020 to the Berlin SA, which was transferred to the DPC on 14 October 2020. The Complainant did not accept, inter alia, that his data had been erased and queried why Airbnb erased his data immediately after responding to his access request before he could review them.
14. The DPC notified Airbnb of the content of the Complainant's email of 3 August 2020 and requested Airbnb's views arising therefrom. Airbnb responded by email of 9 December 2020 largely reiterating its response of 27 May 2020 and stating that the Complainant's "access and deletion requests were processed in accordance with [the Complainant's] request and in order to meet the time limits set out in the GDPR". In addition, it provided a German translation of its response of 27 May 2020 and of the email itself. Airbnb confirmed it had no record of the Complainant adding credit card details to their Airbnb account, and stated that even though the Complainant's account had been deleted, the uploading of payment information would have been retained pursuant to section 6.3 of its Privacy Policy. Airbnb stated "Airbnb retains certain categories of personal data following the deletion of an Airbnb account. This includes records of certain activities, including uploading payment information". The DPC wrote to the Complainant conveying Airbnb's responses via the Berlin SA on 24 March 2021.
15. The Complainant reverted to the Berlin SA on 13 July 2021 and re-iterated his dissatisfaction with Airbnb's response to both the Complainant's access and erasure requests and highlighted his dissatisfaction with initially being asked to provide a copy of his ID. The Complainant advised that he did not agree to the amicable resolution of his Complaint.
# Conduct of Inquiry
16. Acting in its capacity as LSA, the DPC commenced an Inquiry in relation to this matter by writing to Airbnb on 22 December 2022.
17. The DPC advised Airbnb that the Inquiry commenced by the Commencement Notice would seek to examine and assess whether Airbnb had complied with its obligations under the GDPR and the Act, in particular under Articles 5, 6, 12, 15 and 17 of the GDPR in respect of the relevant processing operations which are the subject matter of the Complaint.
18. The DPC advised Airbnb that the scope of the Inquiry concerned an examination and assessment of the following:
4
An Coimisiún um Chosaint Sonraí
Data Protection Commission
Issue 1: Whether Airbnb's provision of the personal data and information concerning the processing of that personal data in response to the Complainant's access request was compliant with the GDPR and the Act.
Issue 2: Whether Airbnb's handling of the Complainant's access request was compliant with the GDPR and the Act insofar as the information provided to the Complainant was in a concise, transparent, intelligible and easily accessible form using clear and plain language.
Issue 3: Whether Airbnb's handling of the Complainant's erasure request was compliant with the GDPR and the Act.
Issue 4(a): Whether Airbnb's obligation to provide information on action taken in response to the access and erasure requests without undue delay pursuant to Article 12(3) GDPR was suspended until after the verification of the Complainant's identity by phone call on 31 July 2018.
Issue 4(b): Whether Airbnb had a lawful basis for requesting a copy of the Complainant's ID, and upon the Complainant's refusal to provide same, whether Airbnb had a lawful basis to thereafter request a telephone call in order to verify the Complainant's identity in circumstances where he had submitted a request for access and erasure pursuant to Articles 15 and 17 GDPR.
19. In order to progress the matter, the DPC posed specific queries regarding the access request and the erasure request and the manner in which those requests were handled by Airbnb.
20. The DPC also informed the Complainant via letter dated 23 December 2022, which was issued to the Complainant via the Berlin SA, that an Inquiry had commenced in relation to their Complaint. The DPC provided the Complainant the opportunity to withdraw any information previously provided and asked whether the Complainant had any new information they wished to submit regarding their Complaint. On 9 February 2023, the Berlin SA wrote to the DPC to inform it that the Complainant had not responded to the DPC's update.
21. On 23 January 2023 Airbnb responded to the queries raised by the DPC in its Commencement Notice. In its response Airbnb stated that its identity verification policies and procedures are in place to protect the Airbnb platform and its users in accordance with its obligations under GDPR, in a manner that facilitates and safeguards the rights of data subjects under the GDPR. Airbnb stated it diligently reviews policies and procedures to ensure they comply with all applicable laws, reflect best industry practice and are consistent with the ever-changing legal, social and technological landscape within which Airbnb operates.
22. Airbnb noted that at the time it received the Complainant's access and erasure requests in 2018, ID verification represented the preferred method of authenticating access and erasure requests,
5
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
given the probative value of ID verification and the safety and security issues relating to the nature of the Airbnb platform, including the need to preserve accounts that may be necessary for travel abroad or which may be an important element of an individual's livelihood and the need to avoid disclosing such information to the wrong person.
23. Airbnb informed the DPC that in accordance with its commitment to updating its practices in alignment with best practice and regulatory expectations in the data protection space, it has since revised its practices so that two-factor authentication methods and other authentication methods are used instead of ID verification.
24. Airbnb referred to previous communications with the DPC in the context of another statutory inquiry and DPC decision as regards changes made to its authentication methods and referred to the following extract of the communication sent to the DPC; "Airbnb is committed to complying with data protection law and to enhancing its compliance on an on-going basis. Prior to the DPC's decision, Airbnb had already begun the process of removing IDs from its suite of authentication methods, which began in earnest in August 2020 with the launch of our privacy portal, an account tool for facilitating data subject rights in a manner which utilises two-factor authentication instead of ID verification.¹ In line with the principle of data minimisation, the privacy portal does not require users to provide additional personal data to Airbnb in order to authenticate their requests. This tool is now the preferred method for authenticating erasure requests due to its enhanced security features. In light of these security features, users who submit erasure requests through other channels, such as email, are directed to this portal in the first instance. Notwithstanding the primacy of the privacy portal, Airbnb also facilitates the manual authentication of requests received through other channels, for example by email or phone. However, Airbnb no longer uses IDs to authenticate requests."
