Kimlik Doğrulama Belgelerinde Veri Minimizasyonu

[LOGO]

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

DPC Ref:

DPC Complaint Ref:

Date: 28 September 2023

Complainant:

Data Controller: Airbnb Ireland UC

RE: vs Airbnb Ireland UC

This document is a Decision of the Data Protection Commission of Ireland ("DPC") in relation to DPC complaint, reference hereinafter referred to as the ("Complaint"), which was lodged with the Federal Commissioner for Data Protection, and Freedom of Information ("BfDI", "Federal DPA"), by ("Complainant") against Airbnb Ireland UC ("Airbnb"), and which was transferred to the Berlin Commissioner for Data Protection and Freedom of Information ("Berlin DPA") and thereafter transferred to the DPC to be handled in its role as lead supervisory authority.

This Decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General Data Protection Regulation ("GDPR").

### Communication of Draft Decision to "supervisory authorities concerned"

In accordance with Article 60(3) of the GDPR, the DPC is obliged to communicate the relevant information and submit a Draft Decision, in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.

In accordance with its obligation, the DPC transmitted a Draft Decision in relation to the matter to the "supervisory authorities concerned". As Airbnb offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as lead supervisory authority identified that each supervisory authority is a supervisory authority concerned as defined in Article 4(22) of the GDPR. On this basis, the Draft Decision of the DPC in relation to this complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

# Complaint Handling by the DPC – Timeline and Summary

1. The complaint was lodged with the Federal DPA by email on 19 October 2019. It was referred to the Berlin DPA, and thereafter transferred to the DPC, with the initial correspondence received via the IMI on 27 May 2020, to be handled by the DPC in its role as lead supervisory authority. The Complainant submitted that he wanted to make a booking for a property on the Airbnb platform. The Complainant submitted that when he tried to make the booking that Airbnb requested a copy of his identity card ("ID") in high resolution and colour. The Complainant submitted that he first tried to do this by means of a redacted copy, but that this was not accepted by Airbnb. The Complainant stated that Airbnb would not accept his booking until he verified his identity by providing a copy of his ID in addition to a newly taken photograph to ensure that the ID related to the person making the booking. The Complainant advised that his booking was only completed when he provided a high resolution colour photo of both the front and back of his ID card with only the online access code redacted. The Complainant stated that he had concerns in relation to identity theft given the volume of personal data that he was required to submit to the Airbnb platform in order to complete an accommodation booking. The Complainant contended that he was entitled to redact information such as the serial number, address, signature, place of birth, nationality, eye colour, size and the machine readable-zone.

2. The Complainant made a further submission, by correspondence dated 20 April 2020, received by the DPC on 3 September 2020. The Complainant stated that he was forwarding his email of November 2019 including an attachment. The Complainant's forwarded message stated that he had submitted his complaint to the Federal DPA and copied in Airbnb. He stated that Airbnb initially misunderstood what he wanted it to do and that it thought he wanted to erase his Airbnb account. He stated that Airbnb requested another copy of his ID at that point. The Complainant stated that he again explained to Airbnb what he wanted it to do and that Airbnb responded that he should explain everything again using a web form. The Complainant stated that at that point he stopped engaging with Airbnb and that he did not respond further to Airbnb at that time.

3. In addition, the Complainant also submitted that he wanted Airbnb to delete his identity card. The Complainant stated that he was not sure whether it would be removed fully from Airbnb's servers and he queried what would happen to the multiple IDs, the redacted copies and the unredacted copy that Airbnb had collected from him during the process.

4. The DPC notified Airbnb of the complaint by way of email and letter dated 19 January 2021 and provided Airbnb with a copy of all of the Complainant's

An Coimisiún um Chosaint Sonraí
Data Protection Commission

correspondence. The DPC also asked Airbnb to address a number of queries, such as to provide information regarding its relevant policy, to provide information regarding the legal bases for the relevant processing and to explain why an unredacted copy of ID was necessary.

5. Airbnb reverted to the DPC by email dated 2 February 2021. Airbnb stated that the Complainant attempted to book a listing in circumstances where the host in question required all prospective guests to verify their identities with Airbnb. Airbnb stated that the Complainant provided it with copies of his ID where the ID number, signature and machine readable zone on the document were redacted. Airbnb stated that where this information is obscured, it is unable to confirm that the ID in question is authentic and uncompromised and therefore verify the user's identity. Airbnb stated that the Complainant submitted copy ID documents that satisfied its verification requirements and that it deleted the copy ID documents submitted by the Complainant which failed to meet its verification requirements.

6. Airbnb stated that as part of its broader verification policies, and as stated in its ID and Verification Help Centre page, Airbnb allows hosts on the Airbnb platform to require that prospective guests have verified their identity with Airbnb. Airbnb stated that where this preference is in place, as was the case in this instance, Airbnb is required to give effect to the host's prerogative by requiring that prospective guests verify their identities by providing Airbnb with a copy of an ID document. Airbnb stated that as part of its ongoing effort to enhance its safety and security measures and to protect the Airbnb community, Airbnb is expanding its identity verification requirements globally. Airbnb stated that Germany, the Complainant's country of residence, is one of the many jurisdictions where this expansion has been implemented. Airbnb submitted that in circumstances where a host in the Complainant's country of residence requests ID verification from guests, the expansion of this program exists alongside Airbnb's own requirement for ID verification from guests.

7. Airbnb stated that, pursuant to its Terms of Service, it is required to facilitate, and guests are required to comply with, host requirements, such as the requirement that prospective guests verify their identities by providing Airbnb with a copy of an ID document. Airbnb submitted that this forms part of Airbnb's contractual obligations to its users, described in its Terms of Service and Privacy Policy. Airbnb submitted that therefore, in order for it to complete the Complainant's booking of the listing in question, it must carry out ID verification of the Complainant as requested by the host. Airbnb stated that its verification procedures are carried out in accordance with the legitimate interests of safeguarding the Airbnb platform and its users, particularly where the guests and hosts are not merely carrying out an online transaction but will meet in real life.

An Coimisiún um Chosaint Sonraí
Data Protection Commission

8. Airbnb also submitted to the DPC that the requirement of providing a copy of ID documents allows Airbnb to refer to official sources, such as government guidelines, to ensure that the ID document in question is authentic and to verify the user is who they say they are. Airbnb submitted that in addition official identification documents benefit from anti-fraud components and characteristics designed and implemented by the relevant issuing body, with the result that unauthentic or compromised versions are often easier to identify. Airbnb stated that similarly by restricting the scope of acceptable ID documents to official government issued documents, this avoids Airbnb having to determine the authenticity of documents on a case by case basis. Airbnb stated that consequently by affording such discretion to users and engaging in these assessments on a per-user basis would not only pose risks regarding security and accuracy, but would also be unworkable from a practical standpoint. Airbnb submitted that in summary requiring a copy of an official identification document is a more secure, consistent and efficient means of verifying a user's identity.

