[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
DPC Ref:
DPC Complaint Ref:
Date: 28 September 2023
Complainant:
Data Controller: Airbnb Ireland UC
RE: vs Airbnb Ireland UC
This document is a Decision of the Data Protection Commission of Ireland ("DPC") in relation to DPC complaint reference, (the "Complaint"), which was lodged with the Federal Commissioner for Data Protection and Freedom of Information ("BfDI", "Federal DPA"), by ("Complainant") against Airbnb Ireland UC ("Airbnb"), and which was transferred to the Berlin Commissioner for Data Protection and Freedom of Information ("Berlin DPA") and thereafter transferred to the DPC to be handled in its role as lead supervisory authority.
This Decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General Data Protection Regulation ("GDPR").
### Communication of Draft Decision to "supervisory authorities concerned"
In accordance with Article 60(3) of the GDPR, the DPC is obliged to communicate the relevant information and submit a Draft Decision, in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a Draft Decision in relation to the matter to the "supervisory authorities concerned". As Airbnb offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as lead supervisory authority identified that each supervisory authority is a supervisory authority concerned as defined in Article 4(22) of the GDPR. On this basis, the Draft Decision of the DPC in relation to this complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.
1
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# Complaint Handling by the DPC – Timeline and Summary
1. The complaint was lodged with the Berlin DPA and was thereafter transferred to the DPC. Initial correspondence was received by the DPC on 3 September 2019, to be handled by it in its role as lead supervisory authority. The Complainant submitted that when he had tried to make a booking for a property on the Airbnb platform, his booking was not accepted until he had verified his identity by providing a copy of his ID and taking a picture with his webcam. The Complainant stated that he had booked the same property on the Airbnb platform earlier in the year and no such identity verifying conditions attached to that booking. The Complainant stated that he provided a copy of his ID and took a photograph with his webcam on four separate occasions following further requests by Airbnb, but when he did not provide the data in response to Airbnb's fifth and sixth request, Airbnb cancelled his booking. The Complainant advised that his booking was then fulfilled when the owner of the property reactivated his booking, without the need to provide the data previously sought by Airbnb. The Complainant stated that he did not consider Airbnb's request to be legal. The Complainant provided the DPC with copies of the correspondence exchanged with Airbnb. This included emails sent to him by Airbnb on 20 and 21 June 2019 which stated "On the photo you added, your ID is hard to see. In order for us to ensure that it is really you, we need a photo that clearly shows all the information on your badge. This way we can confirm the validity." and "In order for us to confirm your profile and for you to receive a new accommodation, please send us a well recognizable photo of your official ID."
2. The DPC notified Airbnb of the complaint by way of email and letter dated 29 April 2020 and provided Airbnb with a copy of the Complainant's correspondence.
3. Airbnb reverted to the DPC by email dated 14 May 2020. Airbnb stated that on 20 June 2019, the Complainant attempted to book a listing in Vienna and was asked to provide a copy of his ID to verify his identity, in accordance with Airbnb's user identity verification procedures. Airbnb stated that, in this case, identity verification was triggered by the host's requirement that prospective guests have verified their identity with Airbnb before they can book the listing in question. Airbnb advised that the copy of ID provided by the Complainant was blurry and therefore he was asked to send a clearer photo so that the verification procedure could be completed. Airbnb advised that it made this request a number of times and requested that the Complainant provide a better
2
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
quality photo by 21 June 2019 in order to proceed with the booking. It stated that the Complainant was directed to Airbnb's online Help Centre article in relation to ID verification. Airbnb stated that the Complainant failed to provide a better quality photo of his ID and the booking process was discontinued. Airbnb advised that, on 21 June 2019, the Complainant successfully booked the same listing using another Airbnb account, which Airbnb believes he shares with another person. To enable this booking, Airbnb stated that the Complainant provided a copy of his ID together with a clear photo confirming that he was the relevant ID holder.
4. Further, Airbnb stated that the safety and security of its users is of paramount importance and that it asks users to verify their identity to enable it to confirm that they are who they say they are. Airbnb stated that section 2.1 of its Privacy Policy states that certain information is required from users, including "To help create and maintain a trusted environment, we may collect identity Verification and Payment Information. Such as images of your government issued ID (as permitted by applicable laws), your ID number or other verification information, bank account or payment account information". Further Airbnb stated that as set out in its Help Centre article, some hosts require their guests to complete identity verification steps with Airbnb in order to book that host's listing. Airbnb advised that this is also referred to in section 8.1.1 of its Terms of Service "Subject to meeting any requirements (such as completing any verification processes) set by Airbnb and/or the Host, you can book a Listing available on the Airbnb Platform by following the respective booking process...". Airbnb advised that the host of the listing in question had activated this requirement for the listing, which triggered the request for verification of the Complainant's identity. Airbnb informed the DPC that the Complainant completed the booking on a second Airbnb account, having successfully verified his identity through that account.