25. Airbnb noted that the DPC requested comprehensive responses to various queries, to include supplemental documentation and input from third parties, if necessary, in relation to an Airbnb user account that was deleted in 2018. Airbnb stated that while it had endeavoured to respond to the DPC in as comprehensive a manner as possible, difficulties arose in investigating certain of the underlying factual and contextual issues in a historical case such as this where the relevant account no longer exists.
26. As regards the Complainant's access request, Airbnb stated it received the access request on 6 July 2018. Airbnb advised that due to the deletion of the Complainant's access file, it does not have a record of precisely what would have been provided. However Airbnb stated that access files generally in 2018 included the following categories of data: account information, including profile details, preferences and contact information; listing and reservation data; identity verification information (including ID documents where provided); financial information, such as
¹ "The portal can be access through the "Privacy & sharing" section of user accounts, and can also be reached through section 6 of our privacy policy which leads users to this data subject rights Help Centre page containing links to the account portal page."
6
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
bank account and credit card details used for transactions on the platform; communications on and relating to the Airbnb platform, for example redacted messages with other users and emails to Airbnb; and technical logs relating to activities on the platform, for example account login records.
27. As regards responding to the access request, Airbnb stated that the individuals who handled the Complainant's request misunderstood or failed to appreciate the scope of the Complainant's access request and omitted a response to the Complainant's broader questions about the processing of his personal data, for which Airbnb apologised. Airbnb stated it responded to the Complainant's access request on the terms of specific queries raised by the DPC, sent to Airbnb during the amicable resolution process. "Unfortunately it appears that the individuals handling the complainant's request misunderstood or failed to appreciate the scope of the complainant's access request and omitted a response to his broader questions about the processing of his personal data, an omission that we apologise for." Airbnb stated it responded to those questions sent by the DPC as part of its response to the Complaint, and would answer any additional questions during the Inquiry process.
28. With regards to the personal data provided to the Complainant, Airbnb stated that due to the deletion of the Complainant's account and access file, it could not confirm the scope of the personal data provided. However Airbnb stated it could confirm it withheld certain information from the access file on the basis of Article 15(4) GDPR, such as any third party personal data and confidential/commercially sensitive Airbnb information. Airbnb informed the DPC that the Complainant's broader Article 15 questions were not responded to but that Airbnb ultimately answered the specific questions raised by the DPC on behalf of the Complainant during the complaint handling process.
29. As regards the categories of personal data that were not provided and the corresponding legal basis for withholding that personal data from the Complainant, Airbnb stated it could not confirm the precise scope of the personal data provided and withheld. Airbnb confirmed the categories of data which would have been withheld on the basis of Article 15(4) GDPR were, for example, any third party personal data and confidential / commercially sensitive Airbnb information.
30. As regards retention of information by Airbnb, Airbnb stated that it did not require upon registration credit card details or other payment information at the time of account creation. Airbnb informed the DPC that these details are only required for substantive use of the platform, for example where a guest is making a booking or where a host is setting up a payment method for receipt of reservation payments. Airbnb advised that it had no record of the Complainant ever adding a credit card to his account. Airbnb advised that it retains certain log data relating to Airbnb accounts for security reasons, and could not find evidence in these of logs of a credit card or other payment method having been added to the Complainant's account. Due to the account having been deleted, Airbnb stated it could not comment further.
7
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
31. With regard to the DPC's query as regards Airbnb's handling of the Complainant's access request and why it did not communicate to the Complainant in German so as to be clear and comprehensible in accordance with the principle of transparency, Airbnb referred to its response of 27 May 2020 stating that its practice was to issue access file cover emails in English unless the data subject requested the communication in their preferred native language. Airbnb stated that it did provide the Complainant a German language translation of both of its responses on 9 December 2020.
32. With regard to the DPC's query on the subject of Airbnb's automatic processes to issue cover emails to access requests in English, Airbnb advised that if a user submits an access request through the privacy portal the automated process produces a cover email in the user's identified language. If the request is made outside this channel, such as by email, the default position is to produce an English language version of the cover email unless a request is made for the communication in a preferred language. Airbnb stated it will be looking into making improvements to its processes in this area.
33. With regard to the access file, the DPC requested Airbnb to advise and demonstrate how Airbnb currently meets its obligations under Article 12(1) GDPR in responding to access requests and to advise and demonstrate how the access form has been improved. Airbnb stated that the access files it provides to data subjects comply with Article 12(1) of the GDPR as the personal data is set out in clearly described tabs corresponding with the categories of personal data included. Airbnb stated there is an explanatory tab titled "Read me" which explains the nature, form and contents of the file to data subjects, therefore constituting a roadmap for review. Airbnb advised it has also published an article on its Help Centre which explains the structure and contents of these access files. Airbnb stated it was looking at ways to enhance its access files with a view to rendering them more readily accessible and understandable from a data subject perspective.
34. As regards Airbnb's handling of the erasure request, the DPC asked why Airbnb had not responded to the Complainant's erasure requests of 2015. In response, Airbnb referred to its response of 27 May 2020 and advised that the two erasure requests appeared to have routed to its spam inbox due to a technical issue associated with the body of the emails containing no text, which in turn generated emails to the Complainant notifying him that the emails [erasure requests] had not been sent properly.
35. Airbnb confirmed to the DPC, in response to the DPC query as regards the date it received the Complainant's erasure request and the further query as to any action taken on the erasure request, that it acknowledged the erasure request on 17 July 2018. It then began a process of authenticating and processing the erasure request.
36. In response to the DPC query as to when Airbnb completed the erasure request and then erased the data, Airbnb informed the DPC that due to the deletion of the account that is subject to this Inquiry, it is unable to confirm precisely when the account was deleted. However, according to
8
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
Airbnb the deletion would have been completed shortly after the commencement of the deletion process.