9. Airbnb further submitted that when designing its ID verification processes, it gave careful consideration to the correct balance to strike between the privacy rights of its users and their rights as hosts and guests to a safe and secure stay during a reservation. Airbnb stated that its verification processes involve not just a singular consideration of the ID submitted but also its comparison with a wide range of data points on IDs submitted by other users to detect the use of fake or fraudulent IDs. Airbnb stated that the question of what information may be redacted depends on the circumstances of the case and that for example, it says as outlined in its Help Centre article, there are different requirements in place for different jurisdictions. Airbnb stated that as this user was German, the Complainant's copy ID document must be watermarked as an Airbnb copy, provided this does not impact on the readability of the user's ID. Airbnb stated that the Complainant's failed attempts to verify his identity were attributable to the fact that he applied redactions to his ID. Airbnb stated that given the risks in allowing a fraudulent or otherwise illegitimate booking to proceed, it believes that its redaction policy is adequate, relevant and necessary for the purpose of verifying user identities.

10. The DPC notified the Complainant, via the Berlin DPA using the IMI procedure on 23 March 2021, which issued to the Complainant from the Berlin DPA on 7 May 2021, of the progress of his complaint and informed him of Airbnb's response dated 2 February 2021.

11. The Complainant responded by email to the Berlin DPA on 21 May 2021 and the Berlin DPA forwarded same to the DPC on 25 June 2021. In his response the Complainant stated that it is contrary to the principle of data minimisation for

An Coimisiún um Chosaint Sonraí
Data Protection Commission

Airbnb not to accept a copy of the identity card that is clearly recognisable and partially redacted and that Airbnb by requesting a high resolution, true colour and unredacted version of user IDs created a risk that this large amount of data could be compromised and identity theft could occur such as forgeries of a user's official identification documents. The Complainant stated that a copy of his identity was not necessary as there were other means available to Airbnb to verify his identity, such as the use of 'Post-Ident' where identity only has to be presented and the controller receives confirmation of the person's existence. The Complainant stated that Airbnb does not need to permanently store more than this confirmation for the purposes pursued by Airbnb and once this confirmation has been provided the user is permanently marked as identified, meaning that a copy of the ID does not need to be stored any further. The Complainant queried if a copy of the unredacted ID was still being stored/permanently stored by Airbnb as Airbnb had explained that it had deleted the redacted copies he had submitted as they did not satisfy their verification processes. The Complainant contended that Airbnb's position regarding its submission that it cannot carry out identification if the machine readable zone and identity number are redacted contradicts the German Federal Ministry of the Interior which, he said, states that "Identification data that are not required for identification can and should be redacted on the copy by the ID card holder. This applies in particular to the access number printed on the ID card as well as the serial number".

12. The DPC notified Airbnb by correspondence dated 09 February 2022 that attempts to resolve the complaint amicably had not been successful.

# Conduct of Inquiry

13. Acting in its capacity as lead supervisory authority, the DPC commenced an Inquiry in relation to this matter by writing to Airbnb on 07 September 2022.

14. The DPC notified Airbnb that the Inquiry would seek to examine and assess whether or not Airbnb had complied with its obligations under the GDPR and the Act, in particular under Articles 5, 6, 12, 13 and 17 of the GDPR in respect of the relevant processing operations which are the subject matter of the complaint.

15. The DPC notified Airbnb that the scope of the Inquiry concerned an examination and assessment of the following:

a. Whether Airbnb had a lawful basis for requesting a copy/copies of the Complainant's ID and/or photograph/s in order to verify his identity, so that he could complete his booking on the platform.

An Coimisiún um Chosaint Sonraí
Data Protection Commission

b. Whether Airbnb complied with the principle of data minimisation when requesting an unredacted copy of the Complainant's ID and/or photograph/s in order to verify his identity and when processing personal data relating to same processing.
c. Whether Airbnb had a lawful basis for retaining a copy of the Complainant's ID after it had verified his identity.
d. Whether Airbnb complied with the principles of transparency and provision of information where the Complainant's personal data was collected.
e. Whether Airbnb received an Article 17 erasure request from the data subject and if so, whether Airbnb's handling of the Complainant's erasure request complied with the GDPR and the Act.

16. In order to progress the matter the DPC posed specific questions to Airbnb regarding its processing operations that are the subject matter of the complaint.
17. The DPC also informed the Complainant via the Berlin DPA in a letter dated 07 September 2022 that an Inquiry had commenced in relation to his complaint. The DPC provided the Complainant the opportunity to withdraw any information previously provided and asked whether the Complainant had any new information he wished to submit regarding the complaint. The DPC did not receive any response to this correspondence.
18. On 28 September 2022, Airbnb provided the DPC by letter its response to the questions posed in the DPC's Commencement Notice. Airbnb stated that in its original response of 2 February 2021, under the section 'The relevant policy', Airbnb disclosed certain internal information about the then existing geographical scope of its identity verification processes. Airbnb stated that these matters are confidential, with the effect that the dissemination of this information could compromise or undermine Airbnb's processes.
19. In response to the DPC's query as to what legal basis was relied upon for requesting a copy of the Complainant's ID and a copy of his photograph in order to verify his identity, Airbnb submitted that it relied on the legitimate interests of the host in question, who required that the identities of prospective guests be verified by ID verification, and its legitimate interests in facilitating this host's prerogative, which was a safety and security measure that benefitted the legitimate interests of the Airbnb community and those associated with it as a

An Coimisiún um Chosaint Sonraí
Data Protection Commission

whole, in accordance with Article 6(1)(f) of the GDPR. Airbnb submitted that the request for a supplemental image of the Complainant was made to ensure that the individual submitting the ID document was indeed the person in the ID photo, as part of the pursuit of these legitimate interests.

20. Airbnb stated that its Terms of Service are contracts with its users, and as part of these terms and the various other constituent terms and policies that apply to the Airbnb platform, including those described in the Legal Terms page, it gives effect to certain decisions and requirements of its users, including identity verification requirements which align with its identity verification practices. Airbnb submitted that in a number of pages in its ID and verification Help Centre page it informs individuals that Airbnb hosts may require their guests to provide ID to book a listing. This reflects the ID requirement option it provides hosts in their account settings, which is also explained to hosts in pages such as the hosting section of its trust page. Airbnb stated that when it requests IDs from users on behalf of hosts, it does so on the basis of the legitimate interests it described above, which include giving effect to the security decisions of hosts.

