An Coimisiún um Chosaint Sonraí
Data Protection Commission
DPC Complaint Ref:
DPC Inquiry Ref:
Berlin DPA Ref:
Date: 14 September 2022
Complainant:
Data Controller: Airbnb Ireland UC
RE: V Airbnb Ireland UC
This document is a decision of the Data Protection Commission of Ireland ("DPC") in relation to DPC complaint reference, (hereinafter referred to as the ("Complaint"), submitted by ("Complainant") against Airbnb Ireland UC ("Airbnb"), which was referred to the Data Protection Commission of Ireland ("DPC"), in its capacity as lead supervisory authority, by the Berlin Commissioner for Data Protection and Freedom of Information ("Berlin DPA"), as the concerned supervisory authority with which the complaint was lodged.
This decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General Data Protection Regulation ("GDPR").
# Communication of draft decision to "supervisory authorities concerned"
In accordance with Article 60(3) of the GDPR, the DPC was obliged to communicate the relevant information and submit a draft decision, in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a draft decision in relation to the matter to the "supervisory authorities concerned". As Airbnb offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as LSA identified that each supervisory authority is a supervisory authority concerned as defined in Article 4(22) of the GDPR. On this
1
An Coimisiún um Chosaint Sonraí
Data Protection Commission
basis, the draft decision of the DPC in relation to this complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.
# Complaint Handling by the DPC – Timeline and Summary
1. The complaint was initially lodged with the Berlin DPA and thereafter transmitted to the DPC, on 06 March 2020, via the IMI to be handled by the DPC in its role as lead supervisory authority. The complainant alleged that Airbnb failed to properly respond to an erasure request submitted by them, via email on 17 August 2019, pursuant to Article 17 of the GDPR. Further, the complainant stated that when they submitted their request for erasure, Airbnb requested that they verify their identity by providing a photocopy of their identity document (“ID”), which they had not previously provided to Airbnb. The complainant refused to provide a copy of their ID and Airbnb then provided them with the option of logging into their account to verify their identity. Upon logging into their account to verify their identity, Airbnb advised the complainant that it had initiated their deletion request and would delete all data to the extent that GDPR permits or requires Airbnb to retain data. On 24 October 2019, Airbnb confirmed to the complainant that their personal data had been deleted pursuant to Airbnb’s obligations under the GDPR.
2. The complainant also alleged that they submitted an access request to Airbnb, via email on 02 September 2019, pursuant to Article 15 of the GDPR, to which they received no response.
3. The DPC notified Airbnb of the complaint by way of letter on 08 June 2020 and provided Airbnb with a copy of the complaint.
4. Airbnb reverted to the DPC confirming that the complainant's account had been deleted. Airbnb advised the DPC that the complainant had requested that their account be deleted and was asked by Airbnb to verify their identity by providing ID, in accordance with its identity verification procedures, further details of which it advised, are set out in its "Help Centre" article. Airbnb stated that the complainant raised concerns with providing a copy of their ID and so its community support agents verified the complainant's identity using an alternative verification method, namely having the complainant log in to their Airbnb account. Airbnb informed the DPC that, once their identity was verified, its agents notified the complainant that their deletion request was being processed and also that certain data may be retained:
“Airbnb will delete your personal data, except to the extent GDPR permits or requires us to retain that data. For example, we retain data that is necessary for
2
An Coimisiún um Chosaint Sonraí
Data Protection Commission
complying with laws to which we are subject, for exercising the right of freedom of expression and information (such as the content overviews [sic]), and for the establishment, exercise or defence of legal claims (such as Information relating to user disputes)"
5. In addition, Airbnb stated that it informed the complainant that they would not receive any further emails from Airbnb.
6. Airbnb advised the DPC that subsequent to this, the complainant emailed Airbnb on 24 October 2019 requesting access to their personal data retained post-deletion, contrary to the complainant's assertion they submitted their access request on 02 September 2019. Airbnb advised the DPC that, regretfully, the complainant's request was not escalated to the relevant team. Similarly, when the complainant emailed Airbnb's community support team on 08 November 2019, the agent did not link the request to any particular account as the complainant's account had already been deleted. Airbnb advised the DPC that it was investigating the cause of this oversight and would like to offer its apologies to the complainant for the inconvenience caused by this error.
7. Airbnb advised the DPC that it was, at that time, processing the complainant's access request post-deletion.
8. In an attempt to facilitate the amicable resolution of the complaint, the DPC reverted to the complainant advising them that the DPC had communicated with Airbnb on this matter. The DPC advised the complainant that Airbnb stated that their account, and associated personal data (including phone recordings), had been erased to the extent required by GDPR as they had verified their identity by way of logging in to their Airbnb account, and that no further personal data was provided for this purpose.
9. The DPC advised the complainant that, regarding their access request, which was made after the erasure of their account, Airbnb informed the DPC that this request would be processed and issued to them directly by email and that they should have now received this correspondence. The DPC informed the complainant that Airbnb had noted that this request was not initially processed as the account had already been erased and that Airbnb has apologised for this and provided the below explanation:
"emailed Airbnb on 24 October 2019 requesting access to her personal data retained post-deletion. Regretfully, this request was not escalated to the relevant team. Similarly, when emailed our community support team on 8 November 2019, the agent did not link the request to any particular account as s account
3
An Coimisiún um Chosaint Sonraí
Data Protection Commission
had already been deleted. We are investigating the cause of this oversight and would like to offer our apologies to [REDACTED] for the inconvenience caused by this error.”
10. The complainant reverted to the Berlin DPA on 25 November 2020 to advise that they were not satisfied and did not agree to the amicable resolution of their complaint.
# Conduct of Inquiry
11. Acting in its capacity as lead supervisory authority, the DPC commenced an Inquiry in relation to this matter by writing to Airbnb on 25 March 2021.
12. The DPC advised Airbnb that the Inquiry commenced by the Commencement Notice would seek to examine and assess whether or not Airbnb had complied with its obligations under the GDPR and the Act, in particular under Articles 5, 6, 15 and 17 of the GDPR in respect of the relevant processing operations which are the subject matter of the complaint.
13. The DPC advised Airbnb that the scope of the Inquiry concerned an examination and assessment of the following:
a) Whether Airbnb had a lawful basis for requesting a copy of the complainant’s I.D. in order to verify their identity in circumstances where they had submitted a request for erasure pursuant to Article 17;
b) An examination of whether Airbnb’s handling of the complainant’s erasure request was compliant with the GDPR and the Act; and
c) An examination of whether Airbnb’s handling of the complainant’s access request was compliant with the GDPR and the Act.
