An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
**DPC Complaint Ref:** [REDACTED]
**DPC Ref:** [REDACTED]
**Berlin DPA Ref:** [REDACTED]
**Date: 31 January 2024**
**Complainant:** [REDACTED]
**Data Controller: Airbnb Ireland UC**
**RE:** [REDACTED] v Airbnb
This document is a Decision of the Data Protection Commission of Ireland ("DPC") in relation to DPC complaint reference, C-20-02-437 (the "Complaint"), submitted by [REDACTED] ("Complainant"), against Airbnb Ireland UC ("Airbnb"), to the Berlin Commissioner for Data Protection and Freedom of Information ("Berlin DPA") in its capacity as the concerned supervisory authority and thereafter referred to the DPC in its capacity as lead supervisory authority.
This Decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General Data Protection Regulation ("GDPR").
### **Communication of Draft Decision to "Supervisory Authorities Concerned"**
In accordance with Article 60(3) of the GDPR, the DPC is obliged to communicate the relevant information and submit a Draft Decision, in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a Draft Decision in relation to the matter to the "supervisory authorities concerned". As Airbnb offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as lead supervisory authority identified that each supervisory authority is a supervisory authority concerned as defined in Article 4(22) of the GDPR. On this basis, the Draft Decision of the DPC in relation to this complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.
1
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# **Complaint Handling by the DPC – Timeline and Summary**
1. The complaint was lodged with the Berlin DPA and thereafter was transferred to the DPC, on 7 February 2020, to be handled by the DPC in its role as lead supervisory authority. The Complainant alleged that, during the course of his registration with the platform, Airbnb sought a copy of his identity to complete the registration process. The Complainant entered his email address and phone number. He also ticked a box to be excluded from advertising emails. The Complainant stated that once he was asked to submit his I.D. documentation, he decided to abort the registration process. He provided his email address and created a password to access an internal area within the platform and within this area, he asked Airbnb to delete all his personal data and to ensure that none of his data was transferred to third parties. The Complainant stated that he was told that it was not possible to delete his data without his I.D. The Complainant stated that he did not consider Airbnb's request for I.D. to have any legal basis and that it was an infringement of the principle of data minimisation by Airbnb. He also had concerns in relation to an alleged infringement of his right to erasure of his personal data. The Complainant provided the DPC with copies of the correspondence he exchanged with Airbnb.
2. The DPC notified Airbnb of the complaint by way of email and letter dated 25 May 2020 and provided Airbnb with a copy of the Complainant's complaint.
3. Airbnb reverted to the DPC by email dated 26 May 2020 indicating that it could not locate an account related to the Complainant with the email address provided to it and asked that the DPC confirm the Complainant's email address with him. By way of response, the Complainant confirmed the email address that had been provided and stated that Airbnb had communicated with him through this email address. The Complainant provided evidence of this communication. In correspondence with the DPC on 27 October 2021, Airbnb stated that without access to a specific account, it would be limited in its ability to respond to the specific questions raised by the Complainant. Notwithstanding Airbnb's inability to locate an account linked with the Complainant, it responded to the queries raised by the DPC on behalf of the Complainant on 01 December 2021.
4. In relation to the Complainant's query as to why his data was not automatically erased once his account had been deleted, Airbnb stated that account deletion is
2
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
a permanent deletion of personal data and closure of the Airbnb account. Having regard to the request for proof of identity, Airbnb stated that, although it couldn't confirm any specific actions taken in relation to the Complainant, in 2019 I.D. verification represented Airbnb's preferred first-line method of authenticating deletion requests.
5. With regard to the Complainant's request for a confirmation from Airbnb that his data was not shared with any third parties, Airbnb stated that it does not sell user data for advertising purposes. It further stated that it does not review, scan or analyse messaging communications to send third party marketing messages to users and it does not sell, review or analyse any of these communications. Airbnb stated that it could not address this matter with specificity given that it could not locate any account linked with the Complainant.
6. The DPC reverted to the Complainant notifying him of the progress of his complaint. The DPC advised the Complainant that Airbnb provided further information regarding its position in respect of the concerns identified in his complaint and set out the contents of Airbnb's email dated 01 December 2021.