21. In response to the DPC's query as to why Airbnb considered it both necessary and proportionate to request a copy of the Complainant's ID and a copy of the Complainant's photograph to verify his identity, in circumstances where Airbnb had nothing to verify it against, Airbnb submitted that in light of the fact that hosts welcome strangers into their homes, and the real world-risks that this entails, it respects and facilitates the hosts prerogative to make sure that the identities of their guests are fully verified using ID documents. Airbnb stated that in this regard, providing a copy of an ID document through a secure portal is a reliable proof of identity that does not impose a disproportionate burden on the individual and that this approach aligns with established, international organisations and businesses operating across a wide variety of industries and commercial sectors, including the travel, hospitality, and short-term rental industries.

22. Airbnb also stated that the corroborative value of requesting ID is not dependent or predicated on there being a pre-existing ID on the user's account and instead forms part of a holistic approach to identity verification, carried out with reference to the totality of information available to Airbnb, including the information on that user's account and, as the case was here, the supplemental image of the Complainant. Airbnb further stated that given that it is necessary for it to design, implement and maintain robust safety and security measures for the benefit of the Airbnb community and all those connected with it, in particular given that a fundamental feature of the Airbnb platform is strangers interacting in one another's homes, it stated that it believes that its identity verification processes,

An Coimisiún um Chosaint Sonraí
Data Protection Commission

including the verification options it provides hosts with, are a necessary and proportionate means of achieving the purpose of protecting the Airbnb community and indeed the broader community, in compliance with its obligations under the GDPR.

23. In response to the DPC's query regarding whether Airbnb provides members with other methods by which to verify their identity and, if so, why the Complainant was not offered other methods in this instance, Airbnb submitted that in the context of the complaint the ID requirement was stipulated by the host in question and Airbnb therefore respected this decision and facilitated this requirement.

24. In response to the DPC's query regarding data minimisation efforts, Airbnb reiterated its position that it believes its verification processes are a necessary and proportionate means of protecting the Airbnb community in compliance with its obligations under the GDPR, particularly given that strangers interact in one another's homes. Airbnb stated that it processes identity verification data for further security related purposes, which include enhancing its security processes. Airbnb provided examples such as using identity verification data in projects designed to identify fraudulent or otherwise illegitimate ID documents, identifying connecting factors between related fraudulent/potentially fraudulent accounts and investigating incidents that can be linked with verification information previously provided to Airbnb. Airbnb stated that these further purposes can be considered constituent elements of the broader, overarching purpose of protecting the Airbnb platform and those associated with it. Airbnb also enclosed with its submission a copy of ID Verification articles that explain to users and hosts that Airbnb may ask for government ID. The articles explain how it works, when ID will be asked for, the types of ID, what information gets shared with the host, and storing and removing the photo of the ID.

25. Airbnb submitted that, as it previously clarified in its responses, the ID requirement was stipulated by the host in question and Airbnb therefore respected the host's decision and facilitated this requirement. Airbnb contended that therefore the request for the Complainant's identity verification data was adequate, relevant and necessary for the purposes of facilitating this requirement.

26. Regarding any retention of identity verification data once the verification process has completed, Airbnb responded that it retains identification data for further security processing activities, for example investigating incidents on its platform that may be linked with IDs previously provided to Airbnb and the security

![img-0.jpeg](img-0.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

enhancement projects as previously outlined in its response. Airbnb further submitted that the Complainant's identity verification data was retained for these security purposes in accordance with the legitimate interests of protecting the platform and those associated with it under Article 6(1)(f) of the GDPR. Airbnb stated that it typically retains this data for as long as the Airbnb account is in existence and that in the context of this complaint it stated that it deleted the Complainant's ID documents as part of its response to the complaint.

27. Regarding the matter of the identity verification data that had been retained and whether any further processing of this data had taken place, Airbnb stated that it processed the Complainant's ID uploads [until 2 February 2021] and continues [to the current time] to process the supplemental images of the Complainant for the security purposes described in its above responses, in accordance with the legitimate interests of protecting the Airbnb platform and those associated with it under Article 6(1)(f) of the GDPR.

28. In response to the DPC's query regarding Airbnb's contractual obligations to its users, Airbnb set out the contractual context within which the ID was collected in this instance. Airbnb stated that it relied on the legitimate interests of the host to request a supplemental image of the Complainant to ensure that the individual submitting the ID document was indeed the person in the ID photo. Airbnb stated that in its ID and verification Help Centre page it informs individuals that Airbnb hosts may require their guests to provide ID to book a listing. Airbnb provided a screenshot of the account settings page where hosts can select this ID verification option.

29. In reply to the DPC's query regarding why Airbnb allowed a host to determine the range of personal data to be collected by the platform from the Complainant at booking stage and the legal basis relied upon to give a host a say in the collection of such personal data at the booking stage, Airbnb referred to its practice of giving effect to the host's identity verification requirements which align with identity verification practices, on the basis of the legitimate interests of the host, Airbnb and the broader Airbnb community and those connected with it, under Article 6(1)(f) of the GDPR.

30. In response to the DPC's query and request for evidence regarding notification to the Complainant of its Terms of Service, Identification Verification Policy and Privacy Policy, Airbnb provided copies of the Terms of Service and Privacy Policy which were in place when the Complainant joined the Airbnb platform on 24 October 2014 and the Terms of Service, Privacy Policy and identity verification Help Centre materials which were in effect when the request for

An Coimisiún um Chosaint Sonraí
Data Protection Commission

identity verification was made on 18 October 2019, together with a copy of the email notification sent to the Complainant regarding updates to the Terms and Policy. Airbnb stated that links to these documents were made available to the Complainant during the account creation process. Airbnb stated that the sections of the 2014 Privacy Policy entitled 'How Airbnb uses and processes the information that you provide or make available' and 'When Airbnb discloses or shares personal information, and to whom' informs individuals that Airbnb engages in identity verification practices. Airbnb submitted that similarly, section 2.4 and 8.1.1 of the 2019 Terms of Service informed individuals about Airbnb's identity verification practices, as did sections 2.1.1, 2.1.3, 2.1.5, 3.2 and 4.6 of the 2019 Privacy Policy.