37. In response to the DPC query as regards a delay in informing the Complainant on action taken on the erasure request, Airbnb reiterated that it acknowledged the Complainant's access and deletion requests on 17 July 2018, and commenced the process of deletion on 29 August 2018, within a calendar month of the request being authenticated on 31 July 2018.
38. The DPC posed a query as regards whether Airbnb had a lawful basis for requesting a copy of the Complainant's ID, and upon the Complainant's refusal to provide same, whether Airbnb had a lawful basis to thereafter request a telephone call with the Complainant in circumstances where he had submitted a request for access and erasure pursuant to Articles 15 and 17 GDPR. In response to this query, Airbnb clarified its understanding as regards data subjects' rights requests, as informed by data protection regulatory guidance, such as the right of access and right of erasure are not effective until the identity of the data subject has been determined. Airbnb quoted an extract of the DPC's own guidance document on data subject access requests. Airbnb clarified that its understanding is that an obligation to provide information on action taken on an access request and a deletion request is triggered only when the requests are in effect which, as guidance such as that published by the DPC has clarified, is when the identity of the data subject has been verified.
39. In response to the query regarding the legal bases relied upon for requesting a copy of the Complainant's ID on receipt of his erasure request and upon the Complainant's refusal to provide ID, requesting a telephone call with the Complainant, Airbnb stated that it relied on a variety of legitimate interests, including its legitimate interests in verifying the authenticity of the requests and the legitimate interests of the account holder in ensuring their personal data was not disclosed or deleted in illegitimate or otherwise inappropriate circumstances, in accordance with Article 6(1)(f) of the GDPR.
40. As regards why Airbnb considered it necessary and proportionate to request a copy of a user's ID to verify their identity where they have submitted a request for access or erasure, especially in circumstances where the user had not previously provided their ID to Airbnb before and Airbnb have nothing to verify it against, Airbnb informed the DPC that in 2018 ID verification represented the preferred method of authentication for access and deletion requests, given the probative value of ID verification and the safety and security issues relating to the nature of the Airbnb platform, including the need to preserve accounts that may be necessary for travel abroad or which may be an important element of an individual's livelihood and to avoid disclosing such information to the wrong person. Airbnb stated that the corroborative value of requesting ID was not dependent or predicated on there being a pre-existing ID on a user's account, and instead formed part of a holistic approach to identity verification, carried out with reference to the totality of information available to Airbnb. Airbnb advised that given it was and is necessary for it to design, implement and maintain robust safety and security measures, Airbnb believes that ID verification formed part of a necessary and proportionate suite of measures, which included
9
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
alternative verification measures where appropriate, designed to protect the Airbnb platform and community and all those associated with it. However, Airbnb clarified it no longer uses identity documents to authenticate access and deletion requests.
41. As regards why Airbnb considered it necessary and proportionate to request a phone call to verify the Complainant's identity, Airbnb informed the DPC that it was necessary and proportionate to request a phone call to verify the Complainant's identity in circumstances where Airbnb needed to exercise care and diligence and verify the identity of the requester, and where a phone call was a convenient alternative verification method that the Complainant was amenable to. Airbnb informed the DPC that this was a precautionary step to supplement the engagement with the Complainant by email, to ensure that the individual communicating by email was the account holder in question.
42. With regard to reasonable doubts pursuant to Article 12(6) GDPR that Airbnb had, if any, concerning the Complainant's identity such that Airbnb considered it necessary to first request a copy of the Complainant's ID and subsequently to request a telephone call, Airbnb informed the DPC that in circumstances where the underlying account has been deleted, it could not comment on any reasonable doubts in existence at the time in question.
43. As regards compliance with the requirements of Article 12(3) in relation to the processing of access and erasure requests, Airbnb reiterated that on 6 July 2018 the Complainant submitted his access and deletion requests and Airbnb responded on 17 July 2018, commencing a process of authenticating and processing the requests.
44. As regards other methods of identity verification, and why other methods are not offered to a user to verify their identity in the first instance, Airbnb reiterated that in 2018 ID verification represented the preferred method of authentication, given the probative value of ID verification and the safety and security issues relating to the nature of the Airbnb platform, but alternative methods were facilitated where possible and appropriate, as was the case with the Complainant.
45. In response to the DPC's request to provide a record of the identity verification telephone call of 31 July 2018 including time and date, Airbnb stated that given the account has been deleted, it does not have a record of this call beyond the timestamped material in the Complaint documentation provided by the DPC, which provides evidence that the call took place.
# Notification of the Preliminary Draft Decision to the Data Controller
46. The DPC provided a copy of the Preliminary Draft Decision to Airbnb on 22 March 2023 and requested Airbnb to provide submissions in relation to the content by close of business on 12 April 2023.
47. Airbnb provided its submissions to the DPC on 12 April 2023. Airbnb responded to the DPC's preliminary finding that the practice of requesting ID for authentication purposes constitutes
10
An Coimisiún um Chosaint Sonraí
Data Protection Commission
"collection" within the meaning of "processing" as so defined in Article 4(2) of the GDPR. Airbnb made reference to the European Data Protection Board ("EDPB") guidelines on the concepts of controller and processor² (the "Guidelines"), in which the EDPB emphasises the following aspect of the definition of "processing": "any operation or set of operations which is performed on personal data or on sets of personal data".³ Airbnb stated that in the earlier version of the Guidelines⁴, the EDPB included the following description of "processing":
"[i]n Article 4(2) processing is defined as a concept including a wide array of operations ranging from collection, storage and consultation to use, dissemination or otherwise making available and destruction. In practice, this means that all imaginable handling of personal data constitutes processing"⁵
Airbnb stated that this demonstrates that Article 4(2) requires that the operation or set of operations be "performed on" personal data and, in the earlier version of the Guidelines, the EDPB outlined the need for this to involve actual "handling" of personal data.