5. The DPC informed the Complainant of Airbnb's response via correspondence that issued to the Berlin DPA on 05 June 2020.
6. The Berlin DPA provided the DPC with the Complainant's response on 30 June 2020 in which he advised that he did not consider his complaint to be amicably resolved.
7. The DPC reverted to Airbnb via email on 22 September 2020 requesting further information. Airbnb responded via email on 06 October 2020 and provided the requested information. In its response Airbnb advised that the safety and security of its users is of paramount importance to Airbnb. Airbnb stated that it is this overarching concern that informs its identity verification procedures and
3
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
its practice of respecting the prerogative of hosts, such as the host of the booking involved in this complaint, to require that prospective guest's evidence and prove their identity to Airbnb in a verifiable manner. Airbnb advised that the purpose of requiring a copy of an ID document and an image verifying that the individual is the ID holder is to combat unauthorised and illegitimate bookings, such as to prevent someone posing as an account holder, from making reservations using the ID document or a photo of the ID document of another individual. Airbnb stated that it is confident that these identity verification procedures are a necessary and proportionate means of achieving the purpose of protecting the Airbnb platform and its community against the myriad of risks associated with identifying users on an online platform, in compliance with its obligations under the GDPR. Airbnb stated that as outlined in section 2.1.1 of its Privacy Policy, with reference to the sub-heading 'Identity Verification Information', such processing is necessary to perform the contracts entered into with its users pursuant to its Terms of Service and to comply with its legal obligations, including its obligations under the GDPR. Further Airbnb stated that Section 3 of its Privacy Policy informs users that Airbnb processes their personal data for the purposes of, among other things, pursuing Airbnb's legitimate interests in providing the Airbnb platform and maintaining the platform as a trusted and safe environment. Airbnb advised that, for example, section 3.2 of the Privacy Policy provides that Airbnb will use this data to "verify or authenticate information or identifications provided by you (such as to verify your Accommodation address or compare your identification photo to another photo you provide)" with reference to Airbnb's legitimate interests in protecting the Airbnb platform. Airbnb asserted that providing a copy of an ID document is one of the most practical and easily accessible ways in which users can verify their identities.
8. Further, Airbnb stated that providing a copy of an official document such as a passport, national ID card, driver licence, etc. lends authenticity to the reservation request being made by the user. Airbnb advised that the prevalence of bad actors targeting online platforms, such as Airbnb, requires Airbnb to exercise diligence, due care and caution, in particular where hosts, such as the host of the listing in this complaint, have requested that prospective guests be verified in this manner. Airbnb stated that the limited additional step of requesting that the individual supplement the copy of the ID document provided with a photo verifying that it is the ID holder is a reasonable and necessary component of ensuring that the individual making the reservation is genuine and is the true ID holder. Airbnb asserted that given the risks in processing an illegitimate reservation, it believes that this approach is adequate, relevant and necessary for the purpose of verifying the user's identity, in alignment with the principle of data minimisation.
4
An Coimisiún um Chosaint Sonraí
Data Protection Commission
9. The DPC advised the Complainant of Airbnb's response via correspondence that was sent to the Berlin DPA on 18 December 2020.
10. The Complainant responded via correspondence provided to the DPC on 29 June 2021 advising that he wished to pursue his complaint.
11. The DPC advised Airbnb via correspondence dated 28 February 2022 that it had been unable to facilitate the amicable resolution of this complaint.
# Conduct of Inquiry
12. Acting in its capacity as lead supervisory authority, the DPC commenced an Inquiry in relation to this matter by writing to Airbnb on 22 September 2022.
13. The DPC advised Airbnb that the Inquiry commenced by the Commencement Notice would seek to examine and assess whether or not Airbnb had complied with its obligations under the GDPR and the Act, in particular under Articles 5, 6, 7, 12 and 13 of the GDPR in respect of the relevant processing operations which are the subject matter of the complaint.
