Rezervasyonda Fotoğraflı Kimlik Doğrulaması

An Coimisi¢n um
Chosaint Sonrai
Data Protection
Commission

Date: 28 September 2023

Complainant

Data Controller: Airbnb Ireland UC

RE: [vs Aironb Ireland UC

This document is a Decision of the Data Protection Commission of Ireland (“DPC”) in
relation to DPC complaint reference, EEE (the “Complaint’), which was lodged
with the Federal Commissioner for Data Protection and Freedom of Information (“BfDI’,
“Federal DPA’), by {EE (Complainant’) against Airbnb Ireland UC (“Airbnb”),
and which was transferred to the Berlin Commissioner for Data Protection and Freedom
of Information (“Berlin DPA”) and thereafter transferred to the DPC to be handled in its
role as lead supervisory authority.

This Decision is made pursuant to the powers conferred on the DPC by section
113(2)(a) of the Data Protection Act 2018 ("the Act”) and Article 60 of the General Data
Protection Regulation (“GDPR’).

Communication of Draft Decision to “supervisory authorities concerned” (

In accordance with Article 60(3) of the GDPR, the DPC is obliged to communicate the
relevant information and submit a Draft Decision, in relation to a complaint regarding
cross border processing, to the supervisory authorities concerned for their opinion and
to take due account of their views.

In accordance with its obligation, the DPC transmitted a Draft Decision in relation to the
matter to the “supervisory authorities concerned”. As Airbnb offers services across the
EU, and therefore the processing is likely to substantially affect data subjects in every
EU member state, the DPC in its role as lead supervisory authority identified that each
supervisory authority is a supervisory authority concerned as defined in Article 4(22) of
the GDPR. On this basis, the Draft Decision of the DPC in relation to this complaint was
transmitted to each supervisory authority in the EU and EEA for their opinion.

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

Complaint Handling by the DPC — Timeline and Summa

1. The complaint was lodged with the Berlin DPA and was thereafter transferred
to the DPC. Initial correspondence was received by the DPC on 3 September
2019, to be handled by it in its role as lead supervisory authority. The
Complainant submitted that when he had tried to make a booking for a property
on the Airbnb platform, his booking was not accepted until he had verified his
identity by providing a copy of his ID and taking a picture with his webcam. The
Complainant stated that he had booked the same property on the Airbnb
platform earlier in the year and no such identity verifying conditions attached
to that booking. The Complainant stated that he provided a copy of his ID and
took a photograph with his webcam on four separate occasions following
further requests by Airbnb, but when he did not provide the data in response
to Airbnb’s fifth and sixth request, Airbnb cancelled his booking. The
Complainant advised that his booking was then fulfilled when the owner ofthe
property reactivated his booking, without the need to provide the data
previously sought by Airobnb. The Complainant stated that he did not consider
Airbnb’s request to be legal. The Complainant provided the DPC with copies
of the correspondence exchanged with Airbnb. This included emails sent to
him by Airbnb on 20 and 21 June 2019 which stated “On the photo you added,
your ID is hard to see. In order for us to ensure that it is really you, we need a
photo that clearly shows all the information on your badge. This way we can
confirm the validity.” and “In order for us to confirm your profile and for you to
receive a new accommodation, please send us a well recognizable photo of
your official ID.”

2 The DPC notified Airbnb of the complaint by way of email and letter dated 29
April 2020 and provided Airbnb with a copy of the Complainant's
correspondence.

3 Airbnb reverted to the DPC by email dated 14 May 2020. Airbnb stated that on
20 June 2019, the Complainant attempted to book a listing in Vienna and was
asked to provide a copy of his ID to verify his identity, in accordance with
Airbnb’s user identity verification procedures. Airbnb stated that, in this case,
identity verification was triggered by the host's requirement that prospective
guests have verified their identity with Airbnb before they can book the listing
in question. Airbnb advised that the copy of ID provided by the Complainant
was blurry and therefore he was asked to send a clearer photo so that the

1 verification procedure could be completed. Airbnb advised that it made this
request a number of times and requested that the Complainant provide a better

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

quality photo by 21 June 2019 in order to proceed with the booking. It stated
that the Complainant was directed to Airbnb’s online Help Centre article in
relation to ID verification. Airbnb stated that the Complainant failed to provide
a better quality photo of his ID and the booking process was discontinued.
Airbnb advised that, on 21 June 2019, the Complainant successfully booked
the same listing using another Airbnb account, which Airbnb believes he shares
with another person. To enable this booking, Airbnb stated that the
Complainant provided a copy of his ID together with a clear photo confirming
that he was the relevant ID holder.