48. Furthermore, Airbnb stated that the Spanish supervisory authority, La Agencia Española de Protección de Datos ("AEPD"), has published guidelines for data protection by default⁶, in which the AEPD considers the examples of activities which fall within the concept of "processing" under Article 4(2) of the GDPR⁷. Airbnb stated that the AEPD provided the example of the receipt of a CV constituting "collection" and therefore processing, of personal data while the publication of a vacancy for a relevant job does not constitute processing. Airbnb asserted that, for the purposes of the Preliminary Draft Decision, the publication of a [job] vacancy can be viewed as analogous to a request for personal data, such as an ID, and that the receipt of the CV can be treated as analogous to the receipt of the ID, with the effect that, in the present case, the processing cannot have taken place in circumstances where no ID was received by Airbnb.
49. In addition, Airbnb referred to the EDPB Twitter decision⁸, in which the EDPB traced the DPC's rationale for not reprimanding Twitter for certain ancillary activities relating to a data breach, which according to Airbnb are relevant for present purposes. Airbnb cited the following extract from paragraph 139 of the EDPB Twitter decision for illustrative purposes:
"In its Draft Decision, the [DPC] explained its decision to not issue a reprimand by recalling the argument put forward by TIC in its submissions in relation to the Preliminary Draft Decision,
² Guidelines 07/2020 on the concepts of controller and processor in the GDPR (Version 2.1), adopted on 7 July 2021.
³ See paragraph 42 of the Guidelines
⁴ Guidelines 07/2020 on the concepts of controller and processor in the GDPR (Version 1.0), adopted on 2 September 2020 (the "Original Guidelines").
⁵ See paragraph 77 of the Original Guidelines
⁶ https://www.aepd.es/sites/default/files/2020-10/guia-proteccion-datos-por-defecto-en.pdf
⁷ Page 10 of the AEPD Guidelines.
⁸ Decision 01/2020 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding Twitter International Company under Article 65(1)(a) GDPR, Adopted on 09 November 2020
11
An Coimisiún um Chosaint Sonraí
Data Protection Commission
contending that the infringements of Article 33(1) and Article 33(5) GDPR do not compromise "processing operations", while Article 58(2)(b) GDPR provides supervisory authorities with the power to issue reprimands where processing operations have infringed provisions of the GDPR. The [DPC] considered that the term 'processing operation(s)' appears 50 times in the GDPR and seems to be used to denote the treatment or use of, in other words things that are done to, personal data by a controller, but that at the same time the definition of "processing" provided by the GDPR is very broad, which makes it arguable that given that a breach is something affecting or done to, personal data, it follows that the notification obligation (insofar as it inherently must entail an examination of what has happened to personal data or how it has been affected) is intrinsically connected or one or more processing operations. The [DPC] did not consider it necessary to definitely conclude on the meaning on the meaning and effect of the term "processing operations" in the Draft Decision, but "on balance" considered that TIC's legal argument was "a stateable one", deciding not to proceed with the issuing of a reprimand to TIC" (emphasis added).
50. Airbnb stated that the basis for the DPC's conclusion that a request for ID constituted "processing" within the meaning of Article 4(2) of the GDPR is therefore unclear to Airbnb and this conclusion does not appear to align with the common understanding of the concept of "processing". Airbnb stated that in the present case, although ID was requested from the Complainant, it was ultimately never provided, with the effect that the impugned processing never in fact occurred.
51. Airbnb stated that in light of its point above, it respectfully submits that the request for ID from the Complainant in order to authenticate his data subject rights requests cannot reasonably be considered to constitute "processing" within the meaning of Article 4(2) of the GDPR and, therefore, that the related findings of infringement cannot be maintained.
52. Airbnb also noted an erroneous reference by the DPC to the date of 30 August 2018 at paragraph 82 (previously 70) as the date that Airbnb authenticated the Complainant's requests. Airbnb noted the Complainant's requests were authenticated on 31 July 2018. The DPC has amended this paragraph to reflect the correct date in this decision.
53. The DPC has carefully considered Airbnb's submissions in making this decision.
# Notification of the Preliminary Draft Decision to the Complainant
54. The DPC provided the Complainant with a copy of the Preliminary Draft Decision, via the Berlin SA, on 13 April 2023. In its letter, the DPC requested that the Complainant provide their submissions in relation to the Preliminary Draft Decision within 2 weeks of the date of receipt of the letter following its provision by the Berlin SA.
55. The Berlin SA responded on 14 June 2023 informing the DPC that the Complainant had not responded to the Preliminary Draft Decision.
12
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# Relevant and Reasoned Objections and Comments from "supervisory authorities concerned"
56. Having transmitted the draft decision on 16 June 2023 to the "supervisory authorities concerned" in accordance with Article 60(3) of the GDPR, the DPC did not subsequently receive any relevant or reasoned objections under Article 60(4). An opinion, which was not expressed as a formal objection, in relation to the draft decision was received from the Comissão Nacional de Proteção de Dados (CNPD).
57. The DPC gave careful consideration to the opinion received from the CNPD. However the DPC did not consider that it was necessary to revise the draft decision in light of that opinion.
# Applicable Law
58. For the purposes of its examination and assessment of this Complaint, the DPC has considered the following Articles of the GDPR:
Article 5
Article 6
Article 12
Article 15
Article 17
# Findings of Inquiry
59. The DPC notes that two erasure requests were submitted by the Complainant to Airbnb in 2015 - on 18 September 2015 and 12 October 2015. However, for the following reasons the DPC is not considering those matters any further in this decision: (i) the two erasure requests appear to have been routed to Airbnb's spam inbox due to a technical issue associated with the fact that the body of the emails sent by the Complainant to Airbnb allegedly contained no text, (which in turn allegedly generated emails to the Complainant notifying him that the emails [erasure requests] had not been sent properly); and (ii) those erasure requests (insofar as they could be considered to be valid erasure requests in the alleged absence of text in the body of the emails concerned) were submitted to Airbnb over two years prior to the application of the GDPR and therefore these matters fall outside the scope of the cooperation and consistency mechanism.