7. The DPC invited the Complainant to submit his comments, if any, in relation to the information provided by Airbnb and also invited him to set out any outstanding concerns he had in relation to the issues raised in his initial complaint.
8. The Complainant reverted to the Berlin DPA by letter dated 03 February 2022 stating that he was not satisfied with Airbnb's response and that his complaints had not been addressed or resolved.
9. In summary, therefore, the DPC was unable to arrange or facilitate within a reasonable time an amicable resolution of the complaint through the mechanism of its complaint handling process.
# Conduct of Inquiry
10. Acting in its capacity as lead supervisory authority, the DPC issued a Notice of Commencement of Inquiry, including a request for information, to Airbnb on 08 December 2022.
3
An Coimisiún um Chosaint Sonraí
Data Protection Commission
11. The DPC notified Airbnb that the Inquiry would seek to examine and assess whether Airbnb had complied with its obligations as a data controller under the GDPR and the Act in respect of the relevant processing operations which are the subject matter of the complaint.
12. The DPC notified Airbnb that the scope of the Inquiry concerned an examination and assessment of the following:
a) Whether Airbnb had a lawful basis for requesting the Complainant's I.D. at the point of registration of an account.
b) Whether Airbnb had a lawful basis for requesting a copy of the Complainant's I.D. in order to verify his identity so that he could delete his account.
c) Whether Airbnb complied with the principle of data minimisation when requesting a copy of the Complainant's I.D. in order to verify his account and when processing personal data relating to same.
d) Whether Airbnb complied with principles of transparency and provision of information at the point when the Complainant's personal data was collected from him.
13. The DPC notified the Complainant, by email and letter including a request for information, sent to the Berlin DPA on 18 November, 2022 that an Inquiry had commenced in relation to his complaint. In his response received by the DPC on 26 September, 2023 the Complainant confirmed that he attempted to register with Airbnb as a guest on 11 May, 2019. He also confirmed that he did not provide Airbnb with a copy of his ID as he cancelled his registration because "I did not agree with the demanded data processing. During the erasure request, I was told that this would only work with an ID copy. Which I refused."
14. On 12 January 2023, Airbnb provided the DPC with its response to the questions posed in the DPC's Notice of Commencement. Airbnb stated at the outset that this inquiry relates to a Complainant that it has not been able to link with an Airbnb account.
4
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
15. Airbnb stated that in the circumstances, Airbnb was being asked a number of specific questions regarding an account that it cannot locate and which it suspected was deleted following the Complainant’s request a number of years ago. Airbnb stated that, as such, it was restricted in its ability to respond to certain of the questions included in the Commencement Notice.
16. Airbnb stated that it does not require new Airbnb users creating their accounts to provide I.D. documents as part of registering an account, and can confirm that in 2019 when the Complainant seemed to have joined the platform, such a requirement would not have been imposed on him. Airbnb also stated that regarding verification of the Complainant’s identity for the purpose of exercising his erasure request it appeared that in this instance the Complainant was not required to provide his I.D. document either. Airbnb stated that it had, however, a policy of requesting I.D. verification for deletion requests under Article 17 of the GDPR, which was in place in 2019 but was replaced in 2020 by two-factor authentication methods and other authentication methods that do not require I.D. documents. Airbnb stated that in 2019 it facilitated alternative authentication methods to I.D. verification and, based on the information provided to it in this complaint, including material from the Complainant, the evidence suggests that the Complainant’s deletion request was authenticated through account login and his account was subsequently deleted.
17. In response to the DPC’s question as to the legal basis relied upon by Airbnb for requesting a copy of the Complainant’s I.D. in order to verify his identity at the registration stage and subsequently to enable him to delete his partially created account, Airbnb stated that it does not require new users creating their accounts to provide I.D. documents as part of registering an account, and would not have imposed this requirement on the Complainant. Airbnb stated that since it cannot relate any account to the Complainant, it was unable to specifically comment on the basis for a request of the Complainant’s I.D. documentation (if any) prior to his deletion request. Airbnb stated that where it requested I.D.’s to authenticate deletion requests in the past, it relied on a variety of legitimate interests including its legitimate interests in verifying the authenticity of the request and the legitimate interests of account holders generally in ensuring that their accounts were not deleted in illegitimate or otherwise inappropriate circumstances, in accordance with Article 6(1)(f) of the GDPR.