Further, Airbnb stated that the safety and security of its users is of paramount
importance and that it asks users to verify their identity to enable it to confirm
that they are who they say they are. Airbnb stated that section 2.1 of its Privacy
Policy states that certain information is required from users, including “To help
create and maintain a trusted environment, we may collect identity Verification
and Payment Information. Such as images of your government issued ID (as
permitted by applicable laws), your ID number or other verification information,
bank account or payment account information”. Further Airbnb stated that as
set out in its Help Centre article, some hosts require their guests to complete
identity verification steps with Airbnb in order to book that host's listing. Airbnb
advised that this is also referred to in section 8.1.1 of its Terms of Service
“Subject to meeting any requirements (such as completing any verification
processes) set by Airbnb and/or the Host, you can book a Listing available on
the Airbnb Platform by following the respective booking process...”. Airbnb
advised that the host of the listing in question had activated this requirement
for the listing, which triggered the request for verification of the Complainant's
identity. Airbnb informed the DPC that the Complainant completed the booking
on a second Airbnb account, having successfully verified his identity through
that account.

The DPC informed the Complainant of Airbnb’s response via correspondence
that issued to the Berlin DPA on 05 June 2020.

The Berlin DPA provided the DPC with the Complainant's response on 30 June
2020 in which he advised that he did not consider his complaint to be amicably
resolved. :

The DPC reverted to Airbnb via email on 22 September 2020 requesting further
information. Airbnb responded via email on 06 October 2020 and provided the
requested information. In its response Airbnb advised that the safety and
security of its users is of paramount importance to Airbnb. Airbnb stated thatit
is this overarching concern that informs its identity verification procedures and

3:

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

its practice of respecting the prerogative of hosts, such as the host of the
booking involved in this complaint, to require that prospective guest's evidence
and prove their identity to Airbnb in a verifiable manner. Airbnb advised that
the purpose of requiring a copy of an ID document and an image verifying that
the individual is the ID holder is to combat unauthorised and illegitimate
bookings, such as to prevent someone posing as an account holder, from
making reservations using the ID document or a photo of the ID document of
another individual. Airbnb stated that it is confident that these identity
verification procedures are a necessary and proportionate means of achieving
the purpose of protecting the Airbnb platform and its community against the
myriad of risks associated with identifying users on an online platform, in
compliance with its obligations under the GDPR. Airbnb stated that as outlined
in section 2.1.1 of its Privacy Policy, with reference to the sub-heading ‘Identity
Verification Information’, such processing is necessary to perform the contracts
entered into with its users pursuant to its Terms of Service and to comply with
its legal obligations, including its obligations under the GDPR. Further Airbnb
stated that Section 3 of its Privacy Policy informs users that Airbnb processes
their personal data for the purposes of, among other things, pursuing Airbnb’s
legitimate interests in providing the Airbnb platform and maintaining the
platform as a trusted and safe environment. Airbnb advised that, for example,
section 3.2 of the Privacy Policy provides that Airbnb will use this data to “verify
or authenticate information or identifications provided by you (such as to verify
your Accommodation address or compare your identification photo to another
photo you provide)” with reference to Airbnb’s legitimate interests in protecting
the Airbnb platform. Airbnb asserted that providing a copy of an ID document
is one of the most practical and easily accessible ways in which users can
verify their identities.

Further, Airbnb stated that providing a copy of an official document such as a
passport, national ID card, driver licence, etc. lends authenticity to the
reservation request being made by the user. Airbnb advised that the
prevalence of bad actors targeting online platforms, such as Airbnb, requires
Airbnb to exercise diligence, due care and caution, in particular where hosts,
such as the host of the listing in this complaint, have requested that prospective
guests be verified in this manner. Airbnb stated that the limited additional step
of requesting that the individual supplement the copy of the ID document
provided with a photo verifying that it is the ID holder is a reasonable and
necessary component of ensuring that the individual making the reservation is
genuine and is the true ID holder. Airbnb asserted that given the risks in
processing an illegitimate reservation, it believes that this approach is
adequate, relevant and necessary for the purpose of verifying the user's
identity, in alignment with the principle of data minimisation.

4

10.

11.

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

The DPC advised the Complainant of Airbnb’s response via correspondence '
that was sent to the Berlin DPA on 18 December 2020.

The Complainant responded via correspondence provided to the DPC on
29 June 2021 advising that he wished to pursue his complaint.

The DPC advised Airbnb via correspondence dated 28 February 2022 that it
had been unable to facilitate the amicable resolution of this complaint.

Conduct of Inquiry

12

13.

14.

Acting in its capacity as lead supervisory authority, the DPC commenced an
Inquiry in relation to this matter by writing to Airbnb on 22 September 2022.

The DPC advised Airbnb that the Inquiry commenced by the Commencement
Notice would seek to examine and assess whether or not Airbnb had complied
with its obligations under the GDPR and the Act, in particular under Articles 5,
6, 7, 12 and 13 of the GDPR in respect of the relevant processing operations
which are the subject matter of the complaint.