Issue 1: An examination of whether Airbnb's provision of the personal data and information concerning the processing of that personal data in response to the Complainant's access request was compliant with the GDPR and the Act.
60. In accordance with Article 15 GDPR, a data subject has the right to obtain from the data controller a copy of the personal data undergoing processing, and certain additional information concerning
13
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
the processing and the data subject's rights as prescribed by Articles 15(1)(a) to (h) of the GDPR. The scope of the personal data to be provided under Article 15(1) GDPR comprises full and complete information on all data relating to the data subject undergoing processing in order for the data subject to be aware of, and to verify the lawfulness of the processing.
61. The Complainant, as part of the Complaint submitted on 1 January 2019, highlighted his concerns regarding the personal data provided to him by Airbnb. The Complainant noted that upon registration of an account with Airbnb in the summer of 2015, he provided his name, date of birth, telephone and credit card number. According to the Complainant, Airbnb failed to properly comply with his access request in failing to provide a copy of full and complete information.
62. The Complainant submitted an access request for a copy of his personal data to Airbnb on 6 July 2018 via email, where he requested full access to his information and outlined the data he was particularly interested in. Airbnb responded to the Complainant via email on 17 July 2018 requesting for the Complainant to provide a copy of his ID. The Complainant refused this request on 18 July 2018. The DPC notes that upon the Complainant's refusal to provide a copy of his ID, Airbnb offered an alternative method of authenticating his requests through the completion of a telephone call. On 31 July 2018, Airbnb authenticated the Complainant's requests via telephone call. Airbnb provided the Complainant with access to some of his personal data via email on 30 August 2018. The Complainant noted in his Complaint that he was not provided with access to credit card personal data or data as regards devices used to log in to his Airbnb account. The Complainant also noted that Airbnb failed to provide information on the processing of his personal data including the sources from where his data had been gathered, the legal basis of the processing, or the third parties with whom his data had been shared.
63. In response to queries raised by the DPC on 23 January 2023, Airbnb advised the DPC that the individuals dealing with this access request had misunderstood or failed to appreciate the scope of the personal data to be provided to the Complainant. Airbnb advised the DPC that when it received the complaint from the DPC, due to the DPC's formulation of the Complainant's request [in the DPC letter of 13 May 2020], it responded to the access request as per the DPC's formulation of the request. The DPC, in the letter of 13 May 2020, had formulated the Complaint as follows:
"The Data Subject believes that Airbnb's response to his access request was unsatisfactory for several reasons: Airbnb's response was in English and contained abbreviations that the Data Subject did not understand; the Data Subject considers that Airbnb's response was incomplete as it did not include his credit card information which he provided while setting up his account or information about the devices used to sign into his account; Airbnb's response also did not contain any information regarding where his data had been gathered from, the purposes of the processing, and with whom his data had been shared. The Data Subject wishes for Airbnb to comply with his access and erasure requests in that order."9
9 DPC letter 13 May 2020
14
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
The DPC then outlined the next steps in order to progress the complaint and requested Airbnb to take the following steps:
1. "Write to the Data Subject by 27 May 2020, responding to the substance of their access request in accordance with the provisions of Article 15 of the GDPR. In so doing, Airbnb should:
a) Provide access to the personal data that it holds, process or controls in relation to the Data Subject to the extent that such personal data falls within the scope of their access request and set out explicitly how the completed access request complies with Article 15 of the GDPR; OR
b) Notify the Data Subject in writing of the refusal of their access request (whether in whole or in part), setting out a statement of the reasons for that refusal and outlining the basis for any statutory restrictions relied upon.
2. Confirm to the DPC that the above action has been taken by Airbnb. If Airbnb has previously completed the access request in a manner it considers consistent with Article 15 GDPR, please provide evidence to the DPC.
3. Provide an explanation for why Airbnb did not action the Data Subject's erasure requests in 2015. Write to the Data Subject by 27 May 2020, responding to the substance of their erasure request in accordance with the provisions of Article 17 of the GDPR."10
Airbnb stated that it responded to those queries [outlined in the DPC's formulation of the Complainant's request] on 27 May 2020.
64. The DPC notes that Airbnb responded originally to the access request providing a limited set of personal data to the Complainant. The DPC further notes that Airbnb has advised that any data not provided to the Complainant would have been due to the fact that the data had not been registered to the Complainant's account, that Airbnb did not at the time include certain data in the formulation of its access file production, or that certain sensitive/confidential data would not have been provided as per Article 15(4) of the GDPR. However, the DPC notes that certain information was erroneously withheld from the Complainant (such as the sources from where his data had been gathered or the legal basis of the processing) and it was only arising from intervention by the DPC that Airbnb then provided the Complainant with the additional information.
65. On the basis of the above, the DPC finds that Airbnb infringed Article 15(1) of the GDPR at the time of first processing the Complainant's access request by not providing him with access to
10 DPC letter 13 May 2020
15
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
all of his personal data that was being processed by Airbnb on the date of receipt of his access request.
Issue 2: An examination of whether Airbnb's handling of the Complainant's access request was compliant with the GDPR and the Act insofar as the information provided to the Complainant was in a concise, transparent, intelligible and easily accessible form using clear and plain language.
66. Article 12(1) of the GDPR states that "The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form using clear and plain language".
67. According to the Complainant, in his Complaint submitted to the Berlin SA, some of the information provided to him from Airbnb was in English, with incomprehensible column headings, some of which were abbreviated and the data was unsorted. Airbnb explained that the provision of the cover email in English accompanying the access file was due to an automated process. However, if a data subject requested a translation into another language, such as German, Airbnb could facilitate this. As regards the form and layout of the access file containing the data, Airbnb explained this was due to an early procedure of access file production and that Airbnb has worked to refine the clarity and navigability of its access files.