14. In order to progress the matter the DPC posed specific questions regarding the erasure request, the access request and the manner in which those requests were handled.
15. The DPC also informed the complainant via letter dated 25 March 2021, which was issued to the complainant via the Berlin DPA, that an Inquiry had commenced in relation their complaint. The DPC provided the complainant the opportunity to withdraw any information previously provided and asked whether the complainant had any new information they wished to submit regarding the complaint. The DPC
4
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
also requested that the complainant provide specific information regarding their requests to Airbnb.
16. Airbnb responded to the queries raised by the DPC in its Commencement Notice via email on 23 April 2021. In its response, Airbnb advised that its identity verification procedures are in place to protect the Airbnb platform and its users, in accordance with its obligations under the GDPR and in a manner that facilitates and safeguards the rights of data subjects under the GDPR. Airbnb stated that it diligently reviews its policies and procedures to ensure that they comply with all applicable laws, reflect best industry practice and are consistent with the ever-changing social, regulatory and technological landscape within which Airbnb operates. Airbnb noted that in the Commencement Notice the DPC requested comprehensive responses to various queries, to include supplemental documentation and input from third parties, if necessary, in relation to an Airbnb user account that had been deleted in 2019 following a deletion request made by the complainant. Airbnb stated that, while it had endeavoured to respond to the DPC in as comprehensive a manner as possible, difficulties arose in investigating certain of the underlying factual and contextual issues in a historical case such as this where the relevant account no longer exists. Simply put, because Airbnb deleted the complainant’s account at their request, its records were limited. Airbnb advised that the complaint relates to a deletion request that was authenticated and processed with minimal difficulties for the complainant, and a post-deletion access request that it had already acknowledged involved certain inadvertent shortcomings on Airbnb’s part but that Airbnb promptly addressed once drawn to its attention. Airbnb stated that it hoped that the efforts it had made to amicably resolve the complaint would be taken into consideration by the DPC during the course of the Inquiry.
17. Airbnb advised that when individuals register with Airbnb, they agree to its Terms of Service and are made aware of its Privacy Policy. Airbnb stated that the relevant aspects of these documents for the purposes of the complaint and the Inquiry are broadly in line with those documents in place when the complainant created their account in January 2018. Airbnb advised that as stated in sections 16 and 17 of the Terms of Service, Airbnb retains the right to verify its users and the information provided by its users. Airbnb stated that section 17 of its Terms of Service states that Airbnb may “ask you to provide identification or other information” and “undertake checks designed to help verify your identity or background”. Airbnb advised that section 2.1 of its Privacy Policy states that certain information is required from users, including:
“Identity Verification and Payment Information. Such as images of your government issued ID (as permitted by applicable laws), your ID number or other verification information, bank account or payment account information”
5
An Coimisiún um Chosaint Sonraí
Data Protection Commission
18. In addition, Airbnb stated that section 5 of its supplemental Privacy Policy directs individuals to its dedicated data subject rights Help Centre page and informs individuals that “we may ask you to verify your identity and request before taking further action on your request”. Airbnb advised that its identity verification procedures are carried out in accordance with the legitimate interests of safeguarding the Airbnb platform and its users, including safeguarding against the wrongful deletion of an Airbnb account, in accordance with Article 5(1)(f) and Article 6(1)(f) of the GDPR. Airbnb advised that user accounts are an important resource for users for a variety of reasons, including financial reasons such as income / livelihood and reasons relating to the safety and wellbeing of users, for example users relying on their accounts during their travels abroad. Airbnb asserted that, because of the harm that can be caused by processing an illegitimate or otherwise invalid deletion request, both to the account holder in question and potentially the wider Airbnb community, at the time the complainant submitted their deletion request its position was that Airbnb was required to authenticate a user’s identity on receipt of a request for erasure by using specific authentication methods. Airbnb stated that it believed that authenticating a user’s identity through these methods was and is a reasonable and pragmatic approach to both protecting and facilitating the rights of the individual purporting to make the deletion request, while also balancing the interests of the account holder against fraudulent deletion requests and protecting the Airbnb community at large. Airbnb advised that these are not mere theoretical considerations; research has shown that hackers can exploit GDPR requests to do harm.¹ Airbnb advised that it has since revised its processes and its approach to the authentication of deletion requests that are submitted through a privacy tool on the platform so that methods such as two-factor authentication are the principal means of authentication.
19. Airbnb stated that providing an online platform such as Airbnb carries with it attendant risks such as fraudulent activity engaged in by bad actors, who often use sophisticated methods to attempt to deceive and defraud Airbnb and its users. Airbnb stated that the myriad of risks associated with identifying users on an online platform such as Airbnb, including the prevalence of bad actors and nefarious activity online, justifies the exercise of diligence, due care and caution when dealing with the important rights associated with a user’s account and the adverse effects that might result from the wrongful deletion of an account.
20. Airbnb advised that providing a copy of an ID document to authenticate a deletion request constitutes a reliable form of proof of identity and a secure authentication method that does not impose a disproportionate burden on the individual making the request, considering the nature of the request and the risks involved. Airbnb stated that accounts are associated with a named and identified person, and that
¹ Pavur and Knerr, ‘GDPRrrrrr: Using Privacy Laws to Steal Identities’, Blackhat USA 2019 Whitepaper.
6
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
a request that a person seeking to delete that account produces ID to confirm that they are the account holder in question is a valid and proportionate step. Airbnb stated that its approach is similar to that adopted by numerous other businesses, such as airlines and international hotels, who request ID because it is a straightforward way to confirm that a given individual is in fact their customer, even if they do not compare the ID to a file copy. Airbnb asserted that ID verification can be considered to be an evidential bridge between online and offline identity and a method of establishing that the individual behind the online presence is indeed the individual that he or she claims to be. Airbnb advised that it is important to recall that the fraudulent deletion of an Airbnb account can lead to significant real-world harm including, in the case of hosts, the economic harm through cancelled bookings and loss of the goodwill built up in the account and, in the case of guests, the potential loss of accommodation while travelling abroad. Airbnb opined that these are not trivial risks and appropriate steps must be taken to address them.
21. In terms of the probative value of ID documentation, Airbnb stated that government-issued ID documentation is less likely to be illegitimately obtained or accurately reproduced by counterfeit means and used for ulterior motives than information such as login credentials, which are more susceptible to access / exposure risks and third party manipulation and misuse, for example misappropriation online. Airbnb advised that the possession of an ID document that can be attributed to the Airbnb account holder in question is a concrete basis on which to conclude that the end-user is the account holder. As stated above, Airbnb opined that this “best evidence” view is shared by a large number of established, international organisations and businesses operating across a wide variety of industries and commercial sectors. Airbnb stated that it is also the case that in some instances, a number of individuals may have access to an account created under one individual’s name, for example a couple who share a listed property and both manage the named host’s account. Airbnb stated that, in these circumstances, it needs to make sure that the named account holder is exercising the right to erasure and not another individual who has access to the account in question. Airbnb advised that, in the context of authenticating erasure requests, it requests a copy of an ID document only for authentication purposes.