14. The DPC advised Airbnb that the scope of the Inquiry concerned an examination and assessment of the following:
a. Whether Airbnb had a lawful basis for requesting copies of the Complainant's ID and photograph in order to verify his identity.
b. Whether Airbnb complied with the principle of data minimisation when processing a copy of the Complainant's ID and photograph in order to verify his account.
c. Whether Airbnb complied with the Conditions for Consent by making the Complainant's ability to complete his booking conditional on the Complainant submitting his ID and photograph in order to verify his identity.
d. Whether Airbnb complied with principles of transparency and provision of information where the Complainant's personal data was collected.
5
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
15. In order to progress the matter the DPC posed specific questions to Airbnb regarding their processing operations that are subject matter of the complaint.
16. The DPC also informed the Complainant via the Berlin DPA in a letter dated 22 September 2022 that an Inquiry had commenced in relation to his complaint. The DPC provided the Complainant the opportunity to withdraw any information previously provided and asked whether the Complainant had any new information he wished to submit regarding the complaint. The DPC's letter of 22 September, 2022 was passed on to the Complainant by the Berlin DPA on 2 January, 2023. No reply was received from the Complainant up to the date of drafting this Decision.
17. On 13 October 2022, Airbnb responded to the DPC by letter and addressed the questions posed in the DPC's Commencement Notice of 22 September 2022. In response to the DPC's query as to what legal basis Airbnb relied upon for requesting a copy of the Complainant's ID and a copy of his photograph in order to verify his identity, Airbnb submitted that it relied on the legitimate interests of the host in question who required that the identities of prospective guests be verified by ID, and its legitimate interests in facilitating this host's prerogative, which was a safety and security measure that benefitted the legitimate interests of the Airbnb community and those associated with it as a whole, in accordance with Article 6(1)(f) of the GDPR. Airbnb submitted that the request for a supplemental image of the Complainant was made to ensure that the individual submitting the ID document was indeed the person in the ID photo, as part of the pursuit of these legitimate interests.
18. Airbnb also submitted that its Terms of Service are contracts with its users, and as part of these terms and the various other constituent terms and policies that apply to the Airbnb platform (including those described in the relevant Legal Terms page) it gives effect to certain decisions and requirements of its users, including identity verification requirements which align with its identity verification practices. Airbnb stated that in a number of pages in its ID and verification Help Centre page it informs individuals that Airbnb hosts may require its guests to provide ID to book a listing. Airbnb stated that this reflects the ID requirement option it provides hosts in its account settings, which it says is also explained to hosts in pages such as the hosting section of its trust page.
19. The DPC asked why Airbnb considered it both necessary and proportionate to request a copy of the Complainant's ID photograph to verify his identity Airbnb submitted that in light of the fact that hosts welcome strangers into their homes, and the real-world risks of harm that this entails, it respects and facilitates the
6
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
prerogative of hosts to make sure that the identities of their guests are fully verified using ID documents. Airbnb submitted that providing a copy of an ID document and supplemental image through a secure portal is a reliable proof of identity that does not impose a disproportionate burden on the person. Airbnb stated that its approach aligns with established, international organisations and businesses operating across a wide variety of industries and commercial sectors, including the travel, hospitality, and short term rental industries.
20. Airbnb submitted that, as it is necessary for it to design, implement and maintain robust safety and security measures for the benefit of the Airbnb community and those connected with it, it believes that the identity verification processes, including the facilitation of host ID requirements, are a necessary and proportionate means of achieving the purpose of protecting the Airbnb community and indeed the broader community, in compliance with its obligations under the GDPR.
21. The DPC asked Airbnb whether it provides users with other means by which to verify their identity. It further asked, if another method of verification was offered, why this option was not offered to the Complainant. Airbnb submitted that in the context of the complaint the ID requirement was stipulated by the host in question, and Airbnb therefore respected this decision and facilitated this requirement.
22. In response to the DPC's query regarding why the personal data provided by the Complainant on four separate occasions were not considered sufficient to verify his identity, Airbnb submitted that its records indicate that on 20 June 2019 the Complainant submitted, in two separate uploads, unclear images of the requested identity verification images, which prevented it from being able to verify those images.
23. In response to the DPC's query regarding any data minimisation efforts made by Airbnb, in respect of the subject matter of the complaint, Airbnb submitted that it processes identity verification data so as to respect and facilitate the prerogative of hosts by ensuring that the identity of their guests are verified using ID documents. Further, Airbnb stated that it processes this data for other related security purposes, which include enhancing its security processes, for example using identity verification data in projects designed to identify fraudulent or otherwise illegitimate ID documents, identifying connecting factors between related fraudulent / potentially fraudulent accounts and investigating incidents that can be linked with verification information previously provided to Airbnb.