68. During the course of the Inquiry, Airbnb explained that if a user submits an access request through the privacy portal the automated process produces a cover email in the user's identified language. Airbnb further stated it would be looking to make improvements to its processes in this area.
69. Regarding the form and layout of the access file, during the course of the Inquiry Airbnb explained that the form of the access files it provides to data subjects complies with Article 12(1) GDPR. Airbnb explained that it sets out the personal data in clearly described tabs corresponding with the categories of personal data included, in addition to an explanatory tab titled "Read me" which explains the nature, form and contents of the file to data subjects, constituting a roadmap for review. Airbnb advised the DPC that a help centre article had been published which explains the structure and contents of its access files.
70. The DPC notes that the Complainant submitted his access and erasure requests by email (i.e. outside of the privacy portal) using the German language. However, the DPC does not accept that the Complainant should have to specify to Airbnb the language in which he wanted to be responded to. Once the data protection rights requests were made by the Complainant in the German language, it follows that any communications that followed from Airbnb to the Complainant regarding those requests should have been issued to him by Airbnb in the German language. Airbnb had previously communicated with the Complainant in German prior to the provision of his access file.
16
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
71. Following the intervention of the DPC on 2 November 2020, through forwarding the Complainant's comments to Airbnb's responses of 27 May 2020, Airbnb only then provided a German translation copy of its responses of 27 May 2020 to the Complainant on 9 December 2020.
72. On the basis of the above, the DPC finds that Airbnb infringed Article 12(1) of the GDPR at the time of first processing the Complainant's access request by failing to provide the Complainant with an access file that was of a concise, transparent, intelligible and easily accessible form. The cover email was provided in English rather than in German, and the data provided to the Complainant was not of a transparent nature, due to the abbreviation of some column headings and unsorted data.
Issue 3: An examination of whether Airbnb's handling of the Complainant's erasure request was compliant with the GDPR and the Act.
73. Further to his Complaint regarding Airbnb's handling of his access request, the Complainant also in his Complaint outlined his dissatisfaction with Airbnb's handling of his erasure request.
74. According to Article 17 GDPR, "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay".
75. The DPC notes that the Complainant submitted a valid request for erasure, pursuant to Article 17 of the GDPR, to Airbnb on 6 July 2018. The Complainant noted that, following the reactivation of his Airbnb account on 9 June 2018, he requested on 6 July 2018 that his Airbnb account be deleted. On 17 July 2018, Airbnb acknowledged the Complainant's erasure request and requested the Complainant to submit a copy of his ID so as to commence a process of authenticating and processing the requests, which the Complainant refused on 18 July 2018. Airbnb suggested thereafter that it conduct a telephone call to which the Complainant agreed and the telephone call took place on 31 July 2018. Following this, Airbnb proceeded with the erasure request, and commenced the erasure process on 29 August 2018.
76. However, a period of over twenty-two months elapsed between the date of lodging of the erasure request (6 July 2018) and the date on which Airbnb provided information to the Complainant on action taken in relation to it (27 May 2020). That delay is examined further below in the context of Article 12(3) of the GDPR.
Issue 4 (a): Whether Airbnb's obligation to provide information on action taken in response to the access and erasure requests without undue delay pursuant to Article 12(3) GDPR was suspended until after the verification of the Complainant's identity by phone call on 31 July 2018.
17
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
77. Article 12(3) GDPR stipulates "The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject."
78. The DPC notes that the Complainant submitted both his access and erasure requests on 6 July 2018. Airbnb stated that it "acknowledged the Complainant's access and deletion requests on 17 July 2018 and then began a process of authenticating and processing the requests." In the first instance Airbnb sought a copy of ID from the Complainant on 17 July 2018 and this request was rejected by the Complainant on 18 July 2018. As an alternative means of verifying the authenticity of the requests, Airbnb offered to conduct a telephone call to which the Complainant agreed on 23 July 2018. Airbnb conducted a telephone call with the Complainant on 31 July 2018 and, at that point, it was satisfied with the authenticity of the requests.
79. Airbnb stated it commenced the erasure process on 29 August 2018 and provided a copy of the access file on 30 August 2018, one month after the telephone call had taken place.
80. On 27 May 2020, following the DPC's intervention, Airbnb wrote to the Complainant and informed him that the process of erasure had commenced on 29 August 2018.