22. Airbnb asserted that, notwithstanding the complainant’s assertions, its records indicate that the complainant uploaded a copy of an ID document to the platform in February 2018, shortly after joining the platform. Airbnb stated that it is necessary for Airbnb to design, implement and maintain robust safety and security measures, in compliance with its obligations under the GDPR. Airbnb advised that where a user is unwilling or unable to provide an ID document for authentication purposes, Airbnb will engage with that user in an attempt to verify his or her identity by other means. In addition, Airbnb advised that it has implemented a privacy tool on the platform (the “manage your data” feature) that allows users to submit
7
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
deletion requests via their account in a manner that utilises two-factor authentication as an alternative to ID verification.
23. With regard to the DPC’s query that Airbnb outline the reasonable doubts, if any, that it had concerning the complainant’s identity such that Airbnb considered it necessary to request a copy of the complainant’s ID, Airbnb advised that complainant’s account had been deleted. Airbnb advised that the deletion of the complainant’s account rendered it very difficult and in some instances impossible for Airbnb to comment on the specifics of the complaint that is the subject matter of the Inquiry. Airbnb advised that it was therefore not in a position to provide any further information on any specific doubts held by Airbnb at that time about the identity of the complainant.
24. Regarding the DPC’s query as to circumstances where Airbnb provides a user with other methods by which to verify their identity (i.e. sign into their account), and why a user is not offered this method to verify their identity in the first instance, Airbnb advised that at the time the complainant submitted their deletion request Airbnb’s position was that Airbnb had other preferred methods of authentication. Airbnb stated that if a user raises concerns and is unwilling or unable to provide a copy of his or her ID to authenticate a deletion request, Airbnb will engage with that user in an attempt to verify his or her identity by other means. Airbnb advised that this practice is carried out on a case-by-case basis, depending on the facts involved. Airbnb advised that it has implemented a privacy tool on the platform (the “manage your data” feature) that allows users to submit deletion requests via their account in a manner that utilises two-factor authentication as an alternative to ID verification. Further, Airbnb advised that, in circumstances where a user does provide a copy of their ID in order to verify their identity, the ID documentation provided to authenticate a deletion request is deleted as part of the deletion process.
25. Airbnb advised that ID verification is still used by Airbnb, however Airbnb has introduced an additional authentication method to broaden its suite of deletion request authentication methods. Airbnb stated that users who are logged in to their Airbnb accounts can submit deletion requests through the “manage your data”$^{2}$ feature on the platform. Airbnb advised that for requests submitted via the “manage your data” tool, users are asked to authenticate their request by inputting a verification code sent to the users by phone (text message or call) or email, depending on the relevant user’s account details and preference settings. Airbnb advised that where a deletion request is made by email, the individual is directed to the “manage your data” portal. However, Airbnb clarified that this tool was launched after the complainant submitted their erasure request.
$^{2}$ Further information in relation to this tool is contained in Airbnb’s dedicated data subject rights Help Centre page.
8
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
26. With regard to its response to the complainant’s erasure request, Airbnb advised that a review of the documentation provided with the complaint by the DPC in June 2020 indicates that the erasure request was received by Airbnb on 17 August 2019. Airbnb noted that the documentation provided with the complaint by the DPC contained a copy of an email from Airbnb to the complainant dated 17 August 2019, confirming receipt of the deletion request and setting out the required authentication steps for the complainant. Airbnb stated that the request was ultimately authenticated by the complainant on 2 September 2019 (and provided the below screenshot of the relevant extract from its records).
*Figure 1 - Screenshot of relevant extract of Airbnb’s records*
27. With regard to the DPC’s request for clarification as to the date the complainant’s erasure request was completed and all data was deleted, Airbnb advised that the deletion of an Airbnb account is a highly technical process that involves a number of stages / phases. Airbnb advised that the length of time it takes to delete an account in its entirety is dependent on a number of variables, including the volume and nature of the data on the account as well as confirmations from various internal teams that certain additional data is not required to be held for legal or regulatory reasons. Airbnb stated that it informed the complainant of this fact:
*“Please note that the deletion process itself happens over a period of time across our systems. We are not able to confirm the exact date on which the deletion process for any given request completes”*
28. Airbnb stated that, in the context of the complaint, Airbnb could not confirm from its records when the deletion process was completed. Airbnb stated that separate deletion processes are in place for phone call recordings, which are automatically deleted on a cyclical basis, unless Airbnb is required to retain these recordings for specific reasons. Airbnb advised that, as confirmed by Airbnb in its response to the DPC dated 22 June 2020 in respect of the underlying complaint, all phone recordings in respect of the complainant had been deleted by that point in time.
9
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
29. With regard to the complainant’s access request, Airbnb advised that a review of the documentation provided with the complaint by the DPC in June 2020 indicated that the complainant’s access request was received by Airbnb on 24 October 2019. Airbnb noted that the documentation provided with the complaint by the DPC contains a copy of the request from the complainant to Airbnb dated 24 October 2019. Further, Airbnb stated that a review of the documentation provided with the complaint by the DPC in June 2020 indicated that one of Airbnb’s agents responded to the complainant on 24 October 2019 but mishandled / misinterpreted the complainant’s request. Airbnb noted that the documentation provided with the complaint by the DPC contained a copy of this response dated 24 October 2019. Airbnb advised that these issues were outlined in its response to the DPC dated 22 June 2020 in respect of the complaint handling process, with the relevant extracts set out below for ease of reference:
“Subsequently, [REDACTED] emailed Airbnb on 24 October 2019 requesting access to her personal data retained post-deletion. Regretfully, this request was not escalated to the relevant team. Similarly, when [REDACTED] emailed our community support team on 8 November 2019, the agent did not link the request to any particular account as [REDACTED]’s account had already been deleted. We are investigating the cause of this oversight and would like to offer our apologies to [REDACTED] for the inconvenience caused by this error. As stated above, we are processing [REDACTED]’s access post-deletion request now and will send it to her by email at [REDACTED]”
30. Airbnb stated that it provided the complainant with the post-deletion access file on 17 July 2020. However, as the account had been deleted, Airbnb’s investigations into the issues that resulted in the mishandling of the post-deletion access request have not yielded further insight into what transpired.
