In the matter of the General Data Protection Regulation
DPC Complaint Reference:
IMI Complaint Reference:
In the matter of a complaint, lodged by with the Berliner Beauftragte für
Datenschutz und Informationsfreiheit Data Protection Commission pursuant to Article 77 of the
General Data Protection Regulation, concerning Airbnb Ireland UC
Record of Amicable Resolution of the complaint and its consequent withdrawal pursuant to
Section 109(3) of the Data Protection Act, 2018
Further to the requirements of EDPB Guidelines 06/2022 on the practical implementation of
amicable settlements Version 2.0 (adopted on 12 May 2022)
RECORD OF AMICABLE RESOLUTION FOR THE
PURPOSE OF EDPB GUIDELINES 06/2022 ON THE
PRACTICAL IMPLEMENTATION OF AMICABLE
SETTLEMENTS VERSION 2.0, ADOPTED 12 MAY 2022
Dated the 23rd day of October 2023
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, Ireland
1
Background
1. (“the Data Subject”) lodged a complaint pursuant to Article 77 GDPR with the
Berliner Beauftragte für Datenschutz und Informationsfreiheit (“the Recipient SA”)
concerning Airbnb Ireland UC (“the Respondent”).
2. In circumstances where the Data Protection Commission (“the DPC”) was deemed to be the
competent authority for the purpose of Article 56(1) GDPR, the Recipient SA transferred the
complaint to the DPC on 3 September 2021.
The Complaint
3. The details of the complaint were as follows:
a. On 29 March 2021, the Data Subject submitted an access request to the Respondent
seeking a copy of their personal data, as well as all information required to be
provided pursuant to Article 15 GDPR. The Data Subject also asserted their rights
pursuant to Article 18 GDPR, requesting the restriction of any unlawful processing
that may have been carried out.
b. The Data Subject also noted that the Respondent offered a customer contact channel
via Facebook, and had concerns about transfers of their personal data by the
Respondent to Facebook in the United States. On 13 July 2021, the Data Subject
contacted the Respondent again, this time via Facebook Messenger, requesting
information about transfers of their personal data to third countries and the
appropriate safeguards required pursuant to Article 46 GDPR. The Data Subject also
reminded the Respondent about their outstanding request of 29 March 2021.
c. The Data Subject did not receive a response from the Respondent and, accordingly,
lodged a complaint with the Recipient SA.
Action taken by the DPC
4. The DPC, pursuant to Section 109(4) of the Data Protection Act, 2018 (“the 2018 Act”), is
required, as a preliminary matter, to assess the likelihood of the parties to the complaint
reaching, within a reasonable time, an amicable resolution of the subject-matter of the
complaint. Where the DPC considers that there is a reasonable likelihood of such an amicable
resolution being concluded between the parties, it is empowered, by Section 109(2) of the
2018 Act, to take such steps as it considers appropriate to arrange or facilitate such an
amicable resolution.
5. Following a preliminary examination of the material referred to it by the Recipient SA, the DPC
considered that there was a reasonable likelihood of the parties concerned reaching, within a
reasonable time, an amicable resolution of the subject matter of the complaint. The DPC’s
experience is that complaints of this nature are particularly suitable for amicable resolution in
2
circumstances where there is an obvious solution to the dispute, if the respondent is willing
to engage in the process. In this regard, the DPC had regard to:
a. The relationship between the Data Subject and Respondent (being, in this case, an
individual consumer and a service provider); and
b. The nature of the complaint (in this case, an unsuccessful attempt by the Data Subject
to exercise their data subject rights).
6. While not relevant to the assessment that the DPC is required to carry out pursuant to Section
109(4) of the 2018 Act, the DPC also had regard to EDPB Guidelines 06/2022 on the practical
implementation of amicable settlements Version 2.0, adopted on 12 May 2022 (“Document
06/2022”), and considered that:
a. the possible conclusion of the complaint by way of amicable resolution would not
hamper the ability of the supervisory authorities to maintain the high level of
protection that the GDPR seeks to create; and that
b. such a conclusion, in this case, would likely carry advantages for the Data Subject,
whose rights under the GDPR would be vindicated swiftly, as well as for the controller,
who would be provided the opportunity to bring its behaviour into compliance with
the GDPR.