The DPC advised Airbnb that the scope of the Inquiry concerned an
examination and assessment of the following:

a. Whether Airbnb had a lawful basis for requesting copies of the
Complainant's ID and photograph in order to verify his identity.

b. Whether Airbnb complied with the principle of data minimisation when
processing a copy of the Complainant's ID and photograph in order to
verify his account.

c. Whether Airbnb complied with the Conditions for Consent by making
the Complainant's ability to complete his booking conditional on the
Complainant submitting his ID and photograph in order to verify his
identity.

d. Whether Airbnb complied with principles of transparency and provision
of information where the Complainant's personal data was coilected.

ucoy

16.

17.

18.

19.

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

In order to progress the matter the DPC posed specific questions to Airbnb
regarding their processing operations that are subject matter of the complaint.

The DPC also informed the Complainant via the Berlin DPA in a letter dated 22
September 2022 that an Inquiry had commenced in relation to his complaint.
The DPC provided the Complainant the opportunity to withdraw any information
previously provided and asked whether the Complainant had any new
information he wished to submit regarding the complaint. The DPC’s letter of 22
September, 2022 was passed on to the Complainant by the Berlin DPA on 2
January, 2023. No reply was received from the Complainant up to the date of
drafting this Decision.

On 13 October 2022, Airbnb responded to the DPC by letter and addressed the
questions posed in the DPC’s Commencement Notice of 22 September 2022.
In response to the DPC’s query as to what legal basis Airbnb relied upon for
requesting a copy of the Complainant's ID and a copy of his photograph in order
to verify his identity, Airbnb submitted that it relied on the legitimate interests of
the host in question who required that the identities of prospective guests be
verified by ID, and its legitimate interests in facilitating this host's prerogative,
which was a safety and security measure that benefitted the legitimate interests
of the Airbnb community and those associated with it as a whole, in accordance
with Article 6(1)(f) of the GDPR. Airbnb submitted that the request for a
supplemental image of the Complainant was made to ensure that the individual
submitting the ID document was indeed the person in the ID photo, as part of
the pursuit of these legitimate interests.

Airbnb also submitted that its Terms of Service are contracts with its users, and
as part of these terms and the various other constituent terms and policies that
apply to the Airbnb platform (including those described in the relevant Legal
Terms page) it gives effect to certain decisions and requirements of its users,
including identity verification requirements which align with its identity
verification practices. Airbnb stated that in a number of pages in its ID and
verification Help Centre page it informs individuals that Airbnb hosts may require
its guests to provide ID to book a listing. Airbnb stated that this reflects the ID
requirement option it provides hosts in its account settings, which it says is also
explained to hosts in pages such as the hosting section of its trust page.

The DPC asked why Airbnb considered it both necessary and proportionate to
request a copy of the Complainant's ID photograph to verify his identity Airbnb
submitted that in light of the fact that hosts welcome strangers into their homes,
and the real-world risks of harm that this entails, it respects and facilitates the

An Coimisién um
Chosaint Sonrai

Data Protection
Commission

prerogative of hosts to make sure that the identities of their guests are fully
verified using ID documents. Airbnb submitted that providing a copy of an ID
document and supplemental image through a secure portal is a reliable proof of
identity that does not impose a disproportionate burden on the person. Airbnb
stated that its approach aligns with established, international organisations and
businesses operating across a wide variety of industries and commercial
sectors, including the travel, hospitality, and short term rental industries.

Airbnb submitted that, as it is necessary for it to design, implement and maintain

robust safety and security measures for the benefit of the Airbnb community and

those connected with it, it believes that the identity verification processes,

including the facilitation of host ID requirements, are a necessary and

proportionate means of achieving the purpose of protecting the Airbnb

community and indeed the broader community, in compliance with its obligations’
under the GDPR.

The DPC asked Airbnb whether it provides users with other means by which to
verify their identity. It further asked, if another method of verification was offered,
why this option was not offered to the Complainant. Airbnb submitted that in the
context of the complaint the ID requirement was stipulated by the host in
question, and Airbnb therefore respected this decision and facilitated this
requirement.

In response to the DPC’s query regarding why the personal data provided by
the Complainant on four separate occasions were not considered sufficient to
verify his identity, Airbnb submitted that its records indicate that on 20 June 2019
the Complainant submitted, in two separate uploads, unclear images of the
requested identity verification images, which prevented it from being able to
verify those images.

In response to the DPC’s query regarding any data minimisation efforts made
by Airbnb, in respect of the subject matter of the complaint, Aironb submitted
that it processes identity verification data so as to respect and facilitate the
prerogative of hosts by ensuring that the identity of their guests are verified using
ID documents. Further, Airbnb stated that it processes this data for other related
security purposes, which include enhancing its security processes, for example
using identity verification data in projects designed to identify fraudulent or
otherwise illegitimate ID documents, identifying connecting factors between
related fraudulent / potentially fraudulent accounts and investigating incidents
that can be linked with verification information previously provided to Airbnb.