31. The DPC received a response from the complainant via the Berlin DPA on 19 July 2021. In their response, the complainant confirmed that they were agreeable to all information that they had previously provided in the context of the complaint handling process being used for the purposes of the Inquiry. In their correspondence the complainant informed that DPC that they did not provide a copy of their ID to Airbnb for identification purposes. The complainant also provided a number of correspondence they had exchanged with Airbnb.
32. The DPC reverted to Airbnb via email on 24 January 2022. The DPC advised Airbnb that, in addition to the issues previously notified to Airbnb in its Commencement Notice, the following issue was also deemed to form part of the Inquiry under, and in accordance with, Section 110(1) of the Data Protection Act, 2018:
10
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
d) Whether Airbnb has complied with its obligations in accordance with Article 12 of the GDPR with respect to its handling of the complainant's erasure request and access request.
The DPC also posed a number of queries relating to the issues outlined in the Scope of the Inquiry.
33. Airbnb responded via letter dated 07 February 2022. With regard to the DPC's request for a copy of Airbnb's Terms of Service, Privacy Policy and supplemental Privacy Policy that were in place in January 2018 when the complainant created their account where it notified the complainant that Airbnb required that users provide a copy of the government issued ID in order to verify their identity, Airbnb provided the DPC with copies of the Terms of Service and Privacy policy that were in place in January 2018.
34. Airbnb advised that Section 2 of its Terms of Service describes Airbnb's identity verification practices and that Section 2.3 states that "Airbnb may make the access to and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform, subject to certain conditions or requirements, such as completing a verification process". Further, Airbnb advised that Section 2.4 of its Terms of Service informs users that Airbnb may "ask Members to provide a form of government identification or other information or undertake additional checks designed to help verify the identities or backgrounds of Members".
35. Airbnb stated that its Privacy Policy also contained a number of disclosures around identity verification, such as Section 1.1 which states "Other Authentication-Related Information. To help create and maintain a trusted environment, we may collect identification (like a photo of your government-issued ID) or other authentication information. To learn more, see our Help Center [sic] article about providing identification on Airbnb". Further, Airbnb advised that Section 2.2 of its Privacy Policy describes practices deployed to "Create and Maintain a Trusted and Safer Environment", including steps to "Verify or authenticate information or identifications provided by you". Airbnb stated that these disclosures form part of a series of disclosures, throughout the various iterations of its Terms and Privacy Policies, which inform users about identity verification.
36. In response to the DPC's request that Airbnb clarify how its records indicate that the complainant had previously uploaded a copy of their ID document shortly after joining the platform, Airbnb provided the DPC with a redacted extract of the post-deletion access file. Airbnb advised that the redacted extract contains a log entry (Figure 2 below) - originally included at row 73 in the Security Data tab of the access file - which indicates that a government ID was uploaded to the
11
An Coimisiún um Chosaint Sonraí
Data Protection Commission
Complainant's logged-in account on 17 February 2018. [On foot of the complainant's erasure request, Airbnb erased the complainant's data and therefore cannot confirm what type of Government ID was provided at the time and can only provide a log to evidence that ID was provided]. On the basis that other elements of the log, such as the IP address associated with the upload of the ID, are aligned with the logs of other activities associated with the Complainant's account, Airbnb advised that it was confident that this log evidences the fact that the Complainant uploaded a government ID.
Figure 2 - Copy of log which Airbnb states demonstrates that the complainant had previously provided a copy of ID
37. Airbnb advised the DPC that when it receives a deletion request, it first seeks to authenticate the data subject's identity. Airbnb advised that after the data subject has successfully authenticated his or her identity, it engages an internal tool that triggers and orchestrates deletion across its systems. Airbnb advised that, in general, a user's Airbnb account is substantively deleted within one month from the tool being engaged, with residual personal data deleted from its back-end systems as soon as possible and in any event within 90 days from the tool being engaged. Further, Airbnb confirmed that the schedule of the information provided to the complainant in response to their "post erasure access request" is the personal data Airbnb has retained following the complainant's erasure request.
38. With regard to the complainant's erasure request, Airbnb advised that it engaged with the complainant on the same date it received the complainant's erasure request, 17 August 2019, in order to authenticate their request. Airbnb advised that it continued to engage with them until the request was authenticated on 02 September 2019 and, on the same day, responded to the complainant to confirm that it was taking action on the complainant's erasure request.
39. With regard to the complainant's access request, Airbnb again advised that unfortunately it was mishandled. Airbnb advised that when the complainant emailed Airbnb on 24 October 2019 requesting access to their personal data, it was not escalated to the relevant team. Airbnb advised that the complainant's access request was ultimately processed as part of the attempted resolution of the complaint on 17 July 2020.
12
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
### **Notification of the Preliminary Draft Decision to Airbnb**
40. The DPC provided a copy of the preliminary draft decision to Airbnb on 13 April 2022 and requested that Airbnb provide submissions in relation to the content of the preliminary draft decision by close of business on 11 May 2022.
41. Via email on 29 April 2022, Airbnb requested to extend the deadline for submissions on the content of the preliminary draft decision to 25 May 2022. The DPC advised Airbnb, via email on 03 May 2022, that it was willing to extend the deadline for submissions on the content of the preliminary draft decision until the close of business on 20 May 2022.
42. Airbnb responded to the DPC via email on 20 May 2022. In its correspondence, Airbnb summarised that its identity verification policies and procedures are designed and implemented to protect the Airbnb platform and its users, in accordance with its obligations under the GDPR and in a manner that facilitates and safeguards the rights of data subjects. Airbnb stated that it diligently reviews its policies and procedures to ensure that they comply with all applicable laws, reflect best industry practice and are consistent with the ever-changing social, regulatory and technological landscape within which it operates. Airbnb informed the DPC that, at the time the complainant submitted their deletion request, ID verification represented the preferred first-line method of authentication, for specific safety and security reasons relating to the nature of the Airbnb platform. However, Airbnb advised that in accordance with its commitment to updating its practices in alignment with best practice and regulatory expectations in the data protection space, Airbnb has since revised its practices so that its “manage your data” tool, and its use of two-factor authentication instead of ID authentication, is the primary method of authenticating deletion requests [REDACTED].
43. With regard to the DPC’s description that the practice of requesting ID for authentication purposes constitutes “collection” within the meaning of the definition of “processing” contained at Article 4(2) of the GDPR, Airbnb made the following submission. Airbnb outlined that in the European Data Protection Board (“EDPB”) guidelines on the concepts of controller and $^{3}$processor (the “Guidelines”), the EDPB emphasises the following aspect of the definition of “processing”: “*any operation or set of operations which is performed on personal data or on sets of*
$^{3}$ Guidelines 07/2020 on the concepts of controller and processor in the GDPR, adopted on 7 July 2021.