31. In response to the DPC's queries regarding Article 17 of the GDPR, Airbnb submitted that it has no record of an Article 17 erasure request from the Complainant. It stated that the only request for IDs to be deleted was disclosed in the DPC Complaint letter dated 19 January 2021 and the translated regulatory letter from the Complainant dated 20 April 2020 provided with the complaint on 19 January 2021. Airbnb stated that all copies of the Complainant's IDs were deleted from its systems as part of its response to the Complaint, and will be deleted from its complaint file following the conclusion of this inquiry and any related legal processes.
32. Airbnb submitted that its records indicate that deletion was actioned on or around 2 February 2021, the date of its response to the complaint.
33. In response to the DPC's query regarding whether Airbnb retained any personal information relating to the Complainant following the completion of his erasure request, Airbnb submitted that the Complainant had only sought the deletion of the IDs provided and that his broader Airbnb account remains in existence.
34. In response to the DPC's queries regarding the purpose and legal basis for retaining each category of the Complainant's personal data that it retained and the processing each category of retained data undergoes, Airbnb stated its interpretation of this query is that it was intended to capture any personal data retained following a broader Article 17 deletion request, which, it stated, is not what transpired here.
35. The DPC wrote to Airbnb on 24 January 2023 raising additional queries in relation to the retention of the Complainant's personal data.
36. Airbnb responded to these additional queries by letter dated 2 February 2023 by reiterating the points previously made in its letter of 28 September 2022,

An Coimisiún um Chosaint Sonraí
Data Protection Commission

particularly its responses at paragraphs 1(e), (f) and (g). In response to the DPC's query as to the purpose for retaining a copy of ID documents and/or photographs, particularly redacted copies and copies Airbnb deemed insufficient, Airbnb stated that it retained the Complainant's identity verification data for safety and security purposes. It stated that these safety and security purposes include security enhancement purposes such as comparative reviews between authentic ID documents and fraudulent ID documents, documenting emerging trends in this space, identifying technical issues and improving methods for comparing IDs against supplemental images uploaded by users that have been altered or redacted. Airbnb stated that it deleted the Complainant's identity documents as part of its response to the complaint.

37. In response to the DPC's query relating to the number of attempted uploads and the description of the documents and/or photographs that were not deemed acceptable, Airbnb stated that nine attempted uploads were made. The Complainant attempted to upload a national identity card and a driver licence. These identity items were rejected by Airbnb due to the fact that redactions had been applied by the Complainant.
38. The DPC also asked Airbnb to clarify the date on which the Complainant successfully verified his ID by submission of an unredacted copy of ID. Airbnb stated that this was completed on 19 October 2019.

# Notification of the Preliminary Draft Decision to the Data Controller

39. The DPC provided Airbnb with a copy of the Preliminary Draft Decision on 02 May 2023 and invited submissions.
40. The DPC received submissions from Airbnb dated 02 June 2023.
41. Airbnb stated that it would like to confirm that the host ID verification option, the subject matter of this inquiry, has been discontinued, with the effect that Airbnb determines the appropriate identity verification requirements to be applied in any given case involving Airbnb's general platform identity verification practices. It stated in addition that in certain cases Airbnb is legally required to deploy certain identity verification practices, for example identity verification requirements prescribed by anti-money laundering rules.
42. Airbnb objected to the references in the Preliminary Draft Decision to present day Airbnb Help Centre material and the EDPB access guidelines in the DPC's consideration of the matter of data minimisation. These references were removed from the Draft Decision.

![img-1.jpeg](img-1.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

43. The DPC has carefully considered the submissions of Airbnb in making this Decision.

## Notification of the Preliminary Draft Decision to the Complainant

44. The DPC provided the Complainant with a copy of the Preliminary Draft Decision, via the Berlin DPA on 12 June 2023, and invited submissions. On 18 July 2023, the Berlin DPA notified the DPC that the Complainant had not responded.

## Relevant and Reasoned Objections from "supervisory authorities concerned"

45. Having transmitted the Draft Decision, on 22 August 2023, to the "supervisory authorities concerned" in accordance with Article 60(3) of the GDPR, the DPC did not receive any relevant and reasoned objections under Article 60(4) of the GDPR.

46. Given that no relevant and reasoned objections were received from any of the supervisory authorities concerned, within a period of four weeks, after having been consulted, the DPC did not revise the Draft Decision.

## Applicable Law

47. For the purposes of its examination and assessment of this complaint, the DPC has considered the following Articles of the GDPR:

- Article 5
- Article 6
- Article 12
- Article 13
- Article 17

## Analysis and Findings of Inquiry

Issue A – Whether Airbnb had a lawful basis for requesting a copy / copies of the Complainant's ID and / or photograph/s in order to verify his identity, so that he could complete his booking on the platform.

![img-2.jpeg](img-2.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

48. The Complainant contended that Airbnb wrongfully requested a copy of his ID and photograph in order to verify his identity without a legal basis to do so in circumstances where he was already a member of the Airbnb platform. The Complainant said that there were alternative types of identity verification available to Airbnb such as through the "Post-Ident" procedure.

49. During the course of the Inquiry, Airbnb stated that it relied on the legitimate interests of Airbnb, its users, its commercial partners and third parties, in accordance with Article 6(1)(f) of the GDPR as the legal basis for requesting a copy of the Complainant's ID and supplemental photograph in order to verify his identity. Airbnb stated that it relied on the legitimate interests of the host in question, who required that the identities of prospective guests be verified by ID verification, and its legitimate interests in facilitating this host's prerogative, which was a safety and security measure that benefitted the legitimate interests of the Airbnb community and those associated with it as a whole. Airbnb stated that the request for a supplemental image of the Complainant was made to ensure that the individual submitting the ID document was indeed the person in the ID photo, as part of the pursuit of these legitimate interests. Airbnb stated that as part of its broader verification policies Airbnb allows hosts on the platform to require that prospective guests verify their identity with Airbnb.

50. Airbnb submitted that the question of what information may be redacted depends on the circumstances of the case and, for example, there are different requirements in place for different jurisdictions. Airbnb submitted that the Complainant's failed attempts to verify his identity were attributable to the fact that he applied redactions to his ID. Airbnb contended that given the risks in allowing a fraudulent or otherwise illegitimate booking to proceed, it believes that its redaction policy is adequate, relevant and necessary for the purpose of verifying user identities.

51. Airbnb stated that, pursuant to its Terms of Service, it is required to facilitate, and guests are required to comply with, host requirements, such as the requirement that prospective guests verify their identities by providing Airbnb with a copy of an ID document. Airbnb submitted that this forms part of Airbnb's contractual obligations to its users, described in its Terms of Service and Privacy Policy.