7

An Coimisién um
Chosaint Sonrai
Date Protection
Commission

Airbnb stated that these purposes can be considered constituent elements of
the broader, overarching purpose of protecting the Airbnb platform and those
associated with it. Aironb submitted that the Complainant's identity verification
data was adequate, relevant and necessary for the purposes of facilitating the
ID requirement which was stipulated by the host in question.

In response to the DPC’s request to provide a copy of the instruction from the
host that required Airbnb to request the Complainant's ID in order to verify his
identity, Airbnb submitted a screenshot of the account settings page where hosts
can select this ID verification option.

The DPC asked Airbnb to outline why it allowed a host to determine the range
of personal data to be collected by the platform at the booking stage, along with
the legal basis it relies on to allow a host make such a request. Airbnb submitted
that it relied on the legitimate interests of the host in question, which said
interests benefit the Airbnb community and those associated with it under Article
6(1)(f) of the GDPR.

In response to the DPC’s query regarding why the Complainant was required to
verify his identity again if he had previously verified his identity in March of the
same year, in circumstances where the Complainant stated that he had
previously stayed at the same property at the time, Airbnb submitted that the
listing in question is now deactivated. Airbnb indicated its belief that the host's
ID requirement was not selected at the time of the earlier reservations in
February / March 2019. Airbnb submitted that the Complainant was first asked
to verify his identity for the purpose of proceeding with the booking on 20 June
2019, when attempting to book the listing in question. Airbnb stated that it would
also like to reiterate that for the later reservation booked in June 2019, the
Complainant ultimately submitted sufficient copies of his ID and supplementary
photo to reserve the listing. Airbnb submitted that its records do not align with
the Complainant's assertion that he was able to book this reservation directly
with the host, without the requested identity verification data.

In response to the DPC’s query regarding how Airbnb met the conditions for
consent outlined in Article 7 of the GDPR, Airbnb submitted that it did not rely
on consent to process copies of the Complainant's ID and supplementary photo.

The DPC requested detail from Airbnb on the date the Complainant first
registered as a member / host on the platform and further asked it to provide a
copy of the notice available to the Complainant, on the date he created his
account, outlining that Airbnb would require that he verify his identity and that
the provision of ID may be necessary in order to verify his identity. Airbnb

8

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

submitted copies of the Terms of Service and Privacy Policy which were in place
when the Complainant registered as an Airbnb user on 15 July 2013. Airbnb
stated that the section of the Terms entitled ‘Accommodation Listings’ informed
individuals that certain listings may have specific verification requirements, while
the section of the Privacy Policy entitled ‘Personally Identifiable Information’
informed individuals that Airbnb requests information for identity verification
purposes.

In response to the DPC’s request that Airbnb provide a copy of the notice which’
outlines that Airbnb would require that he verify his identity and that the provision
of ID may be necessary in order to verify his identity Airbnb directed the DPC to
Sections 2.4 and 8.1.1 of the 2019 Terms of Service. It stated that these sections
informed individuals about Airbnb’s identity verification practices. It further
directed the DPC to sections 2.1, 2.1.3, 2.1.5, 3.2 and 4.6 of the 2019 Privacy
Policy which contained links to the Help Centre material regarding Airbnb’s
identity verification practices.

Notification of the Preliminary Draft Decision to the Data Controller

w.

g

The DPC provided Airbnb with a copy of the Preliminary Draft Decision and
invited submissions by 02 June 2023.

The DPC received submissions from Airbnb dated 02 June 2023.

Airbnb stated that it would like to confirm that the host ID verification option, the
subject matter of this inquiry, has been discontinued, with the effect that Airbnb
determines the appropriate requirements to be applied in any given case,
involving Airbnb’s general platform identity verification practices (to be
distinguished from certain identity verification practices required by law, for
example identity verification requirements prescribed by anti-money laundering
rules).

Airbnb objected to the references in the Preliminary Draft Decision to present
day Airbnb Help Centre material and the EDPB access guidelines in the DPC’s
consideration of the matter of data minimisation. These references were
removed from the Draft Decision.

Airbnb drew attention to three inaccuracies in the Preliminary Draft Decision. All
three were dealt with in the Draft Decision.

The DPC has carefully considered the submissions of Airbnb in making this
Decision.

An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission

Notification of the Preliminary Draft Decision to the Complainant

%

The DPC provided the Complainant with a copy of the Preliminary Draft Decision
via the Berlin DPA on 12 June 2023 and invited submissions by 10 July
2023.The DPC received a communication from the Berlin DPA on 25 July 2023
which set out: “The complainant has informed us by telephone that he has no
objections to the preliminary draft decision.”