Amicable Resolution
7. The DPC engaged with both the Data Subject and Respondent in relation to the subject matter
of the complaint. On 12 May 2022, the DPC wrote to the Respondent formally commencing
its investigation and requesting that it address the concerns raised. In response, the
Respondent explained that, due to a breakdown in communication, the access request was
never received by the relevant department. The Respondent apologised for this oversight and
explained that it had retrained its agents to avoid the issue happening again. The Respondent
provided the Data Subject with a copy of their personal data, as requested.
8. The Respondent also addressed each of the types of information it was required to provide
pursuant to Article 15 GDPR. The Data Subject was initially dissatisfied with the level of
information provided and so the DPC engaged further with the Respondent in order to obtain
a more comprehensive response. In this subsequent response, and in addition to standard
information about the Data Subject’s right to lodge a complaint with a Supervisory Authority,
the Respondent provided a detailed explanation as to the purposes of its processing activities;
the categories of personal data processed; the recipients of personal data and how it shares
personal data with third parties; its retention of personal data pursuant to its retention
policies; how it obtains any information not provided directly by the Data Subject; the extent
to which it engages in automated processing and profiling; and safeguards it applies where
personal data may be transferred to a third country.
3
9. In relation to the Data Subject’s specific concerns about the safeguards in place for transfers
of personal data between the Respondent and Facebook in the US, the Respondent explained
how it relied on the European Commission’s Standard Contractual Clauses (SCCs),
supplemented by additional measures as appropriate. The Respondent provided an extract of
its intercompany data sharing agreement containing the relevant SCCs, as well as details of
the specific technical and organisational measures it implements.
10. The Respondent further explained that data transfers from Facebook to it are regulated by
Facebook's standard data processing terms, while transfers of such data within the
Respondent’s group of companies are regulated by its intergroup data sharing arrangements
and the attendant safeguards (which were also described in the response). The Respondent
also separately considered whether it had transferred any of the Data Subject’s personal data
to Facebook. The Respondent confirmed that the Data Subject consented to the use of cookies
and other tracking technologies on its platform that include cookies relating to Facebook.
However, the Respondent confirmed that no other transfer of the Data Subject’s personal
data took place.
11. In addition to the explanations provided above, the Respondent acknowledged that its initial
responses to the Data Subject’s requests for information could have been clearer and more
comprehensive. In the interest of achieving an amicable resolution to the complaint, the
Respondent therefore proposed a settlement offer to the Data Subject.
12. The DPC considered the Respondent’s proposal and weighted this against the actions taken
by the Respondent to date in response to the DPC’s investigation. In light of the detailed
explanations provided by the Respondent as outlined above, and the fact that the Data
Subject had now received their personal data pursuant to their request together with all other
required information, the DPC considered it appropriate to conclude the complaint by way of
amicable resolution.
13. As such, on 17 May 2023, the DPC wrote to the Data Subject (via the Recipient SA) informing
them of the explanations provided by the Respondent as set out above, as well as the
settlement offer made, and proposed to conclude the complaint by way of amicable
resolution. In the circumstances, the DPC asked the Data Subject to notify it, within a specified
timeframe, if they were not satisfied with the outcome, so that the DPC could take further
action. The Recipient SA confirmed to the DPC that this letter was sent to the Data Subject on
5 June 2023. On 15 June 2023, the Data Subject responded agreeing to the Respondent’s
proposal. Accordingly, and following subsequent confirmation received by the DPC as to the
performance of the settlement referred to above, the complaint has been deemed to have
been amicably resolved.
14. In circumstances where the subject matter of the complaint has been amicably resolved, in
full, the complaint, by virtue of Section 109(3) of the 2018 Act, is deemed to have been
withdrawn by the Data Subject.
Confirmation of Outcome
4
15. For the purpose of Document 06/2022, the DPC confirms that:
a. The complaint, in its entirety, has been amicably resolved between the parties
concerned;
b. The agreed resolution is such that the object of the complaint no longer exists; and
c. Having consulted with the supervisory authorities concerned on the information set
out above, as required by Document 06/2022 the DPC has now closed off its file in
this matter.
16. If dissatisfied with the outcome recorded herein, the parties have the right to an effective
remedy by way of an application for judicial review, by the Irish High Court, of the process
applied by the DPC in the context of the within complaint.
Signed for and on behalf of the DPC:
_____________________________
Deputy Commissioner
Data Protection Commission
5