52. Article 5(1)(a) of the GDPR states that personal data shall be "processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency')".

An Coimisiún um Chosaint Sonraí
Data Protection Commission

53. Airbnb stated that it informed the Complainant of its updated Terms of Service and that the Complainant had been made aware of its Privacy Policy (as described in para 30 above).

Information available to the Complainant at the time of account creation

54. Airbnb's 2014 Privacy Policy states that it uses and processes information about users to help create and maintain a trusted and safer environment on the platform, such as verifying any identifications provided by users. Airbnb's 2014 Privacy Policy also states that Airbnb may engage with third party companies and individuals who may be located outside of the EEA to provide services to it including services to help verify users' identification.

55. With respect to the above notices available to the Complainant on Airbnb's website at the time the Complainant created his account, the DPC is of the view that the Complainant was on notice that he may be required to verify his identity.

Information available to the Complainant at the time of Airbnb's request for ID and photograph

56. Section 2.3 of the Terms of Service 2019 states that "Airbnb may make access to and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform, subject to certain conditions or requirements, such as completing a verification process".

57. Section 2.4 of the Terms of Service 2019 states:-

"User verification on the internet is difficult and we do not assume any responsibility for the confirmation of any Member's identity. Notwithstanding the above, for transparency and fraud prevention purposes, and as permitted by applicable laws, we may, but have no obligation to (i) ask Members to provide a form of government identification or other information or undertake additional checks designed to help verify the identities or backgrounds of Members, (ii) screen Members against third party databases or other sources and request reports from service providers, and (iii) where we have sufficient information to identify a Member, obtain reports from public records of criminal convictions or sex offender registrations or an equivalent version of background or registered sex offender checks in your local jurisdiction (if available)."

An Coimisiún um Chosaint Sonraí
Data Protection Commission

58. Section 8.1.1 of the Terms of Service 2019 states:-

"Subject to meeting any requirements (such as completing any verification processes) set by Airbnb and/or the Host, you can book a Listing available on the Airbnb Platform by following the respective book process..."

59. Section 2.1.1 of Airbnb's Privacy Policy states that "when a person signs up for an Airbnb Account, Airbnb requires certain information such as person's first name, last name, email address and date of birth, and that Airbnb may collect identity verification information, such as images of government issued ID, passport national ID card, or driving licence as permitted by applicable laws, or other authentication information, to help create and maintain a trusted environment". Section 2.1.1 of Airbnb's Privacy Policy also states that "to use certain features of the Airbnb platform (such as booking or creating a Listing), we may ask you to provide additional information, which may include your address, phone number, and a profile picture...".

60. Section 3.2 of Airbnb's Privacy Policy states:-

"We may use the personal information to create and maintain a trusted and safer environment such as to verify or authenticate information or identifications provided by you (such as to verify your Accommodation address or compare your identification photo to another photo you provide)..."

61. With respect to the above notices available on Airbnb's website at the time the Complainant was requested to provide his ID in order to verify his identity, the DPC is of the view that the Complainant was on notice that he may be required to verify his identity, including by providing a copy of his photographic ID and photograph/s.

# Existence of a lawful basis

62. Article 6(1)(f) of the GDPR states "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child".
63. The DPC notes that Airbnb has claimed that it relied on the legitimate interests of the host in question, who required that the identities of prospective guests be verified by ID verification, and its own legitimate interests in facilitating this host's

![img-3.jpeg](img-3.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

prerogative, which was a safety and security measure that benefitted the legitimate interests of the Airbnb community and those associated with it as a whole, in accordance with Article 6(1)(f) of the GDPR. The DPC notes that Airbnb stated its request for a supplemental image of the Complainant was made to ensure that the individual submitting the ID document was indeed the person in the ID photo, as part of the pursuit of these legitimate interests.

64. Noting that the platform Airbnb operates by bringing hosts and members who are unknown to each other into a situation where they may actually meet in person at the host's premises, or elsewhere, the DPC agrees that a legitimate interest exists in Airbnb ensuring it has adequate safety and security measures in place to protect users of the platform. The service operated by Airbnb is, therefore, significantly different to a purely online service such as a social media platform. Given that Airbnb members stay at the premises of a host "in the real world", the DPC recognises the importance of verifying the identity of guests to ensure that they are who they say they are. However, as stated at paragraph 23 above, regarding whether Airbnb provides members with other methods (apart from submitting photo ID) by which to verify their identity and, if so, why the Complainant was not offered other methods in this instance, Airbnb submitted that the ID requirement was stipulated by the host in question and Airbnb therefore respected this decision and facilitated this requirement. Given that other means of validating this guest's identity were not attempted in the first instance, the DPC finds that it was not necessary to process the photo ID and supplemental photograph in pursuit of the legitimate interest as a first resort. Airbnb prioritised the rights of the host over the rights of the guest (i.e. the Complainant), in this case and failed to give due consideration to the fact that other identification methods could have been applied to authenticate the Complainant's identity in the first instance. While the DPC acknowledges that Airbnb may request ID verification documents given the 'real world' interactions members of the platform often have, a request of this nature should not be the first attempt at ID verification. In a decision adopted by the DPC on 9 January, 2023 in the case of [REDACTED] v Airbnb Ireland UC (Case Reference Number [REDACTED]), the DPC found that Airbnb validly relied on Article 6(1)(f) as the legal basis for processing the complainant's photographic ID in that case once all other efforts that it had deployed to verify her identity were unsuccessful. In that case, for example, Airbnb stated that it had initially attempted to verify the complainant's identity, without requesting a copy of ID on the basis of information (name, address and dates of birth) submitted by the complainant in the identity verification flow by comparing these details against reliable external databases. In the present case, however, Airbnb made no such attempts to verify the Complainant's identity by other less intrusive means prior to seeking a copy of photographic ID and this

An Coimisiún um Chosaint Sonraí
Data Protection Commission

case differs fundamentally from the above referenced case in that regard. Had Airbnb first deployed other efforts to verify the Complainant's identity without achieving a successful outcome, it would have been in a better position to justify thereafter seeking a copy of photographic ID and may have been able to ground that data processing in the legal basis of Article 6(1)(f). However, without having made other attempts to verify the Complainant's identity prior to seeking a copy of photographic ID, the DPC does not consider that Airbnb could rely on Article 6(1)(f) as the legal basis for processing this complainant's photographic ID and supplemental photographs.