13
An Coimisiún um Chosaint Sonraí
Data Protection Commission
personal data".⁴ Airbnb stated that in the earlier version of the Guidelines⁵, the EDPB included the following description of “processing”:
“[i]n Article 4(2), processing is defined as a concept including a wide array of operations ranging from collection, storage and consultation to use, dissemination or otherwise making available and destruction. In practice, this means that all imaginable handling of personal data constitutes processing”⁶
Airbnb stated that this demonstrates that Article 4(2) requires that the operation or set of operations be “performed on” personal data and, in the earlier version of the Guidelines, the EDPB outlined the need for this to involve actual “handling” of personal data.
44. Further, Airbnb stated that the Spanish supervisory authority, La Agencia Española de Protección de Datos (“AEPD”), has published guidelines for data protection by default⁷ in which the AEPD considers the examples of activities which fall within the concept of “processing” under Article 4(2) of the GDPR⁸. Airbnb stated that the AEPD examines the simplified example of activities relating to personnel selection and concludes that, while the receipt of a CV can be considered “collection” - and therefore processing - of personal data, the publication of a vacancy is not considered to constitute processing. Airbnb asserted that, for the purposes of this decision, the publication of a vacancy can be viewed as analogous to the request for ID, and the receipt of the CV can be treated as analogous to the receipt of the ID, with the effect that, in the present case, the processing cannot have taken place in circumstances where no ID was received by Airbnb.
45. Airbnb advised that, in the EDPB Twitter decision⁹, the EDPB traced the DPC’s rationale for not reprimanding Twitter for certain ancillary activities relating to a data breach, which it stated are relevant for present purposes. Airbnb provided the following extract from paragraph 139 of this decision:
“In its Draft Decision, the [DPC] explained its decision not to issue a reprimand by recalling the argument put forward by TIC in its submissions in relation to the Preliminary Draft Decision, contending that the infringements of Article 33(1) and
⁴ See paragraph 42 of the Guidelines.
⁵ Guidelines 07/2020 on the concepts of controller and processor in the GDPR, adopted on 2 September 2020 (the “Original Guidelines”).
⁶ See paragraph 77 of the Original Guidelines.
⁷ https://www.aepd.es/sites/default/files/2020-10/guia-proteccion-datos-por-defecto-en.pdf
⁸ Page 10 of the AEPD guidelines.
⁹ EDPB - Decision 01/2020 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding Twitter International Company under Article 65(1)(a) GDPR, adopted on 9 November 2020.
14
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
Article 33(5) GDPR do not comprise “processing operations”, while Article 58(2)(b) GDPR provides supervisory authorities with the power to issue reprimands where processing operations have infringed provisions of the GDPR. The [DPC] considered that the term ‘processing operation(s)’ appears 50 times in the GDPR and seems to be used to denote the treatment or use of, in other words things that are done to, personal data controlled by a controller, but that at the same time the definition of “processing” provided by the GDPR is very broad, which makes it arguable that given that a breach is something affecting or done to, personal data, it follows that the notification obligation (insofar as it inherently must entail an examination of what has happened to personal data or how it has been affected) is intrinsically connected to one or more processing operations. The [DPC] did not consider it necessary to definitely conclude on the meaning and effect of the term “processing operations” in the Draft Decision, but “on balance” considered that TIC’s legal argument was “a stateable one”, deciding not to proceed with the issuing of a reprimand to TIC”
46. Airbnb stated that the basis for the DPC’s conclusion that a request for ID constituted “processing” within the meaning of Article 4(2) of the GDPR is unclear and it does not appear to align with the common understanding of the concept, which requires receipt of or access to personal data. Airbnb stated that in the present case, although ID was requested from the complainant, it was ultimately never provided, with the effect that the impugned processing never in fact occurred.
47. In light of the above, Airbnb submitted that the request for ID from the complainant, in order to authenticate their deletion request, cannot reasonably be considered to constitute “processing” within the meaning of Article 4(2) of the GDPR and, therefore, that any corresponding finding of infringement cannot be maintained on the facts.
48. The DPC has carefully considered Airbnb’s submissions in making this decision.
### **Notification of the Preliminary Draft Decision to the Complainant**
49. The DPC provided the complainant with a copy of the preliminary draft decision, via the Berlin DPA on 13 May 2022. In its letter the DPC requested that the complainant provide their submissions in relation to the preliminary draft decision within 2 weeks of the date of receipt of the letter following its provision by the Berlin DPA.
50. The DPC followed up with the Berlin DPA, via the IMI, on 23 May 2022 requesting that it confirm the date the correspondence provided by the DPC on 13 May 2022 had issued to the complainant.
15
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
51. The Berlin DPA responded to the DPC, via the IMI, on 27 May 2022 advising that it was still in the process of translating the preliminary draft decision files and would inform the DPC once all documents have been sent to the complainant. The Berlin DPA advised that it was confident that it would do so by 13 June 2022.
52. The Berlin DPA provided a further response on 09 June 2022, advising the DPC that due to the high workload of the office, it had not yet provided the complainant with the correspondence and preliminary draft decision sent by the DPC on 13 May 2022.
53. The DPC issued correspondence to the Berlin DPA on 28 June 2022 advising the Berlin DPA that, as advised in the cover letter provided to the Berlin DPA on 13 May 2022, the DPC provided the complainant with a specific timeframe of two weeks after the letter had issued to make submissions on the content of the preliminary draft decision, prior to the draft decision being submitted to the Article 60 procedure. The DPC also advised that, in the cover letter provided to the complainant, the DPC outlined that if it did not hear from the complainant within this timeframe, the DPC would proceed to finalising the draft decision and would provide it to the Concerned Supervisory Authorities (“CSAs”) in accordance with Article 60 of the GDPR. The DPC advised that as of the date of its correspondence, it had not yet received any submissions from the data subject on the content of the preliminary draft decision. The DPC advised the Berlin DPA that, as over 6 weeks had now passed since the cover letter and preliminary draft decision was provided to the Berlin DPA, the DPC now planned to finalise and circulate the draft decision to the CSAs in accordance with Article 60 of the GDPR on or after 08 July 2022.