18. In response to whether Airbnb considered it both necessary and proportionate to request a copy of members’ I.D. to verify their identity so that they can delete their account, particularly in circumstances where no I.D. had previously been provided
5
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
Airbnb stated that although it believes that it fulfilled the Complainant's erasure request without requiring I.D. in this instance, in 2019, I.D. verification represented its preferred method of authentication for erasure requests, given the probative value of I.D. verification and the safety and security issues relating to the nature of the Airbnb platform, including the need to preserve accounts that may be necessary for travel abroad or which may support an important element of an individual's livelihood. Airbnb stated that the corroborative value of requesting I.D. was not dependant or predicated on there being a pre-existing I.D. on a user's account, and instead formed part of a holistic approach to identity identification, carried out with reference to the totality of information available to Airbnb. Airbnb stated that given that it was and is necessary for it to design, implement and maintain robust safety and security measures, it believes that I.D. verification formed part of a necessary and proportionate suite of measures, which included alternative verification measures where appropriate, designed to protect the platform, community and all those associated with it. However, Airbnb stated that as clarified previously, it no longer uses I.D. documents to authenticate deletion requests.
19. Airbnb stated that in 2019, I.D. verification represented the preferred method of authentication, given the probative value of I.D. verification and the safety and security issues relating to the nature of the platform, but alternative verification methods were facilitated where possible and appropriate. Airbnb stated that based on the information available to it, it appears that one such method, namely account login, was ultimately used to authenticate the Complainant's deletion request.
20. In relation to the DPC's query concerning any data minimisation efforts used by Airbnb in respect of the subject matter of this complaint. Airbnb stated that based on the information provided to it in the complaint, the evidence suggests that the Complainant's deletion request was authenticated through account login as an alternative to I.D. verification, with the effect that no processing of I.D. documentation took place.
21. In response to what, if any, reasonable doubts Airbnb had as to the Complainant's identity, which led it to consider it necessary to request I.D. in the context of processing the Complainant's erasure request, Airbnb stated that in circumstances where it has very little information in relation to the underlying facts, Airbnb is not in a position to comment on any reasonable doubts in existence at the time in question.
6
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
22. The DPC queried when and how Airbnb first notified the Complainant of its Terms of Service, Identification Verification Policy and Privacy Policy and requested it to supply the DPC with copies of same which applied at the time the Complainant attempted to register as a member and that applied at the time Airbnb requested a copy of the Complainant’s I.D. in 2019. In response to this Airbnb stated that the lack of information available to it leaves it unable to respond to specific questions such as this. Airbnb stated however, that based on information provided to it by the DPC, it appears that the Complainant created an Airbnb account on 11 May 2019 and subsequently submitted a deletion request on 12 May 2019. Airbnb included copies of its applicable terms of service “*Attachment 2 – Terms of Service (2019)*” and privacy policy “*Attachment 3 – Privacy Policy (2019)*” with its response. Airbnb stated:-
> “Sections 2.4 and 8.1.1 of the terms of service informed individuals about Airbnb’s identity verification practices, as did sections 2.1.1, 2.1.3, 2.1.5, 3.2, and 4.6 of the privacy policy, which also contained links to Help Centre material regarding Airbnb’s identity verification practices. Links to these terms and policies were made available to users during the account creation process.”