81. The timeline of events, therefore was as follows:
6 July 2018: Access and Erasure Requests submitted by the Complainant
17 July 2018: Acknowledgement sent by Airbnb and request for copy of ID
18 July 2018: Complainant rejected request to provide a copy of ID
19 July 2018: Airbnb proposed telephone call as alternative to providing ID
23 July 2018: Complainant agreed to telephone call
31 July 2018: Telephone call took place between Airbnb and Complainant
29 Aug 2018: Airbnb commenced erasure process
30 Aug 2018: Access file supplied to Complainant by Airbnb
27 May 2020: Airbnb informed Complainant that erasure had commenced in August 2018.
82. From the above timeline of events, firstly it is clear that the Complainant was not informed by Airbnb until 27 May 2020, following the intervention of the DPC in the handling of the Complaint, of the action taken by Airbnb in relation to his erasure request of 6 July 2018. A period of over twenty-two months had elapsed between the date of lodging of the erasure request and the date on which Airbnb provided information to the Complainant on action taken in relation to it. Secondly, with regard to the access request, some time was lost as the above timeline shows
18
An Coimisiún um Chosaint Sonraí
Data Protection Commission
between 6 July 2018 when the access request was lodged and 30 August 2018 when the access file was supplied to the Complainant by Airbnb. For example, the telephone call which verified the authenticity of the requests did not take place until 31 July 2018 – twenty-five days after the request was lodged. This delay in verifying the authenticity of the requests was contributed to in the main by Airbnb which in the first instance took ten days to acknowledge the requests and then contributed to a further delay by seeking a copy of ID to verify identity rather than requesting a telephone call to authenticate the access and erasure requests. The EDPB adopted guidelines on 18 January 2022 on data subject rights.¹¹ At section 5.3 it gives guidance on the timing for the provision of access. In that regard, it states at para. 157¹² the following: “The time limit starts when the controller has received an Art. 15 request, meaning when the request reaches the controller through one of its official channels. It is not necessary that the controller in fact has taken notice of it. However, when the controller needs to communicate with the data subject due to the uncertainty regarding the identity of the person making the request there may be a suspension in time until the controller has obtained the information needed from the data subject, provided the controller has asked for additional information without undue delay... Example: Following the reception of the request, a controller reacts immediately and asks [for] the information it needs to confirm the identity of the person making the request. The latter replies only several days later and the information that the data subject sends to verify the identity does not seem sufficient which requires the controller to ask for clarifications. In this situation there will be a suspension in time until the controller has obtained enough information to verify the identity of the data subject.” [Underline emphasis added].
83. In the present case, given that Airbnb took no action for the first ten days after receipt of the requests and where it then began an unnecessary pursuit of obtaining a copy of ID from the Complainant which contributed to a further delay in actioning the requests, the DPC finds that Airbnb failed to comply in this case with the requirements of Article 12(3) of the GDPR.
84. On the basis of the above, the DPC considers that Airbnb failed to provide information to the Complainant on the actions taken on his access and erasure requests within one month of receipt of the requests and therefore failed in its obligations under Article 12(3) GDPR.
Issue 4 (a): Whether Airbnb had a lawful basis for requesting a copy of the Complainant’s ID, and upon the Complainant’s refusal to provide same, whether Airbnb had a lawful basis to thereafter request a telephone call in order to verify the Complainant’s identity in circumstances where he had submitted requests for access and erasure pursuant to Articles 15 and 17 GDPR.
85. Article 5(1)(a) GDPR states that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject.”
¹¹ Guidelines 01/2022 on data subject rights – Right of access
¹² This is now paragraph 159 in the revised Guidelines 01/2022 on data subject rights – Right of access adopted on 28 March 2023.
19
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
86. Airbnb advised that its identity verification policies and procedures are in place to protect the Airbnb platform and its users, in accordance with its obligations under the GDPR in a manner that facilitates and safeguards the rights of data subjects under the GDPR.
87. Airbnb advised the DPC that at the time the Complainant submitted his access and erasure requests in 2018, shortly after the introduction of the GDPR, ID verification was the preferred method of authenticating access and deletion requests, given the probative value of ID verification and the safety and security issues associated with the nature of the Airbnb platform. The DPC notes that the Complainant had logged into his Airbnb account on 9 June 2018, utilising the password-forgotten function and discovered it was still active, prior to the submission of his erasure request of 6 July 2018.
88. Article 4(2) of the GDPR defines "processing" as "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction."
89. Article 5(1)(c) of the GDPR states that "Personal data shall be adequate, relevant and limited to what is necessary in relation to the specific purposes for which they are processed."
90. Article 6(1)(f) of the GDPR states that the processing of personal data shall only be lawful if and to the extent "the processing is necessary for the purposes of legitimate interest pursued by the controller or by a third party, except where such interests are overridden by the interests of fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."
91. Article 12(6) of the GDPR states that "Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject."
92. As per Article 12(6), Airbnb may request the provision of additional information necessary to confirm the identity of the data subject should it have any reasonable doubts concerning the person's identity.
93. The DPC notes that Airbnb has claimed legitimate interests pursued by the controller as the lawful basis for requesting a copy of ID in order to verify the authenticity of the request and verify the account holder to ensure that their personal data was not disclosed or deleted in illegitimate or otherwise inappropriate circumstances, in accordance with Article 6(1)(f) of the GDPR. While the DPC considers that a legitimate interest does exist in Airbnb ensuring it does not disclose or delete personal data in an illegitimate or inappropriate circumstance, in the instance of this case Airbnb
20
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
has not demonstrated to this inquiry that the request for a copy of the Complainant's ID was either necessary or proportionate for the completion of the access and erasure requests as Airbnb was able to verify the Complainant's identity through other means. The DPC is of the view that other methods were available to Airbnb at the time that would have negated the need for Airbnb to request a copy of ID. Airbnb has failed to provide evidence in this Inquiry to demonstrate that Airbnb first attempted to utilise other tools it already possessed, such as the completion of a telephone call.
94. The DPC notes that Airbnb was subsequently able to authenticate the Complainant's rights requests through the completion of a telephone call between the Complainant and Airbnb. Airbnb has advised the DPC that the telephone call was a convenient alternative verification method that the Complainant was amenable to.
95. The DPC considers the request to provide a copy of his ID in order to verify his identity so as the Complainant could exercise his rights pursuant to Articles 15 and 17 of the GDPR constituted the collection of personal data. This was data processing as per Article 4(2) of the GDPR. In this case, the DPC does not consider that the legitimate interest pursued by the controller constitutes a valid lawful basis under Article 6 for that specific data processing activity.
96. The DPC notes that Airbnb has advised it is not in a position to comment on any reasonable doubts in existence at the time in question in circumstances where the underlying account has been deleted. The DPC considers that Airbnb has not sufficiently demonstrated to this Inquiry that it had reasonable doubts in this case as to the Complainant's identity such as would have justified it requesting to provide additional information to confirm identity through the provision of a copy of the Complainant's ID. Further, the DPC does not consider that the request for ID was either necessary or proportionate in circumstances where there were less data-driven options available to Airbnb to confirm the Complainant's identity. As such, Airbnb has not demonstrated that it had reasonable doubts as to the Complainant's identity in accordance with Article 12(6).