54. The DPC received no response to its correspondence to the Berlin DPA.
### Relevant and Reasoned Objections and Comments from “supervisory authorities concerned”
55. Having transmitted the draft decision on 20 July 2022 to the “supervisory authorities concerned” in accordance with Article 60(3) of the GDPR, the DPC did not subsequently receive any relevant or reasoned objections under Article 60(4). Comments, which were not expressed as formal objections, in relation to the draft decision were received from the Berlin Commissioner for Data Protection and Freedom of Information (the “**Berlin DPA**”) and from Autoriteit Persoonsgegevens (the “**Dutch DPA**”).
16
An Coimisiún um Chosaint Sonraí
Data Protection Commission
56. The DPC gave careful consideration to the comments of the Berlin and Dutch DPAs. However, the DPC did not consider that it was necessary to revise the draft decision in light of those comments.
# **Applicable Law**
57. For the purposes of its examination and assessment of this complaint, the DPC has considered the following Articles of the GDPR:
- Article 5
- Article 6
- Article 12
- Article 15
- Article 17
# **Findings of Inquiry**
**Issue A - The complainant's allegation that Airbnb did not have a lawful basis for requesting a copy of their ID in order to verify their identity in circumstances where they had submitted a request for erasure pursuant to Article 17;**
58. Article 5(1)(a) of the GDPR states that personal data shall be "processed lawfully, fairly and in a transparent manner in relation to the data subject."
59. Airbnb advised that its identity verification procedures are in place to protect the Airbnb platform and its users, in accordance with its obligations under the GDPR and in a manner that facilitates and safeguards the rights of data subjects under the GDPR. Airbnb advised that when individuals register with Airbnb, they agree to its Terms of Service and are made aware of its Privacy Policy. Airbnb advised that, as stated in sections 16 and 17 of the Terms of Service, Airbnb retains the right to verify its users and the information provided by its users. Airbnb stated that section 17 of its Terms of Service states that Airbnb may "ask you to provide identification or other information" and "undertake checks designed to help verify your identity or background". However, in the copy of the Terms of Service (marked "Last Updated: June 19, 2017") that were in place at the time the complainant created their Airbnb account (and provided to the DPC inquiry by Airbnb), there is no such reference in section 16 or 17 to the possibility that Airbnb may request that a user provide identification for the purposes of background checks.
60. Section 2.3 of the Terms of Service provided by Airbnb, (that Airbnb advised were in place at the time when the complainant created their account), states that
17
An Coimisiún um Chosaint Sonraí
Data Protection Commission
"Airbnb may make the access to and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform, subject to certain conditions or requirements, such as completing a verification process, meeting specific quality or eligibility criteria, meeting Ratings or Reviews thresholds, or booking and cancellation history." Further, section 2.4 of the Terms of Service states that "User verification on the Internet is difficult and we do not assume any responsibility for the confirmation of any Member's identity. Notwithstanding the above, for transparency and fraud prevention purposes, and as permitted by applicable laws, we may, but have no obligation to (i) ask Members to provide a form of government identification or other information or undertake additional checks designed to help verify the identities or backgrounds of Members, (ii) screen Members against third party databases or other sources and request reports from service providers, and (iii) where we have sufficient information to identify a Member, obtain reports from public records of criminal convictions or sex offender registrations or an equivalent version of background or registered sex offender checks in your local jurisdiction (if available)."
61. Airbnb advised that section 2.1 of its Privacy Policy states that certain information is required from users, including: "Identity Verification and Payment Information. Such as images of your government issued ID (as permitted by applicable laws), your ID number or other verification information, bank account or payment account information". Further, Airbnb stated that section 5 of its supplemental Privacy Policy directs individuals to its dedicated data subject rights Help Centre page and informs individuals that "we may ask you to verify your identity and request before taking further action on your request". However, in the copy of the Privacy Policy (marked "Last Updated: June 19, 2017") that was in place at the time the complainant created their Airbnb account (and provided to the DPC inquiry by Airbnb), there is no reference in section 2.1 to the fact that Airbnb required that a user provide ID for the purposes of identity verification.
62. Section 1.1 of the Privacy Policy provided by Airbnb, (that Airbnb advised was in place at the time the complainant created their account), states that "To use certain features within the Airbnb Platform, we may also ask you to complete a profile, which may include your address, phone number, and gender. Certain parts of your profile (like your profile picture, first name, and description) are a part of your public profile page, and will be publicly visible to others.
- Other Authentication-Related Information. To help create and maintain a trusted environment, we may collect identification (like a photo of your government-issued ID) or other authentication information."
With respect to the above notices available on Airbnb's website at the time the complainant created their account, the DPC is of the view that the complainant was on notice that they may be required to verify their identity. However, the DPC is of
18
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
the view that the above notices did not inform users that the provision of a copy of ID was a mandatory requirement for the purposes of verifying their identity.
63. Article 4(2) of the GDPR defines “processing” as “any operation or set of operations which performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.”.
64. Article 5(1)(c) of the GDPR states that “Personal data shall be adequate, relevant and limited to what is necessary in relation to the specific purposes for which they are processed.”. Article 6(1)(f) of the GDPR states that the processing of personal data shall be lawful only if and to the extent the “processing is necessary for the purposes of the legitimate interest pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”. Further, Article 12(6) of the GDPR states that, “Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.”
65. The DPC notes that Airbnb has stated in its submissions on the preliminary draft decision that the request for a copy of ID cannot be considered to be “processing” as defined under Article 4(2) of the GDPR in circumstances where no ID was provided by the data subject in response to Airbnb’s request. The DPC disagrees with Airbnb on this point. The DPC considers that making the provision of photographic ID a mandatory requirement in order for the data subject in this case to exercise their rights pursuant to Article 17 of the GDPR constituted the collection of personal data. This is “processing” as per the definition set out in Article 4(2) of the GDPR.
66. The DPC notes that Airbnb has claimed legitimate interest pursued by the controller as the lawful basis for requesting a copy of ID in order to verify a user’s identity to safeguard against the wrongful deletion of an Airbnb account in accordance with Article 5(1)(f) and Article 6(1)(f) of the GDPR. While the DPC considers that a legitimate interest exists in Airbnb ensuring it does not wrongfully delete a user’s account, in this instance Airbnb has not sufficiently demonstrated to this inquiry that the request for a copy of an individual’s photographic ID was either necessary or proportionate in circumstances where Airbnb required the complainant to submit a copy of a photographic ID in order to process their erasure request even though Airbnb was able to provide other methods to the complainant to verify their identity. The DPC is of the view that other solutions were available to Airbnb at the time that would not have necessitated the seeking of photographic
19
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
ID. No evidence has been presented to this inquiry to demonstrate that Airbnb first attempted to use the tools that were already in its possession, such as allowing the complainant to verify their identity by logging in to their account [as Airbnb subsequently did when the data subject refused to provide a copy of their ID].