Relevant an soned Objections from “su, it riti d”

Kia

Having transmitted the Draft Decision, on 04 August 2023, to the “supervisory
authorities concerned” in accordance with Article 60(3) of the GDPR, the DPC
did not receive any relevant and reasoned objections under Article 60(4) of the
GDPR.

Given that no relevant and reasoned objections were received from any of the
supervisory authorities concemed, within a period of four weeks, after having
been consulted, the DPC did not revise the Draft Decision.

Applicable Law

a

For the purposes of its examination and assessment of this complaint, the DPC
has considered the following Articles of the GDPR:

e Article 5
e = Article 6
« Article 7
e Article 12
e = Article 13

Analysis and Findings of Inquiry

Issue A — Whether Airbn' \d_a lawful basis for res ina copies of the
Cc i : an tograph in o: ify his identi:

The Complainant asseried that, on submitting an online booking on the Airbnb

platform on 19 October 2019 Airbnb requested that he provide a copy of his ID
documents along with a photograph in order to verify his identity. The

10

A.

An Coimisiin um
Chosaint Sonrai
Data Protection
Commission

Complainant contends that Airbnb did not have a legal basis to request a copy
of his photographic ID and a supplementary image in the circumstances as he
was already a user of the platform and he was using a verified customer account’
to make an online booking. [Airbnb in its submissions regarding the Preliminary
Draft Decision clarified that the description of the account as being verified was
inaccurate as the Complainant's identity had not been verified at that juncture,
which is why the verification checks were carried out]. The Complainant stated
that he had booked the same accommodation some months previously and had
not been asked to provide his ID documentation on that occasion. The
Complainant submits that the data already provided should have been sufficient
to verify his identity when making an online booking.

During the course of the Inquiry, Airbnb stated that it relied on the legitimate
interests of the host who required that the identity of all prospective guests be
verified by ID verification. Airbnb further stated that it relied on its own legitimate
interests in facilitating the host’s prerogative, which was a safety and security
measure that benefitted the Airbnb community and those associated with it in
accordance with Article 6(1)(f) of the GDPR. Airbnb posited that the request for
a supplemental image of the Complainant was made to ensure that the
individual submitting the ID document was indeed the person in the ID photo, as
part of the pursuit of these legitimate interests. .

Airbnb advised the DPC that as part of the Terms of Service that apply to the
users of the Airbnb platform, Airbnb give effect to certain decisions and
requirements of their users, including identity verification requirements which
align with their identity verification practices. Airbnb stated that individuals are
informed in a number of pages within the ID and Help Centre page that Airbnb
hosts may require guests to provide ID to book a listing. Airbnb advised that this
ID requirement option is provided to hosts in their account settings.

During the DPC’s handling of the complaint, the Complainant advised that he
provided a copy of his ID and took a photograph with his webcam on four
separate occasions at the behest of Airbnb, but when he did not provide the data
in response to Airbnb’s fifth and sixth request, Airbnb cancelled his booking.
Airbnb in its automated responses to the Complainant on 20 June 2019 stated
that “For more information on how and why Airbnb requests an ID, please contact
our Help Center’.

Article 5(1)(a) of the GDPR states that personal data shall be “processed )
lawtully, fairly and in a transparent manner in relation to the data subject

11

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

(lawfulness, fairness and transparency’)”.

Information available to the Complainant at the time of account creation

Airbnb provided the DPC with copies of the Terms of Service and Privacy Policy
which were in place when the Complainant joined the Airbnb platform on 15 July
2013. The section of the Terms of Service 2012 entitled “Accommodation
Listings” informed individuals that certain listings may have specific verification
requirements. It states as follows:

“When you create a Listing, you may also choose to include certain
requirements which must be met by the Members who are eligible to
request a booking of your Accommodation, including, but not limited to,
requiring Members to have a profile picture or verified phone number, in
order to book your Accommodation. Any Member wishing to book
Accommodations included in Listings with such requirements must meet
these requirements. More information on how to set such requirements is
available via the “Hosting” section of the Site, Application and Services.”

Airbnb stated that the section of the Privacy Policy entitled “Personally
Identifiable Information” informed individuals that it requests information for
identity verification purposes. The Privacy Policy states as follows:

“When you register with us through the Site or Application and become a
Member and when you choose to post a Listing or book an Accommodation,
or when you wish to contact another Member, we will ask you for personally
identifiable information. This refers to information about you that can be used
to contact or identify you (“Identity Information"). Identity Information includes,
but is not limited to, your name, phone number, email address, social security
number (SSN), and home postal address, but does not include your credit card
number or billing information”

With respect to the above notices available to the Complainant on Airbnb’s
website at the time the Complainant created his account, the DPC is of the view
that the Complainant was on limited notice that he may be required to verifyhis
identity.