23. In response to the DPC’s query to Airbnb to confirm whether the Complainant’s erasure request was given effect to, completed and the date that all data was deleted, Airbnb stated again that in light of the lack of information available to it in relation to this complaint it was unable to fully respond to certain questions such as this. Airbnb stated however, that based on the information that has been provided to it, it believed that the Complainant submitted a deletion request on 12 May 2019 and that this request was authenticated by account login at some point between 12 May 2019 and 21 May 2019, after which point the Complainant’s account was deleted. Airbnb stated that this was supported by the evidence provided by the Complainant that Airbnb responded to him on 21 May 2019, in which response Airbnb confirmed that his account would be deleted. Airbnb stated that while it was not in a position to confirm the precise date on which the Complainant’s account was deleted, given how quickly he requested the deletion post-creation, it was likely that deletion of an account with such minimal activity would have been completed promptly, for example in a matter of days. Airbnb also stated that the fact that it cannot locate an account connected with the Complainant provides further evidence that the Complainant’s erasure request was given effect to and his account was deleted.
7
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# **Notification of the Preliminary Draft Decision to the Data Controller**
24. The DPC provided Airbnb with a copy of its Preliminary Draft Decision on 7 November 2023 and invited submissions from Airbnb.
25. By correspondence dated 9 November 2023, Airbnb stated that it did not intend to make any final submissions in respect of the Preliminary Draft Decision.
# **Notification of the Preliminary Draft Decision to the Complainant**
26. The DPC provided the Complainant with a copy of its Preliminary Draft Decision via the Berlin DPA, on 14 November 2023, and invited any submissions by 5 December 2023.
27. By correspondence dated 3 December 2023, the Complainant submitted his response to the DPC's preliminary draft decision where he stated
"If the elements already discussed are included there once again, then it suits me fine."
28. The DPC has carefully considered the submissions of the Complainant in making this Decision.
# **Relevant and reasoned Objections from "supervisory authorities concerned"**
29. Having transmitted the Draft Decision on 20 December 2023 to the "supervisory authorities concerned" in accordance with Article 60(3) of the GDPR, the DPC did not receive any relevant and reasoned objections under Article 60(4) of the GDPR.
30. Given that no relevant and reasoned objections were received from any of the supervisory authorities concerned within a period of four weeks, after having been consulted on 20 December 2023, the DPC did not revise the Draft Decision.
# **Applicable Law**
31. For the purposes of its examination and assessment of this complaint, the DPC has considered the following Articles of the GDPR:
8
An Coimisiún um Chosaint Sonraí
Data Protection Commission
- Article 5
- Article 6
- Article 12
- Article 13
- Article 17
# Analysis and Findings of Inquiry
# Issue A – Whether Airbnb had a lawful basis for requesting a copy of the Complainant’s I.D. in order to verify his identity at account creation stage
32. During the course of the Inquiry, Airbnb stated that it does not require new Airbnb users creating their accounts to provide I.D. documents as part of registering an account and that it would not have imposed this I.D. requirement in 2019 on the Complainant. It went on to state that it cannot relate any account to the Complainant and is therefore unable to specifically comment on the basis for a request for the Complainant’s I.D. documentation (if any) prior to his deletion request.
33. The DPC has closely examined the information supplied by the Complainant with this complaint. It appears from that evidence that a request for a photocopy of proof of identity was first made by Airbnb on 12 May, 2019 at 03:55 in a letter to the Complainant which began as follows: “We understand that you would like to exercise one of your rights under the General Data Protection Regulation (GDPR), namely the right of erasure……We kindly ask you to re-send your request and to attach a photocopy of your proof of identity.” A second communication was sent to the Complainant on 13 May, 2019 by Airbnb at 01:39 which stated as follows: “To provide us with a copy of your government ID, to verify your identity as the account holder, please log into your account within the next 3 days. Once we confirm a successful log in, we will be able to proceed.” From the evidence provided by the Complainant, the ID request made by Airbnb to the Complainant arose in the context of his erasure request only. No evidence has been provided to the DPC to show that a request for a copy of photographic ID was made by Airbnb at an earlier stage during the registration/account creation process – albeit that both the
9
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
registration process and the request for erasure were initiated by the Complainant within a short space of time between 11 and 12 May, 2019.
34. From the evidence supplied by the Complainant, the DPC is satisfied that Airbnb's request for a copy of photographic ID arose in this case in the context of the request for erasure. Therefore, in the absence of evidence that a copy of photographic ID was sought from the Complainant by Airbnb during the course of the account creation process, the DPC finds that Airbnb did not infringe the GDPR in relation to that specific matter.