65. In those circumstances, therefore, the DPC finds that Airbnb did not validly rely on Article 6(1)(f) of the GDPR as the legal basis for processing this Complainant's photographic ID and supplemental photographs.

Issue B – Whether Airbnb complied with the principle of data minimisation when requesting an unredacted copy of the Complainant's ID and/or photograph/s in order to verify his identity and when processing personal data relating to same processing

66. Article 5(1)(c) of the GDPR states "personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation")." The Complainant stated that it is contrary to the principle of data minimisation for Airbnb not to accept a copy of the identity card that is clearly recognisable and partially redacted and that Airbnb by requesting a high resolution, true colour and unredacted version of user IDs created a risk that this large amount of data could be compromised and identity theft could occur such as forgeries of a user's official identification documents.

67. The DPC notes Airbnb's position that its verification processes involve not just a singular consideration of the ID submitted but also its comparison with a wide range of data points on IDs submitted by other users to detect the use of fake or fraudulent IDs. Airbnb stated that the question of what information may be redacted depends on the circumstances of the case and that, for example, it says as outlined in its Help Centre article, there are different requirements in place for different jurisdictions. Airbnb stated that as this user was German, the Complainant's copy ID document must be watermarked as an Airbnb copy, provided this does not impact on the readability of the user's ID. Airbnb stated that the Complainant's failed attempts to verify his identity were attributable to the fact that he applied redactions to his ID. Airbnb stated that given the risks in allowing a fraudulent or otherwise illegitimate booking to proceed, it believes that its redaction policy is adequate, relevant and necessary for the purpose of verifying user identities.

An Coimisiún um Chosaint Sonraí
Data Protection Commission

68. In the circumstances of this Complainant's case, the DPC is not satisfied that Airbnb gave adequate consideration to the principle of data minimisation when it sought from the Complainant a complete and unredacted copy of his photographic ID and supplemental photograph. There is no evidence that Airbnb sought in this case to minimise the amount of personal data sent to it with the Complainant's photo ID.

The DPC finds, therefore, that in the particular situation that arose in this Complainant's case, Airbnb's requirement that the Complainant verify his identity by submitting a complete and unredacted copy of his photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR.

# Issue C – Whether Airbnb had a lawful basis for retaining a copy of the Complainant's ID after it verified his identity

69. Article 5(1)(e) of the GDPR states personal data shall be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ('storage limitation')."

70. Article 5(1)(c) of the GDPR states that "personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation')".

71. The DPC notes that Airbnb submitted that it retains identity verification data for further security-related processing activities, for example, investigating incidents on the Airbnb platform that may be linked with IDs previously provided to Airbnb and the security-enhancement projects referred to in its response to question 1(e). It said that the Complainant's identity verification data was retained for these security purposes, in accordance with the legitimate interests of protecting the Airbnb platform and those associated with it under Article 6(1)(f) of the GDPR. The DPC further notes that Airbnb typically retains ID documents and supplemental images for as long as the Airbnb account in question is in existence. In the context of this complaint, Airbnb deleted all of the Complainant's ID documents, excluding the supplemental images, on 2 February 2021 as part of its response to the complaint.

![img-4.jpeg](img-4.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

72. The DPC notes that Airbnb submitted that it processed the Complainant's ID uploads [from 19 October 2019 up to 2 February 2021] and that it continues to currently process the supplemental images of the Complainant for security purposes in accordance with the legitimate interests of protecting the Airbnb platform and those associated with it under Article 6(1)(f) of the GDPR. Therefore, there are three matters to be considered in relation to data retention.

73. Firstly, the matter of the retention until 2 February 2021 of the un-redacted ID documents arises for consideration. The DPC has considered whether the data retained by Airbnb was relevant, adequate and limited to what was necessary (in terms of the data minimisation principle) in relation to the purposes for which they are processed, i.e. identity verification of the Complainant for legitimate interests pursued by Airbnb and whether such data were retained for longer than was necessary for the purposes for which the personal data were requested and processed (storage limitation principle).

74. The DPC is of the view that once Airbnb has completed the verification process to its satisfaction, the only record that should be retained is a note on the user's file indicating that an ID document was submitted to verify that user's identity and what that ID document was. In the case of this Complainant it would have sufficiently satisfied the host's requirements that ID be verified, had Airbnb noted on the user's file that a copy of a valid document was submitted on 19 October, 2019 and that Airbnb was satisfied that it fulfilled the identity requirements. The copy submitted should have been safely disposed of by Airbnb once the identify verification process was satisfactorily completed. The DPC is of the view that Airbnb has not demonstrated that the retention of these specific records of personal data until 2 February 2021 was relevant, adequate and limited to what was necessary in relation to the purposes for which they were processed. The DPC is of the view that Airbnb retained this personal data for longer than was necessary for the purposes for which the data was collected. In the circumstances of the Complainant's case, therefore, the DPC is not satisfied that Airbnb gave adequate consideration to the principle of storage limitation when it continued to store from 19 October 2019 until 2 February 2021 the Complainant's ID in a form which permitted identification of the data subject for longer than was necessary for the purposes for which the personal data was processed, i.e. in this case for ID verification and security-related purposes. Neither is the DPC satisfied that Airbnb had a legal obligation to process the Complainant's ID for a purpose other than the purpose for which the data was collected in accordance with Section 41 of the Data Protection Act, 2018.

75. Given that there is no evidence of a legal obligation on Airbnb to process the data for a purpose other than the purpose for which the data was collected, or evidence that retention was limited to a strict minimum for the

![img-5.jpeg](img-5.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

purposes for which the data are processed, (i.e. in this case for ID verification and security-related purposes) the DPC finds that by retaining, after the identify verification process was successfully completed and until 2 February 2021, a copy of the Complainant's un-redacted ID documents, Airbnb infringed the principle of data minimisation in Article 5(1)(c) and the principle of storage limitation in Article 5(1)(e).