Information available to the Complainant at the time of Airbnb’s request for ID
and image

Airbnb provided the DPC with the Terms of Service, Privacy Policy and Identity

12

51.

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

Verification Help Centre materials which were in effect when the request for
identity verification was made on 19 October 2019. Airbnb submitted that certain
sections of its Terms of Service 2019 and Privacy Policy 2019 inform individuals
about Airbnb’s identity verification practices.

Section 2.3 of the Terms of Service 2019 states that “Airbnb may make access
to and use of the Airbnb Platform, or certain areas or features of the Airbnb
Platform, subject to certain conditions or requirements, such as completing a
verification process’.

Section 2.4 of the Terms of Service 2019 states:-

“User verification on the internet is difficult and we do not assume any
responsibility for the confirmation of any Member's identity. Notwithstanding the
above, for transparency and fraud prevention purposes, and as permitted by
applicable laws, we may, but have no obligation to (i) ask Members to provide a’
form of government identification or other information or undertake additional
checks designed to help verify the identities or backgrounds of Members, (ii)
screen Members against third party databases or other sources and request
reports from service providers, and (iii) where we have sufficient information to
identify a Member, obtain reports from public records of criminal convictions or
sex offender registrations or an equivalent version of background or registered
sex offender checks in your local jurisdiction (if available).”

Section 8.1.1 of the Terms of Service 2019 states:-

“Subject to meeting any requirements (such as completing any verification
processes) set by Airbnb and/or the Host, you can book a Listing available on
the Airbnb Platform by following the respective book process...”

Section 2.1.1 of Airbnb’s Privacy Policy 2019 states that “when a person signs
up for an Airbnb Account, Airbnb requires certain information such as person’s
first name, last name, email address and date of birth, and that Airbnb may
collect identity verification information, such as images of government issued ID,
passport national ID card, or driving licence as permitted by applicable laws, or'
other authentication information, to help create and maintain a trusted
environment’. Section 2.1.1 of Airbnb’s Privacy Policy also states that “to use
certain features of the Airbnb platform (such as booking or creating a Listing),
we may ask you to provide additional information, which may include your
address, phone number, and a profile picture...”.

13

3

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

Section 3.2 of Airbnb's Privacy Policy states:-

“We may use the personal information to create and maintain a trusted and safer
environment such as to verify or authenticate information or identifications
provided by you (such as to verify your Accommodation address or compare your
identification photo to another photo you provide)...”

Section 4.6 of Airbnb’s Privacy Policy 2019 also sets out that Airbnb may engage
with third party companies and individuals who may be located outside of the
EEA to provide services to it including services to help verify users’ identification.

With respect to the above notices available on Airbnb’s website at the time the
Complainant was requested to provide his ID in order to verify his identity, the
DPC is of the view that the Complainant was on notice that he may be required
to verify his identity, including by providing a copy of his photographic ID and
image/s.

Existence of a lawful basis

Article 6(1)(f) of the GDPR states “processing is necessary for the purposes of
the legitimate interests pursued by the controller or by a third party, except where
such interests are overridden by the interests or fundamental rights and
freedoms of the data subject which require protection of personal data, in
particular where the data subject is a child”.

The DPC notes that Airbnb has claimed that it relied on the legitimate interests
of the host in question, who required that the identities of prospective guests be
verified by ID verification, and its legitimate interests in facilitating this host’s
prerogative, which was a safety and security measure that benefitted the
legitimate interests of the Airbnb community and those associated with it as a
whole, in accordance with Article 6(1)(f) of the GDPR. The DPC notes that
Airbnb stated its request for a supplemental image of the Complainant was
made to ensure that the individual submitting the ID document was indeed the
person in the ID photo, as part of the pursuit of these legitimate interests.

Noting that the platform Airbnb operates by bringing hosts and members who
are unknown to each other into a situation where they may actually meet in
person at the host's premises, or elsewhere, the DPC agrees that a legitimate
interest exists in Airbnb ensuring it has adequate safety and security measures
in place to protect users of the platform. The service operated by Airbnb is,
therefore, significantly different to a purely online service such as a social media

platform. Given that Aironb members stay at the premises of a host “in the real
14