Issue B - Whether Airbnb had a lawful basis for requesting a copy of the Complainant's ID in order to verify his identity so that he could delete his account
35. Article 5(1)(a) of GDPR states that personal data shall be "processed lawfully, fairly and in a transparent manner in relation to the data subject".
36. According to the documents supplied by the Complainant, on 12 May 2019 after submitting an erasure request to Airbnb on that date he received a reply stating, among other things, the following: "We understand that you would like to exercise one of your rights under the General Data Protection Regulation (GDPR), namely the right of erasure. As a data controller, Airbnb has to verify that the person making the request is, in fact, the data subject entitled to make it, We (sic) have implemented identification and verification procedures to ensure that we do not edit, delete or hand over personal information at the request of, or to a person impersonating a data subject. We kindly ask you to re-send us your request and to attach a photocopy of your proof of identity."
37. Airbnb advised the DPC that at the time the Complainant submitted his erasure request in May 2019 I.D. verification was the preferred method of authenticating deletion requests. Airbnb went on to confirm that his erasure request was authenticated by account login at some point between 12 May 2019 and 21 May 2019, after which point the Complainant's account was deleted.
38. Article 4(2) of the GDPR defines "processing" as "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage,
10
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
*adaption or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction*.
39. Article 6(1)(f) of the GDPR states that the processing of personal data shall be lawful only if and to the extent *“the processing is necessary for the purposes if legitimate interest pursued by the controller or by a third party, except where such interests are overridden by the interest of the fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”*.
40. The DPC notes that Airbnb has stated that where it requested I.D.s to authenticate deletion requests in the past, it relied on a variety of legitimate interests including its legitimate interests in verifying the authenticity of the request and the legitimate interests of account holders generally in ensuring their accounts were not deleted in illegitimate or otherwise inappropriate circumstances, in accordance with Article 6(1)(f) of the GDPR. While the DPC considers that a legitimate interest does exist for Airbnb to ensure that it does not delete personal data in an illegitimate or inappropriate circumstance, in this instance Airbnb has not demonstrated to this inquiry that the request for a copy of the Complainant’s ID was either necessary or proportionate for the completion of the erasure request as Airbnb was able to confirm his identity through other means – i.e. in this instance by account login.
41. Airbnb contended that it had fulfilled the Complainant’s erasure request without requiring I.D. documentation in this instance. It stated that in 2019, when the Complainant made his erasure request I.D. verification was the preferred method of authentication for erasure request given the probative value of I.D. verification and the safety and security issues relating to the nature of the Airbnb platform. This included the need to preserve accounts that may be necessary for travel abroad or which may support an important element of an individual’s livelihood. It continued that the corroborative value of requesting I.D. was not dependent or predicated on there being a pre-existing I.D. on a user’s account, and instead formed part of a holistic approach to identity verification, carried out with reference to the totality of information available to Airbnb.
42. Airbnb stated that given that it was and is necessary to design, implement and maintain robust safety and security measures, it believes that I.D. verification formed part of a necessary and proportionate suite of measures, which included alternative verification measures where appropriate, designed to protect the Airbnb
11
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
platform and community and all those associated with it. It further clarified that it no longer uses I.D. documents to authenticate deletion requests.
43. The DPC notes Airbnb's view that it fulfilled the Complainant's erasure request without requiring I.D. documentation in this instance. However, as outlined above, Airbnb sent a communication to the Complainant in response to his erasure request on 12 May 2019 that specifically asked him to re-send his request "and to attach a photocopy of your proof of identity." The DPC considers that Airbnb's request to the Complainant to provide a copy of his I.D. in order for him to exercise his rights pursuant to Article 17 of the GDPR constituted the collection of personal data. This was data processing as per the definition set out in Article 4(2) of the GDPR. In this case, the DPC does not consider that the legitimate interest pursued by the controller constitutes a valid lawful basis under Article 6 for that specific data processing activity.
44. The DPC finds that, in the specific circumstances of this complaint, the legitimate interest pursued by the controller does not constitute a valid lawful basis under Article 6 of the GDPR for seeking a copy of the Complainant's I.D. in order to process his erasure request.