97. The DPC finds that Airbnb's request that the Complainant verify his identity by way of submission of a copy of his ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR. This infringement occurred in circumstances where less data-driven solutions to the question of identity verification were available to Airbnb.
98. The DPC finds that Airbnb has not demonstrated that reasonable doubts existed concerning the Complainant's identity that would have necessitated the application of Article 12(6) of the GDPR.
99. The DPC finds that, in the specific circumstances of this Complaint, the legitimate interest pursued by Airbnb did not constitute a valid, lawful basis under Article 6(1)(f) of the GDPR for seeking a copy of the Complainant's ID in order to process his access and erasure requests.
21
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
100. With regard to the telephone call made by Airbnb to the Complainant on 31 July 2018 (to which the Complainant was amenable) Airbnb informed the DPC that it relied on Article 6(1)(f) as the lawful basis for a variety of legitimate interests including its legitimate interest in verifying the authenticity of the requests and the legitimate interests of the account holder in ensuring that their personal data was not disclosed or deleted in illegitimate or otherwise inappropriate circumstances. It stated that this was a precautionary step to supplement the engagement with the Complainant by email to ensure that the individual communicating by email was the account holder in question.
101. The DPC considers that the telephone call to the Complainant was a proportionate and appropriate form of contact in this case to verify the authenticity of the access and erasure requests. In particular, where an erasure request sought the deletion of an individual's Airbnb account, Airbnb had strong legitimate interests and good reason to exercise caution in verifying the authenticity of the request prior to commencing the deletion process through contacting the requester by an alternative method to that used to submit the request. Accordingly, the DPC is of the view that Airbnb could rely on Article 6(1)(f) as the lawful basis for contacting the Complainant by telephone after receiving his access and erasure requests in order to verify the authenticity of those requests.
# Decision on infringements of the GDPR
102. Following the investigation of the Complaint against Airbnb Ireland UC, the DPC is of the opinion that Airbnb Ireland UC infringed the General Data Protection Regulation as follows:
- Article 5(1)(c) of the GDPR
The DPC finds that Airbnb's request that the Complainant verify his identity by way of submission of a copy of his ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR. This infringement occurred in circumstances where less data-driven solutions to the question of identity verification were available to Airbnb.
- Article 6(1)(f) of the GDPR
The DPC finds that, in the specific circumstances of this Complaint, the legitimate interest pursued by Airbnb did not constitute a valid lawful basis under Article 6(1)(f) of the GDPR for seeking a copy of the Complainant's ID in order to process his access and erasure requests.
- Article 15(1) of the GDPR
The DPC finds that Airbnb infringed Article 15(1) of the GDPR at the time of first processing the Complainant's access request by not providing him with access to all of his personal data that was being processed by Airbnb on the date of receipt of his access request.
22
An Coimisiún um Chosaint Sonraí
Data Protection Commission
- Article 12(1) of the GDPR
The DPC finds that Airbnb infringed Article 12(1) of the GDPR at the time of first processing the Complainant's access request by failing to provide the Complainant with an access file that was of a concise, transparent, intelligent and easily accessible form.
- Article 12(3) of the GDPR
The DPC finds that Airbnb failed to provide information to the Complainant on the actions taken on his access and erasure requests within one month of receipt of the requests and therefore failed in its obligations under Article 12(3) of the GDPR.
# Remedial measures undertaken by Airbnb Ireland UC
103. In respect of the Complainant's request for access to his personal data submitted on 6 July 2018 pursuant to Article 15 of the GDPR, it is noted that Airbnb eventually provided the Complainant with access to his personal data, and any explanations for data not provided to the Complainant, on 27 May 2020.
104. In respect of the Complainant's access request and the failure of Airbnb to provide the Complainant with his access file and cover email in German, the DPC notes the Complainant was provided with a German translation copy of Airbnb's responses on 9 December 2020 following the DPC's intervention in the matter.
105. With regard the Airbnb seeking a copy of ID to verify access or erasure requests, Airbnb confirmed to the DPC that it no longer uses this method to authenticate requests.
# Judicial remedies with respect to the decision of the DPC
106. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of notification such decision. An appeal may also be taken within 28 days of notification by a data controller: under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under Section 142, against any imposition upon it of an administrative fine by the DPC.
# Exercise of Corrective Power by the DPC
107. In deciding on the corrective powers that are to be exercised in respect of the infringements of the GDPR outlined above, I have had due regard to the Commission's power to impose administrative fines pursuant to Section 141 of the 2018 Act. In particular, I have considered the
23
An Coimisiún um Chosaint Sonraí
Data Protection Commission
criteria set out in Article 83(2)(a) – (k) of the GDPR. When imposing corrective powers, I am obliged to select the measures that are effective, proportionate and dissuasive in response to the particular infringements. The assessment of what is effective, proportionate and dissuasive must be made in the context of the objective pursued by the corrective measures, for example re-establishing compliance with the GDPR or punishing unlawful behaviour (or both)¹³. I find that an administrative fine would not be necessary, proportionate or dissuasive in the particular circumstances in relation to the infringements of the Articles of the GPDR as set out above. For the reasons outlined, I find that no administrative fine should be imposed in respect of these infringements.
108. In light of the infringement of Article 12(1) in the case of this data subject, I find it necessary that the controller bring its data processing into compliance to prevent similar infringements occurring with regard to data subjects in the future in similar circumstances. Accordingly, the DPC hereby orders Airbnb to revise its internal policies and procedures as regards the default position to provide a cover email in English when a data protection rights request is received outside the privacy portal so that data subjects do not have to provide a separate request to receive communications from Airbnb in their preferred language. Airbnb is requested to provide details of its revised internal policies and procedures to the DPC by 20 September, 2023.
109. In light of the extent of the infringements identified above, the DPC hereby issues a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the GDPR.
Signed:
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
¹³ See the Article 29 Data Protection Working Party 'Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679', at page 11.
24