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

world”, the DPC recognises the importance of verifying the identity of guests to
ensure that they are who they say they are. However, as set out at paragraph
21 above, regarding whether the Complainant was provided with other means
of identity verification, Airbnb stated that the ID requirement was selected by the
host and that as such Airbnb respected this decision and facilitated this
requirement. Given that other means of validating this guest’s identity were not
attempted in the first instance, the DPC finds that it was not necessary to
process the photo ID and supplemental image in pursuit of the legitimate interest
as a first resort. Airbnb prioritised the rights of the host over the rights of the
guest (i.e. the Complainant), and failed to give due consideration to the fact that
other identification methods could have been applied to authenticate the!
Complainant's identity in the first instance. While the DPC acknowledges that
Airbnb can request ID verification documents given the ‘real world’ interactions
members of the platform often have, a request of this nature should not be the
first attempt at ID verification. In a decision adopted by the DPC on 9 January,
2023 in the case of fv Airbnb Ireland UC (Case Reference Number I
IB, the DPC found that Airbnb validly relied on Article 6(1)(f) as the legal basis
for processing the complainant's photographic ID in that case once all other
efforts that it had deployed to verify her identity were unsuccessful. In that case,
for example, Airbnb stated that it had initially attempted to verify the
complainant's identity, without requesting a copy of ID on the basis of
information (name, address and dates of birth) submitted by the complainant in
the identity verification flow by comparing these details against reliable external
databases. In the present case, however, Airbnb made no such attempts to
verify the Complainant's identity by other less intrusive means prior to seeking
a copy of photographic ID and this case differs fundamentally from the above
referenced case in that regard. Had Airbnb first deployed other efforts to verify
the Complainant's identity without achieving a successful outcome, it would
have been in a better position to justify thereafter seeking a copy of photographic!
ID and may have been able to ground that data processing in the legal basis of
Article 6(1)(f). However, without having made other attempts to verify the
Complainant's identity prior to seeking a copy of photographic ID, the DPC does
not consider that Airbnb could rely on Article 6(1)(f) as the legal basis for
processing this complainant’s photographic ID and supplemental image.

In those circumstances, therefore, the DPC finds that Airbnb did not
validly rely on Article 6(1)(f) of the GDPR as the legal basis for processing
this Complainant’s photographic IDs and supplemental image.

15

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

Issue B — Whether Airbnb complied with the principle of data minimisation
rocessing a co} he Complai ‘s ID jhotograph in ord

to verify his account.
Article 5(1)(c) of the GDPR states “personal data shall be adequate, relevant

and limited to what is necessary in relation to the purposes for which they are
processed (“data minimisation”).

In the circumstances of this Complainant's case, the DPC is not satisfied that
Airbnb gave adequate consideration to the principle of data minimisation when
it sought from the Complainant a photo which “clearly shows all the information
on your badge.” The Complainant was not given any opportunity to reduce the
amount of data shared to Airbnb from his photographic ID. In the circumstances
of this case, the Complainant was not informed by Airbnb that redactions could
be applied to data contained on his official ID and he was, instead, requested to
submit a photo of his ID showing all the information on it.

Accordingly, there is no evidence that Airbnb sought in this case to minimise the
amount of personal data sent to it with the Complainant's photo ID.

The DPC finds, therefore, that in the particular situation that arose in this
Complainant's case, Airbnb’s requirement that the Complainant verify his
identity by submitting an unredacted copy of his photographic ID
constituted an infringement of the principle of data minimisation, pursuant
to Article 5(1)(c) of the GDPR.

j ; Wi irbn Li i nditi for nt

The Complainant contends that his ability to complete his booking was
conditional on him submitting a copy of his ID and a supplemental image to verify
his identity.

Airbnb submitted that it relies on legitimate interests under Article 6(1)(f) of the

GDPR as the legal basis for the collection and retention of ID documents and

supplementary images in order to verify a party's identity and that this

processing was not carried out on the basis of consent under Article 6(1)(a) or

under Article 7 of the GDPR.

Article 6(1)(a) of the GDPR states “processing shall be lawful only if and to the
extent that... [...]...the data subject has given consent to the processing of his

16

71.

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

1

or her personal data for one or more specific purposes”.

Article 7(1) of the GDPR states “[w]here processing is based on consent, the
controller shall be able to demonstrate that the data subject has consented to
processing of his or her personal data.”

Article 7(4) of the GDPR states “[w]hen assessing whether consent is freely
given, utmost account shall be taken of whether, inter alia, the performance of
a contract, including the provision of a service, is conditional on consent to the
processing of personal data that is not necessary for the performance of that
contract’.

Given Airbnb’s submissions that it did not rely on the complainant's consent in
respect of the processing of his personal data, and rather that it relied on
legitimate interest as per Article 6(1)(f) of the GDPR, the question of obtaining
the consent of the Complainant did not occur in this case and therefore the
matter of whether or not the conditions for consent were complied with does ‘
not arise for consideration. However, that being said, the DPC has made a
finding at paragraph 59 above that Airbnb did not validly rely on Article 6(1)(f)
of the GDPR as the legal basis for processing the Complainant's photographic
IDs and supplemental image.