67. The DPC notes that the complainant was subsequently able to verify their identity to Airbnb without the need to provide ID [by logging into their account], after they had first refused to provide a copy of their ID. However, the DPC considers that making the provision of photographic ID a mandatory requirement in order for the data subject in this case to exercise their rights pursuant to Article 17 of the GDPR constituted the collection of personal data. This was data processing as per the definition set out in Article 4(2) of the GDPR. In this case, the DPC does not consider that the legitimate interest pursued by the controller constitutes a valid lawful basis under Article 6 for that specific data processing activity.
68. While I note that Airbnb advised that it was not in a position to provide any further information on any specific doubts held by Airbnb at that time about the identity of the complainant as the account had been deleted, the DPC considers that Airbnb has not sufficiently demonstrated to this inquiry that it had reasonable doubts in this case as to the complainant's identity such as would have justified it requesting the provision of additional information to confirm their identity in the form of photographic ID. Further, the DPC does not consider that the request for ID was either necessary or proportionate in circumstances where a user has requested the erasure of their personal data, especially in circumstances where there were less data-driven options available to Airbnb to confirm the complainant's identity. As such Airbnb has not demonstrated it had a reasonable doubt as to the user's identity in accordance with Article 12(6).
69. The DPC finds that Airbnb's requirement that the complainant verify their identity by way of submission of a copy of their photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR. This infringement occurred in circumstances where less data-driven solutions to the question of identity verification were available to Airbnb.
70. The DPC finds that Airbnb has not demonstrated that reasonable doubts existed concerning the complainant's identity that would have necessitated the application of Article 12(6) of the GDPR.
71. The DPC finds that, in the specific circumstances of this complaint, the legitimate interest pursued by the controller does not constitute a valid lawful basis under Article 6 of the GDPR for seeking a copy of the complainant's photographic ID in order to process their erasure request.
20
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# **Issue B - Whether Airbnb's handling of the complainant's erasure request was compliant with the GDPR and the Act**
72. The data subject also complained about Airbnb's handling of their erasure request. The complainant asserted that Airbnb had failed to properly comply with an erasure request submitted by them to it. The complainant asserted that Airbnb had not responded to their request within the statutory period.
73. In accordance with Article 17 of the GDPR, a data subject is entitled "to obtain the erasure of personal data concerning him or her from a data controller without undue delay".
74. The DPC notes that the complainant made a valid erasure request pursuant to Article 17 of the GDPR to Airbnb on 17 August 2019. Airbnb responded to the complainant via email on 17 August 2019 advising that it required the complainant to verify their identity in order to progress their erasure request. When the complainant refused to provide a copy of their ID, Airbnb provided an alternative method for the complainant to verify their identity by logging into their Airbnb account. The complainant's identity was verified via account log in on 02 September 2019, on which date Airbnb commenced the erasure of the complainant's personal data. Airbnb confirmed via email on 24 October 2019 that it had deleted the complainant's personal data.
75. On the basis that Airbnb, on receipt of the complainant's erasure request, immediately responded to the complainant and requested that they verify their identity, and when the complainant refused to provide a copy of their ID, provided other means by which the complainant could verify their identity and actioned the erasure request on the day the complainant's identity was verified, the DPC considers that there was no undue delay in responding to the complainant's erasure request.
76. **Based on the facts and analysis outlined above, the DPC finds that Airbnb did not infringe Article 17(1) of the GDPR, as there was no undue delay in handling the complainant's request for erasure.**
21
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
# **Issue C - Whether Airbnb's handling of the complainant's access request was compliant with the GDPR and the Act.**
77. The data subject also complained about Airbnb’s handling of their access request. The complainant asserted that Airbnb had failed to properly comply with an access request submitted by them to it. The complainant asserted that Airbnb had not responded to their request within the statutory period.
78. The complainant asserted to the DPC that they submitted a request for access to their personal data to Airbnb via email on 02 September 2019. The DPC has examined the English translation (provided to it by the Berlin DPA) of the data subject’s emails to Airbnb dated 02 September 2019 and 24 October 2019. The translated version of the data subject’s email of 02 September 2019, is as follows:
*“Hello*
*I have logged in - I have already told you this on Fri/Sat. Everything I have posted in it is no longer visible TO ME. I now expect a written confirmation from you that you have deleted my data, photos and voice irrevocably and not passed on, only then is the issue of data protection closed for me. Because it is completely implausible to me that everything has now been deleted without my intervention, for which you would previously have needed my identification data*
*Yours sincerely* [REDACTED]
The data subject’s email of 24 October 2019 is as follows:
*“Dear Airbnb staff,*
*Now that the 4-week period you needed to delete my data has expired, I would like to ask you for access to data pursuant to Art. 15 of the GDPR, to be sent to me within one month. If the information shows that not all of my data has been deleted, I will take further steps. The deletion also concerns photos and my voice that you have recorded for the purpose of deletion.*
*With kind regards* [REDACTED]
While the DPC notes that the GDPR does not set out any particular method for making a valid access request, the DPC does however consider that an access request should be sufficiently clear for the data controller to act upon. It is very clear from the English translation of the email dated 02 September 2019 that the data subject was seeking in that email confirmation from Airbnb that Airbnb had deleted their personal data on foot of the erasure request that they had submitted on 17 August 2019. Equally, it is very clear from the English translation of the email dated 24 October 2019 that the data subject, noting that the expiry period of four
22
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
weeks to delete their personal data had passed, was at that point submitting a data subject access request as a means of confirming that Airbnb had deleted all of their data and the data subject went on to make the point that if the access request showed that not all data had been deleted, they would take further steps. Therefore, the DPC considers that the data subject lodged their subject access request with Airbnb on 24 October 2019 and that the email sent by the data subject to Airbnb on 02 September 2019 did not constitute a subject access request but rather it was a follow-up email seeking confirmation that the erasure request had been effected by Airbnb.
79. During the course of this Inquiry Airbnb advised the DPC that the complainant's access request of 24 October 2019 was not escalated to the relevant team. Airbnb advised that when the complainant emailed its community support team the agent did not link the request to any particular account as the complainant's account had already been deleted.
80. Airbnb stated that it provided the complainant with the post-deletion access file on 17 July 2020. However, as the account had been deleted, Airbnb's investigations into the issues that resulted in the mishandling of the post-deletion access request have not yielded further insight into what transpired.