76. Secondly, the matter of the continued retention of the Complainant's supplemental images arises for consideration. The DPC notes that Airbnb typically retains such information for the duration of the user's account for the purposes of verifying the identities of Airbnb users for safety and security purposes. The DPC notes that Airbnb retains this information for related safety and security purposes, for example investigating incidents on the Airbnb platform that may be linked with ID's previously provided to Airbnb, in accordance with the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform.
77. The DPC has considered whether the data being retained by Airbnb (i.e. supplemental images) are relevant, adequate and limited to what is necessary (in terms of the data minimisation principle) in relation to the purposes for which they are processed, i.e. identity verification of the Complainant for legitimate interests pursued by Airbnb and whether such data are retained for longer than is necessary for the purposes for which the personal data are requested and processed (storage limitation principle). The DPC does not agree with Airbnb's position that it retain such information for the duration of the user's account. As stated above, once Airbnb has completed the verification process to its satisfaction, all that was required for its records was a note on its file of what ID document was submitted to verify identity. The DPC is of the view that Airbnb has not demonstrated that the intended retention of supplemental images in this case for the duration of the user's account is relevant, adequate and limited to what was necessary in relation to the purposes for which they were processed. The DPC is of the view that Airbnb is retaining this personal data for longer than is necessary for the purposes for which the data was collected.
78. The DPC finds that by retaining, after the identify verification process was successfully completed and for the duration of the user's account, a copy of the Complainant's supplemental images, Airbnb infringed the principle of data minimisation in Article 5(1)(c) and the principle of storage limitation in Article 5(1)(e). These infringements are ongoing.
79. Thirdly, the matter of the retention of the redacted ID documents arises for consideration - i.e. the redacted copies of the Complainant's national identity card

An Coimisiún um Chosaint Sonraí
Data Protection Commission

and driver's licence, which he attempted to upload on 19 October, 2019. The DPC notes that Airbnb continued to process redacted copies of the Complainant's photographic IDs which it had considered insufficient or inadequate for verifying the identity of the Complainant until 2 February, 2021.

80. Airbnb stated that the Complainant made nine attempts to upload a national identity card and driver's licence on 19 October, 2019 which were rejected for readability reasons associated with the redactions applied by the Complainant. In summary, therefore, in addition to the copy of the valid ID that the Complainant uploaded successfully on 19 October 2019, Airbnb retained nine copies of the Complainant's national identity card and/or driver licence which contained various redactions. These documents were retained by Airbnb until it gave effect to the Complainant's request for deletion on 2 February, 2021.

81. The DPC is of the view that Airbnb has not demonstrated that the retention of these specific records of personal data from 19 October 2019 until 2 February 2021 was relevant, adequate and limited to what was necessary in relation to the purposes for which they were processed. The DPC is of the view that Airbnb retained this personal data for longer than was necessary for the purposes for which the data was collected, personal data that Airbnb considered to be obscured and invalid. In the circumstances of this particular case, Airbnb received valid ID from the Complainant on 19 October, 2019 and it was able to conclude its verification process successfully at that point. On that basis, therefore, the Complainant had then satisfied Airbnb as to his identity and the matter of identity was then closed. The redacted/obscured copies of the Complainant's documents were no longer relevant in this case once he submitted a copy of ID that satisfied Airbnb's identity requirements. Therefore, there was no valid basis for Airbnb to continue to retain the redacted/obscured copies of identification submitted by the Complainant on 19 October 2019 once his identity was verified to Airbnb's satisfaction. By retaining these documents until 2 February 2021, it is the view of the DPC that Airbnb infringed the principle of data minimisation in Article 5(1)(c) and the principle of storage limitation in Article 5(1)(e). On the other hand, in the event that the Complainant had not successfully verified his identity to the satisfaction of Airbnb on 19 October 2019 or at any time since then, Airbnb may have a valid justification for the retention of the redacted/obscured copies of identification while the identity verification process was still ongoing.

82. In the circumstances of this Complainant's case, therefore, the DPC is not satisfied that Airbnb gave adequate consideration to the principles of data minimisation and storage limitation when it continued to store until 2 February 2021 personal data which it considered ineffective for identity verification, namely the redacted/obscured copies of the ID documents submitted by the Complainant on 19 October 2019.

![img-6.jpeg](img-6.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

83. The DPC finds, therefore, that Airbnb's processing and retention until 2 February 2021 of identity documents that it deemed inadequate or insufficient to verify the identity of the Complainant infringed the principle of data minimisation that is set out in Article 5(1)(c) of the GDPR and the principle of storage limitation that is set out in Article 5(1)(e) of the GDPR.

Issue D – Whether Airbnb complied with principles of transparency and provision of information where the Complainant's personal data was collected

84. Article 13(1)(c) of the GDPR states "where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with the purposes of the processing for which the personal data are intended as well as the legal basis for the processing" and Article 13(1)(d) of the GDPR states "where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with, where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party".
85. Airbnb notified the DPC of the Privacy Policy, the Terms of Service and identity verification Help Centre materials which were in effect at the time the Complainant joined the Airbnb platform on 24 October, 2014. Airbnb's 2014 Privacy Policy states that it uses and processes information about users to help create and maintain a trusted and safer environment on the platform, such as verifying any identifications provided by users. Airbnb stated that links to these documents were made available to the Complainant during the account creation process.
86. As set out at paragraph 30 and from paragraph 53 - 60 above, Airbnb directed the DPC to particular sections of the 2014 Privacy Policy and the 2019 Terms of Service which inform users that Airbnb engages in identity verification practices and the reasons why this practice is utilised.
87. The DPC is satisfied, taking all of the above submissions and supporting evidence into account, that Airbnb, at the time of requesting and obtaining copies of the Complainant's IDs and photograph, set out the intended purposes of the processing and the legitimate interests pursued by Airbnb. In that regard, therefore, and in the circumstances of this Complainant's case, the DPC finds that Airbnb complied with the requirements of Article 13(1) of the GDPR with regard to the provision of information to the data subject.

![img-7.jpeg](img-7.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

Issue E – Whether Airbnb received an Article 17 erasure request from the data subject and, if so, whether Airbnb’s handling of the Complainant’s erasure request complied with the GDPR and the Act