Issue D: Whether Airbnb complied with principles of transparency and
provision of information where the Complainant's personal data was

collected

Article 13(1)(c) of the GDPR states “where personal data relating to a data
subject are collected from the data subject, the controller shall, at the time when
personal data are obtained, provide the data subject with the purposes of the
processing for which the personal data are intended as well as the legal basis
for the processing” and Article 13(1)(d) of the GDPR states “where personal data
relating to a data subject are collected from the data subject, the controller shall,
at the time when personal data are obtained, provide the data subject with, where
the processing is based on point (f) of Article 6(1), the legitimate interests
pursued by the controller or by a third party’. ;

Airbnb notified the DPC of the Privacy Policy, the Terms of Service and identity
verification Help Centre materials which were in effect at the time the
Complainant joined the Airbnb platform in July 2013. Airbnb’s 2011 Privacy
Policy states that it uses and processes information about users to help create
and maintain a trusted and safer environment on the platform, such as verifying
any identifications provided by users. Airbnb stated that links-to these
documents were made available to the Complainant during the account creation

17

14.

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

process.

As set out from paragraph 45 - 54 above, Airbnb directed the DPC to particular
sections of the 2011 and the 2019 Privacy Policy along with the 2012 and 2019
Terms of Service which inform users that Airbnb engages in identity verification
practices and the reasons why this practice is utilised.

The DPC is satisfied that, taking all of the above submissions and supporting
evidence into account, Airbnb, at the time of requesting copies of the
Complainant's ID and image, set out the intended purposes of the processing
and the legitimate interests pursued by Airbnb. The DPC finds that Airbnb met
the transparency requirements of Article 13 of the GDPR.

Decision on infringements of the GDPR

Following the investigation of the complaint against Airbnb Ireland UC, the DPC
is of the opinion that in the circumstances of this Complainant's case, Airbnb
Ireland UC infringed the General Data Protection Regulation as follows:

e The DPC finds that Airbnb did not validly rely on Article 6(1)(f) of the
GDPR as the legal basis for processing the Complainant’s
photographic IDs and supplemental image.

e The DPC finds that in the particular situation that arose in this
Complainant’s case, Airbnb’s requirement that the Complainant
verify his identity by submitting an unredacted copy of his
photographic ID constituted an infringement of the principle of data
minimisation, pursuant to Article 5(1)(c) of the GDPR.

medial m re nd n_by Ail | in

It is noted that Airbnb has confirmed that it has discontinued the practice of
allowing its hosts to request ID from prospective guests. However the DPC notes
that Airbnb continues to use identity verification requirements depending on the
circumstances of individual bookings on its general platform.

Exercise of Corrective Power by the DPC

In deciding on the corrective powers that are to be exercised in respect of the
infringements of the GDPR outlined above, | have had due regard to the

18

An Coimisién um
Chosaint Sonrai
Data Protection
Commission

Commission’s power to impose administrative fines pursuant to Section 141 of
the 2018 Act. In particular, | have considered the criteria set out in Article 83(2)
(a)-(k) of the GDPR. When imposing corrective powers, | am obliged to select
the measures that are effective, proportionate and dissuasive in response to the
particular infringements. The assessment of what is effective proportionate and
dissuasive must be made in the context of the objective pursued by the
corrective measures, for example re-establishing compliance with the GDPR or
punishing unlawful behaviour (or both). | find that an administrative fine would
not be necessary, proportionate or dissuasive in the particular circumstances in
relation to the infringements of the Articles of the GDPR as set out above.

77. Inlight of the extent of the infringements identified above, the DPC hereby
issues a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the
GDPR.

78 In light of the infringements identified above and to prevent similar
infringements occurring with regard to data subjects in the future, the DPC
proposes to order Airbnb pursuant to Article 58(2)(d) of the GDPR to revise
its internal policies and procedures to ensure that the seeking of
photographic ID and supplemental photographs in the verification process
for users is used only where necessary, proportionate and in accordance
with the GDPR for the purpose for which the personal data is collected and
processed, having regard, in particular, to Airbnb’s legal obligations and
the issue of whether less privacy intrusive verification methods are
available and effective. Details of compliance with this order should be
provided to the DPC by Airbnb by Thursday, 21 December 2023.

Judicial remedies with respect to the Decision of the DPC

78. In accordance with Article 78 of the GDPR, each natural or legal person has the!
tight to an effective judicial remedy against a legally binding decision of a
supervisory authority concerning them. Pursuant to Section 150(5) of the Act,
an appeal to the Irish Circuit Court or the Irish High Court may be taken by a
data subject or any other person (this includes a data controller) affected by a
legally binding decision of the DPC within 28 days of receipt of notification of
such decision. An appeal may also be taken by a data controller within 28 days
of notification; under Section 150(1) against the issuing of an enforcement notice
and/or information notice by the DPC against the data controller; and under

1 See the Article 29 Data Protection Working Party ‘Guidelines on the application and setting of administrative
fines for the purposes of Regulation 2016/679, at page 11.
19

An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission

Section 142, against any imposition upon it of an administrative fine by the DPC.

Signed: engl
Tony Delaney

Deputy Commissioner

On behalf of the Data Protection Commission

20