7
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
Airbnb stated that these purposes can be considered constituent elements of the broader, overarching purpose of protecting the Airbnb platform and those associated with it. Airbnb submitted that the Complainant's identity verification data was adequate, relevant and necessary for the purposes of facilitating the ID requirement which was stipulated by the host in question.
24. In response to the DPC's request to provide a copy of the instruction from the host that required Airbnb to request the Complainant's ID in order to verify his identity, Airbnb submitted a screenshot of the account settings page where hosts can select this ID verification option.
25. The DPC asked Airbnb to outline why it allowed a host to determine the range of personal data to be collected by the platform at the booking stage, along with the legal basis it relies on to allow a host make such a request. Airbnb submitted that it relied on the legitimate interests of the host in question, which said interests benefit the Airbnb community and those associated with it under Article 6(1)(f) of the GDPR.
26. In response to the DPC's query regarding why the Complainant was required to verify his identity again if he had previously verified his identity in March of the same year, in circumstances where the Complainant stated that he had previously stayed at the same property at the time, Airbnb submitted that the listing in question is now deactivated. Airbnb indicated its belief that the host's ID requirement was not selected at the time of the earlier reservations in February / March 2019. Airbnb submitted that the Complainant was first asked to verify his identity for the purpose of proceeding with the booking on 20 June 2019, when attempting to book the listing in question. Airbnb stated that it would also like to reiterate that for the later reservation booked in June 2019, the Complainant ultimately submitted sufficient copies of his ID and supplementary photo to reserve the listing. Airbnb submitted that its records do not align with the Complainant's assertion that he was able to book this reservation directly with the host, without the requested identity verification data.
27. In response to the DPC's query regarding how Airbnb met the conditions for consent outlined in Article 7 of the GDPR, Airbnb submitted that it did not rely on consent to process copies of the Complainant's ID and supplementary photo.
28. The DPC requested detail from Airbnb on the date the Complainant first registered as a member / host on the platform and further asked it to provide a copy of the notice available to the Complainant, on the date he created his account, outlining that Airbnb would require that he verify his identity and that the provision of ID may be necessary in order to verify his identity. Airbnb
8
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
submitted copies of the Terms of Service and Privacy Policy which were in place when the Complainant registered as an Airbnb user on 15 July 2013. Airbnb stated that the section of the Terms entitled 'Accommodation Listings' informed individuals that certain listings may have specific verification requirements, while the section of the Privacy Policy entitled 'Personally Identifiable Information' informed individuals that Airbnb requests information for identity verification purposes.
29. In response to the DPC's request that Airbnb provide a copy of the notice which outlines that Airbnb would require that he verify his identity and that the provision of ID may be necessary in order to verify his identity Airbnb directed the DPC to Sections 2.4 and 8.1.1 of the 2019 Terms of Service. It stated that these sections informed individuals about Airbnb's identity verification practices. It further directed the DPC to sections 2.1, 2.1.3, 2.1.5, 3.2 and 4.6 of the 2019 Privacy Policy which contained links to the Help Centre material regarding Airbnb's identity verification practices.
# Notification of the Preliminary Draft Decision to the Data Controller
30. The DPC provided Airbnb with a copy of the Preliminary Draft Decision and invited submissions by 02 June 2023.
31. The DPC received submissions from Airbnb dated 02 June 2023.
32. Airbnb stated that it would like to confirm that the host ID verification option, the subject matter of this inquiry, has been discontinued, with the effect that Airbnb determines the appropriate requirements to be applied in any given case, involving Airbnb's general platform identity verification practices (to be distinguished from certain identity verification practices required by law, for example identity verification requirements prescribed by anti-money laundering rules).
33. Airbnb objected to the references in the Preliminary Draft Decision to present day Airbnb Help Centre material and the EDPB access guidelines in the DPC's consideration of the matter of data minimisation. These references were removed from the Draft Decision.
34. Airbnb drew attention to three inaccuracies in the Preliminary Draft Decision. All three were dealt with in the Draft Decision.
35. The DPC has carefully considered the submissions of Airbnb in making this Decision.
9
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# Notification of the Preliminary Draft Decision to the Complainant
36. The DPC provided the Complainant with a copy of the Preliminary Draft Decision via the Berlin DPA on 12 June 2023 and invited submissions by 10 July 2023. The DPC received a communication from the Berlin DPA on 25 July 2023 which set out: "The complainant has informed us by telephone that he has no objections to the preliminary draft decision."