**Issue C – Whether Airbnb complied with the principle of data minimisation when requesting a copy of the Complainant's ID in order to verify his account and when processing personal data relating to same.**
45. Article 5(1)(c) of the GDPR states "personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation")."
46. Article 12(6) of the GDPR states that "without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the requests referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject".
47. The DPC notes that Airbnb has advised that it was not in a position to comment on any reasonable doubts in existence at the time of the erasure request about the identity of the Complainant given that the underlying account has been deleted. The DPC considers that Airbnb has not sufficiently demonstrated to this inquiry
12
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
that it had reasonable doubts concerning the identity of the individual who had made the erasure request such as would have justified it seeking to confirm their identity by the provision of a copy of their I.D. In addition, the DPC does not consider that the request for I.D. was either necessary or proportionate in circumstances where a user has requested the erasure of their personal data, especially in circumstances where there were less data-driven solutions available to Airbnb to confirm the Complainant's identity. As such Airbnb has not demonstrated that it had a reasonable doubt as to the user's identity in accordance with Article 12(6).
48. The DPC is of the view that other methods were available to Airbnb in May 2019 when the Complainant made his erasure request that would have negated the need for Airbnb to request a copy of his ID. Airbnb has failed to provide evidence to this Inquiry to demonstrate that it first attempted to utilise other tools it already possessed, such as authentication through account login (the method subsequently used after the Complainant did not comply with the request to provide a copy of I.D.).
49. In the circumstances of this Complainant's case, the DPC is not satisfied that Airbnb gave adequate consideration to the principle of data minimisation when it sought a copy of the Complainant's I.D. on foot of his erasure request in May 2019.
50. The DPC finds, therefore, that in the particular situation that arose in this Complainant's case, Airbnb has not demonstrated that reasonable doubts existed concerning the Complainant's identity that would have necessitated the application of Article 12(6) of the GDPR.
51. Furthermore, the DPC finds that, in the specific circumstances of this complaint, the request by Airbnb that the Complainant verify his identity by way of submission of a copy of his I.D. constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR.
# Issue D: Whether Airbnb complied with principles of transparency and provision of information where the Complainant's personal data was collected
52. Article 13(1)(c) of the GDPR states "where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with the purposes of the processing for
13
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
which the personal data are intended as well as the legal basis for the processing” and Article 13(1)(d) of the GDPR states “where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with, where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party”.
53. In its response to the DPC dated 12 January 2023 Airbnb stated that it was unable to link the complaint to an Airbnb account. It continued that based on the information provided to it by the DPC, it appeared that the Complainant created an Airbnb account on 11 May 2019 and subsequently submitted a deletion request on 12 May 2019. Airbnb then provided a copy of the applicable terms of service and privacy policy that were in place at the time of the account creation and erasure request in 2019.
54. Section 2.4 of the Terms of Service 2019 states:-
“User verification on the internet is difficult and we do not assume any responsibility for the confirmation of any Member’s identity. Notwithstanding the above, for transparency and fraud prevention purposes, and as permitted by applicable laws, we may, but have no obligation to (i) ask Members to provide a form of government identification or other information or undertake additional checks designed to help verify the identities or backgrounds of Members, (ii) screen Members against third party databases or other sources and request reports from service providers, and (iii) where we have sufficient information to identify a Member, obtain reports from public records of criminal convictions or sex offender registrations or an equivalent version of background or registered sex offender checks in your local jurisdiction (if available).”
55. Section 2.3 of the Terms of Service 2019 states that “Airbnb may make access to and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform, subject to certain conditions or requirements, such as completing a verification process”.
56. Section 4.2 of the Terms of Service 2019 states that a person “can register an Airbnb Account using an email address and creating a password, or through your account, or through your account with certain third-party social networking services”.
57. Section 2.1.1 of Airbnb’s Privacy Policy 2019 states that “when a person signs up for an Airbnb Account, Airbnb requires certain information such as person’s first
14
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
name, last name, email address and date of birth, and that Airbnb may collect identity verification information, such as images of government issued ID, passport national ID card, or driving licence as permitted by applicable laws, or other authentication information, to help create and maintain a trusted environment."