81. Article 15 of the GDPR provides a data subject with the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and where that is the case, to obtain access to the data. Further Article 15 of the GDPR states that the controller shall provide a copy of the personal data undergoing processing. In this case, a considerable delay arose between the date on which Airbnb received the access request on 24 October 2019 and the supply of the access file to the data subject on 17 July 2020. That delay is examined further below in the context of Article 12(3) of the GDPR.
# **Issue D - Whether Airbnb has complied with its obligations in accordance with Article 12 of the GDPR with respect to its handling of the complainant's erasure request and access request.**
82. Article 12(3) of the GDPR states that "The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible,
23
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
*unless otherwise requested by the data subject.* Further, Article 12(4) of the GDPR states that *“If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.”*
### Erasure Request
83. With regard to the complainant’s erasure request pursuant to Article 17 of the GDPR, the DPC notes that the complainant submitted their request to Airbnb on 17 August 2019. The DPC notes that Airbnb responded to the complainant via email on 17 August 2019 advising that it required the complainant to verify their identity in order to progress their erasure request. The DPC notes that when the complainant refused to provide a copy of their ID, Airbnb provided an alternative method for the complainant to verify their identity by logging into their Airbnb account. The DPC notes that the complainant’s identity was verified via account log in on 02 September 2019, on which date Airbnb commenced the erasure of the complainant’s personal data. These actions took place within one month of receipt of the erasure request. Therefore, the obligation on the controller to provide to the data subject information on action taken within the period of one month set down in Article 12(3) of the GDPR was met. Airbnb confirmed via email on 24 October 2019 that it had deleted the complainant’s personal data.
84. On the basis of the above, the DPC considers that Airbnb provided information to the complainant on the action taken on their erasure request within one month of receipt of the request. Therefore, the DPC finds that Airbnb did not infringe Article 12(3) with respect to its handling of the complainant’s erasure request.
### Access Request
85. With regard to the complainant’s access request pursuant to Article 15 of the GDPR, the DPC notes that the complainant submitted their access request to Airbnb on 24 October 2019. The DPC notes that the complainant was not provided with access to their personal data by the controller until 17 July 2020. Further, the complainant submitted their access request on 24 October 2019 and was not notified of the action taken on their request by Airbnb until Airbnb provided the complainant with a copy of their personal data on 17 July 2020. The requirement in Article 12(3) to comply within a period of one month of receipt of the request was not met by the controller in this case.
24
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
86. On the basis of the above, the DPC finds that Airbnb infringed Article 12(3) of the GDPR with respect to its handling of the complainant's access request. This infringement occurred when Airbnb failed to provide the complainant with information on the action taken on their request within one month of the receipt of the access request.
### Decision on infringements of the GDPR
87. Following the investigation of the complaint against Airbnb Ireland UC, the DPC is of the opinion that Airbnb Ireland UC infringed the General Data Protection Regulation as follows:
# **88. Article 5(1)(c) of the GDPR**
The DPC finds that Airbnb's requirement that the complainant verify their identity by way of submission of a copy of their photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR. This infringement occurred in circumstances where less data-driven solutions to the question of identity verification were available to Airbnb.
# **89. Article 6(1) of the GDPR**
The DPC finds that, in the specific circumstances of this complaint, the legitimate interest pursued by the controller does not constitute a valid lawful basis under Article 6 of the GDPR for seeking a copy of the complainant's photographic ID in order to process their erasure request.
# **90. Article 12(3) of the GDPR**
The DPC finds that Airbnb infringed Article 12(3) of the GDPR with respect to its handling of the complainant's access request. This infringement occurred when Airbnb failed to provide the complainant with information on the action taken on their request within one month of the receipt of the access request.
### Remedial measures undertaken by Airbnb Ireland UC
91. In respect of the complainant's request for access to their personal data submitted on 24 October 2019 pursuant to Article 15 of the GDPR, it is noted that Airbnb eventually provided access to the complainant's personal data, albeit it did not provide the complainant with a copy of their data until 17 July 2020. Further, Airbnb advised the DPC that it was reviewing its processes to ensure that a request for access would not be mishandled in the same manner in the future.
25
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
### Exercise of Corrective Power by the DPC
92. In deciding on the corrective powers that are to be exercised in respect of the infringements of the GDPR outlined above, I have had due regard to the Commission’s power to impose administrative fines pursuant to Section 141 of the 2018 Act. In particular, I have considered the criteria set out in Article 83(2)(a) – (k) of the GDPR. When imposing corrective powers, I am obliged to select the measures that are effective, proportionate and dissuasive in response to the particular infringements. The assessment of what is effective, proportionate and dissuasive must be made in the context of the objective pursued by the corrective measures, for example re-establishing compliance with the GDPR or punishing unlawful behaviour (or both)$^{10}$. I find that an administrative fine would not be necessary, proportionate or dissuasive in the particular circumstances in relation to the infringements of the Articles of the GDPR as set out above. Furthermore, I have had regard to the fact that the delay in handling the access request in this case does not appear to have arisen from a systemic set of issues but was particular in the circumstances of this case to factors such as Airbnb mishandling the complainant’s access request. For the reasons outlined, I find that no administrative fine should be imposed in respect of these infringements. However, I find it necessary for Airbnb to revise its internal policies and procedures for handling erasure requests to ensure that data subjects are no longer required to provide a copy of photographic ID when making data erasure requests, unless it can demonstrate a legal basis for doing so. Given that the data subject’s personal data has been erased, I find that no order to the data controller is required to comply with the data subject’s erasure request. Further, given that the data subject has received a copy of their personal data from Airbnb, I find that no order to the data controller is required to comply with the data subject’s access request.
93. In light of the extent of the infringements identified above, the DPC hereby issues a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the GDPR.
94. In light of the infringement of Article 5(1)(c) in the case of this data subject, it is necessary that the data controller bring its data processing operations into compliance with Article 5(1)(c) to prevent similar infringements occurring with regard to data subjects in the future in similar circumstances. Accordingly, the DPC hereby orders Airbnb to revise its internal policies and procedures for handling erasure requests to ensure that data subjects are no longer required to provide a copy of photographic ID when making data
$^{10}$ See the Article 29 Data Protection Working Party ‘Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679, at page 11.
26
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
erasure requests, unless it can demonstrate a valid legal basis for doing so. This order is made pursuant to Article 58(2)(d) of the GDPR and Airbnb is requested to provide details of its revised internal policies and procedures to the DPC by Friday 04 November 2022.
# Judicial remedies with respect to decision of the DPC
95. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of receipt of notification of such decision. An appeal may also be taken within 28 days of notification by a data controller: under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under Section 142, against any imposition upon it of an administrative fine by the DPC.
Signed:
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
27