88. Article 17 of the GDPR states that "the data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay". Article 12(3) of the GDPR states that "[t]he controller shall provide information on action taken on a request under Article 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request.
89. The Complainant submitted, by correspondence dated 20 April 2020, received by the DPC in September 2020, that he wanted Airbnb to delete the copy of his ID document. He stated he was not sure if it would really be erased from Airbnb's servers and he questioned what would happen to the numerous copies of ID he had sent to Airbnb during its verification process. The content of the Complainant's correspondence of 20 April 2020 was notified to Airbnb on 19 January 2021.
90. Airbnb responded on 2 February 2021 stating that it had deleted the copy ID documents submitted by the Complainant that failed to meet its verification requirements.
91. On 28 September 2022, Airbnb submitted that the only erasure request it had received from the Complainant was contained in the DPC's letter to Airbnb dated 19 January 2021. Although the Complainant's erasure request was dated 20 April 2020, it was only received by the DPC in September 2020 and it was forwarded to Airbnb in January 2021.
92. The DPC notes that Airbnb received the Complainant's erasure request on 19 January 2021. Airbnb responded to the DPC on 2 February 2021, stating that it had deleted the copy ID documents submitted by the Complainant that failed to meet its verification requirements. It further submitted in its correspondence of 28 September 2022 that all copies of the Complainant's IDs were deleted from its systems as part of its response to the complaint it received on 19 January 2021. Airbnb stated that the Complainant's data would be deleted from its complaint file following the conclusion of this inquiry and any related legal processes.
93. On the basis that Airbnb, on receipt of the Complainant's erasure request on 19 January 2021, responded to the erasure request on 2 February 2021 and erased the Complainant's ID's, the DPC considers that there was no undue delay on the part of Airbnb in responding to the Complainant's erasure request.
94. Based on the facts and analysis outlined above, the DPC finds that Airbnb did not infringe Article 17(1) of the GDPR, as there was no undue delay in the handling of the Complainant's erasure request. Further, the DPC finds

![img-8.jpeg](img-8.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

that Airbnb did not infringe Article 12(3) of the GDPR with respect to its handling of the Complainant's erasure request.

# Decision on infringements of the GDPR

95. Following the investigation of the complaint against Airbnb Ireland UC, the DPC is of the opinion that in the circumstances of this Complainant's case, Airbnb Ireland UC infringed the General Data Protection Regulation as follows:

- The DPC finds that Airbnb did not validly rely on Article 6(1)(f) of the GDPR as the legal basis for processing this Complainant's photographic ID and supplemental photographs.
- The DPC finds that in the particular situation that arose in this Complainant's case, Airbnb's requirement that the Complainant verify his identity by submitting a complete and unredacted copy of his photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR.
- Given that there is no evidence of a legal obligation on Airbnb to process the data for a purpose other than the purpose for which the data was collected, or evidence that retention was limited to a strict minimum for the purposes for which the data are processed (i.e. in this case for ID verification and security-related purposes), the DPC finds that by retaining, after the identify verification process was successfully completed and until 2 February 2021, a copy of the Complainant's un-redacted ID documents, Airbnb infringed the principle of data minimisation in Article 5(1)(c) and the principle of storage limitation in Article 5(1)(e).
- The DPC finds that by retaining, after the identify verification process was successfully completed and for the duration of the user's account, a copy of the Complainant's supplemental images, Airbnb infringed the principle of data minimisation in Article 5(1)(c) and the principle of storage limitation in Article 5(1)(e). These infringements are ongoing.

An Coimisiún um Chosaint Sonraí
Data Protection Commission

- The DPC finds that Airbnb's processing and retention until 2 February 2021 of identity documents that it deemed inadequate or insufficient to verify the identity of the Complainant infringed the principle of data minimisation that is set out in Article 5(1)(c) of the GDPR and the principle of storage limitation that is set out in Article 5(1)(e) of the GDPR.

# Remedial measures undertaken by Airbnb Ireland UC

96. It is noted that Airbnb has confirmed that the host ID verification option, the subject matter of this inquiry, has been discontinued, with the effect that Airbnb determines the appropriate identity verification requirements to be applied in any given case involving Airbnb's general platform identity verification practices.

# Exercise of Corrective Powers by the DPC

97. In deciding on the corrective powers that are to be exercised in respect of the infringements of the GDPR outlined above, I have had due regard to the Commission's power to impose administrative fines pursuant to Section 141 of the 2018 Act. In particular, I have considered the criteria set out in Article 83(2)(a) – (k) of the GDPR. When imposing corrective powers, I am obliged to select the measures that are effective, proportionate and dissuasive in response to the particular infringements. The assessment of what is effective, proportionate and dissuasive must be made in the context of the objective pursued by the corrective measures, for example re-establishing compliance with the GDPR or punishing unlawful behaviour (or both)¹. I find that an administrative fine would not be necessary, proportionate or dissuasive in the particular circumstances in relation to the infringements of the Articles of the GDPR as set out above.

- In light of the extent of the infringements identified above, the DPC hereby issues a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the GDPR.
- In light of the ongoing infringements of Article 5(1)(c) and Article 5(1)(e) in the case of this data subject with regard to the continued retention of his supplemental photographs, it is necessary that the

¹ See the Article 29 Data Protection Working Party 'Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679, at page 11.

![img-9.jpeg](img-9.jpeg)

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

data controller bring its data processing operations into compliance with Article 5(1)(c) and Article 5(1)(e). Accordingly, pursuant to Article 58(2)(d) of the GDPR, the DPC orders Airbnb to delete from all of its systems and records the supplemental photographs that the Complainant uploaded (keeping only a record that such documentation was submitted and the date of submission). Details of compliance with this order should be provided to the DPC by Airbnb by Thursday, 21 December 2023.

- In light of the infringement of Article 5(1)(c) and to prevent similar infringements occurring with regard to data subjects in the future, the DPC orders Airbnb pursuant to Article 58(2)(d) of the GDPR to revise its internal policies and procedures to ensure that the seeking of photographic ID and supplemental photographs in the verification process for users is used only where necessary, proportionate and in accordance with the GDPR for the purpose for which the personal data is collected and processed, having regard, in particular, to Airbnb's legal obligations and the issue of whether less privacy intrusive verification methods are available and effective. Details of compliance with this order should be provided to the DPC by Airbnb by Thursday, 21 December 2023.

[Note: In a decision of the DPC in the case of IN-22-3-1 dated 21 June 2023, an order was made with regard to the revision of Airbnb's internal policies and procedures concerning user identity verification and the retention of personal data related thereto. The order in that decision, when complied with by Airbnb, will prevent infringements of Articles 5(1)(c) and 5(1)(e) occurring to data subjects in the future similar to those that occurred in this case with regard to the retention of redacted and un-redacted ID documents. Accordingly, a further order is not required in this Decision with regard to those infringements.]

# Judicial remedies with respect to the Decision of the DPC

98. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of receipt of notification of such decision. An appeal may also be taken by a data controller within 28 days of

[LOGO]

An Coimisiún um Chosaint Sonraí

Data Protection

Commission

notification; under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under Section 142, against any imposition upon it of an administrative fine by the DPC.

Signed:

Tony Delaney

Deputy Commissioner

On behalf of the Data Protection Commission

[Non-Text]

[Non-Text][{"box_2d": [126, 990,

Kimlik Doğrulama Belgelerinde Veri Minimizasyonu

Türkçe özet

Hukuki mesele

Sonuç

Karar metni