58. Section 3.2 of Airbnb's Privacy Policy 2019 states that "Airbnb may use, store, and process personal information to create and maintain a trusted and safer environment, such as to detect and prevent fraud, security incidents and other harmful activity; to verify or authenticate information or identifications provided by a person; to verify the accommodation address; to compare the identifications photo to another photo the person provides; to conduct checks against databases and other information sources to the extent permitted by applicable laws and with a person's consent where required". Section 3.2 of Airbnb's Privacy Policy 2019 states that "Airbnb processes this personal information for these purposes given its legitimate interest in protecting the Airbnb Platform, to measure the adequate performance of its contract with the person, and to comply with applicable laws".
59. With respect to the above notices available on Airbnb's website in May 2019 when the Complainant was requested to provide a copy of his I.D. the DPC is of the view that the complainant was on notice that he may be required to verify his identity including by providing a copy of photographic ID.
60. Having reviewed Airbnb's privacy policies and terms of service that were in place in May 2019, the DPC is satisfied that there was sufficient information within those documents to inform members that Airbnb may seek a copy of photographic ID to verify identity.
61. In that regard, therefore, and in the circumstances of this Complainant's case, the DPC finds that Airbnb complied with the requirements set out in Article 13(1) of the GDPR with regard to the provision of information to the data subject.
# Decision on Infringements of the GDPR
62. Following the investigation of the complaint against Airbnb Ireland UC, the DPC is of the opinion that in the circumstances of this Complainant's case, Airbnb Ireland UC infringed the General Data Protection Regulation as follows:
15
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
- The DPC finds that, in the specific circumstances of this complaint, the legitimate interest pursued by the controller does not constitute a valid lawful basis under Article 6 of the GDPR for seeking a copy of the Complainant's I.D. in order to process his erasure request.
- The DPC finds that, in the specific circumstances of this complaint, the request by Airbnb that the Complainant verify his identity by way of submission of a copy of his I.D. constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR.
# Remedial measures undertaken by Airbnb Ireland UC
63. It is noted that Airbnb has confirmed that it has discontinued the practice of requesting a copy of I.D. in order to verify erasure requests.
64. The DPC also notes that in this particular case after the initial request by Airbnb for the Complainant to submit a copy of his proof of identity in order to have his erasure request processed, the Complainant's erasure request was authenticated through account login and his request was subsequently processed.
# Judicial remedies with respect to the decision of the DPC
65. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of receipt of notification of such decision. An appeal may also be taken by a data controller within 28 days of notification; under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under Section 142, against any imposition upon it of an administrative fine by the DPC.
16
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
### **Exercise of Corrective Power by the DPC**
66. In deciding on the corrective powers that are to be exercised in respect of the infringements of the GDPR outlined above, I have had due regard to the Commission's power to impose administrative fines pursuant to Section 141 of the 2018 Act. In particular, I have considered the criteria set out in Article 83(2) (a) – (k) of the GDPR. When imposing corrective powers, I am obliged to select the measures that are effective, proportionate and dissuasive in response to the particular infringements. The assessment of what is effective, proportionate and dissuasive must be made in the context of the objective pursued by the corrective measures, for example re-establishing compliance with the GDPR or punishing unlawful behaviour (or both)¹. I find that an administrative fine would not be necessary, proportionate or dissuasive in the particular circumstances in relation to the infringements of the Articles of the GDPR as set out above.
67. In light of the extent of the infringements identified above, the DPC hereby issues a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the GDPR.
[Note: In a Decision of the DPC in the case of IN-22-9-2 dated 28 September 2023, an order was made with regard to the revision of Airbnb's internal policies and procedures concerning the seeking of I.D. in the verification process for users of the Airbnb platform. The order in that Decision, when complied with by Airbnb, will prevent infringements of Articles 5(1)(c) occurring to data subjects in the future similar to those that occurred in this case. Accordingly, a further order is not now required in this Decision.
Signed:
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
¹ See the Article 29 Data Protection Working Party 'Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679, at page 11.
17
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
18