# Relevant and Reasoned Objections from "supervisory authorities concerned"
37. Having transmitted the Draft Decision, on 04 August 2023, to the "supervisory authorities concerned" in accordance with Article 60(3) of the GDPR, the DPC did not receive any relevant and reasoned objections under Article 60(4) of the GDPR.
38. Given that no relevant and reasoned objections were received from any of the supervisory authorities concerned, within a period of four weeks, after having been consulted, the DPC did not revise the Draft Decision.
# Applicable Law
39. For the purposes of its examination and assessment of this complaint, the DPC has considered the following Articles of the GDPR:
Article 5
Article 6
Article 7
Article 12
Article 13
# Analysis and Findings of Inquiry
# Issue A – Whether Airbnb had a lawful basis for requesting copies of the Complainant's ID and photograph in order to verify his identity
40. The Complainant asserted that, on submitting an online booking on the Airbnb platform on 19 October 2019 Airbnb requested that he provide a copy of his ID documents along with a photograph in order to verify his identity. The
10
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
Complainant contends that Airbnb did not have a legal basis to request a copy of his photographic ID and a supplementary image in the circumstances as he was already a user of the platform and he was using a verified customer account to make an online booking. [Airbnb in its submissions regarding the Preliminary Draft Decision clarified that the description of the account as being verified was inaccurate as the Complainant's identity had not been verified at that juncture, which is why the verification checks were carried out]. The Complainant stated that he had booked the same accommodation some months previously and had not been asked to provide his ID documentation on that occasion. The Complainant submits that the data already provided should have been sufficient to verify his identity when making an online booking.
41. During the course of the Inquiry, Airbnb stated that it relied on the legitimate interests of the host who required that the identity of all prospective guests be verified by ID verification. Airbnb further stated that it relied on its own legitimate interests in facilitating the host's prerogative, which was a safety and security measure that benefitted the Airbnb community and those associated with it in accordance with Article 6(1)(f) of the GDPR. Airbnb posited that the request for a supplemental image of the Complainant was made to ensure that the individual submitting the ID document was indeed the person in the ID photo, as part of the pursuit of these legitimate interests.
42. Airbnb advised the DPC that as part of the Terms of Service that apply to the users of the Airbnb platform, Airbnb give effect to certain decisions and requirements of their users, including identity verification requirements which align with their identity verification practices. Airbnb stated that individuals are informed in a number of pages within the ID and Help Centre page that Airbnb hosts may require guests to provide ID to book a listing. Airbnb advised that this ID requirement option is provided to hosts in their account settings.
43. During the DPC's handling of the complaint, the Complainant advised that he provided a copy of his ID and took a photograph with his webcam on four separate occasions at the behest of Airbnb, but when he did not provide the data in response to Airbnb's fifth and sixth request, Airbnb cancelled his booking. Airbnb in its automated responses to the Complainant on 20 June 2019 stated that "For more information on how and why Airbnb requests an ID, please contact our Help Center".
44. Article 5(1)(a) of the GDPR states that personal data shall be "processed lawfully, fairly and in a transparent manner in relation to the data subject
11
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
('lawfulness, fairness and transparency')".
Information available to the Complainant at the time of account creation
45. Airbnb provided the DPC with copies of the Terms of Service and Privacy Policy which were in place when the Complainant joined the Airbnb platform on 15 July 2013. The section of the Terms of Service 2012 entitled "Accommodation Listings" informed individuals that certain listings may have specific verification requirements. It states as follows:
"When you create a Listing, you may also choose to include certain requirements which must be met by the Members who are eligible to request a booking of your Accommodation, including, but not limited to, requiring Members to have a profile picture or verified phone number, in order to book your Accommodation. Any Member wishing to book Accommodations included in Listings with such requirements must meet these requirements. More information on how to set such requirements is available via the "Hosting" section of the Site, Application and Services."
46. Airbnb stated that the section of the Privacy Policy entitled "Personally Identifiable Information" informed individuals that it requests information for identity verification purposes. The Privacy Policy states as follows:
"When you register with us through the Site or Application and become a Member and when you choose to post a Listing or book an Accommodation, or when you wish to contact another Member, we will ask you for personally identifiable information. This refers to information about you that can be used to contact or identify you ("Identity Information"). Identity Information includes, but is not limited to, your name, phone number, email address, social security number (SSN), and home postal address, but does not include your credit card number or billing information"
47. With respect to the above notices available to the Complainant on Airbnb's website at the time the Complainant created his account, the DPC is of the view that the Complainant was on limited notice that he may be required to verify his identity.
Information available to the Complainant at the time of Airbnb's request for ID and image
48. Airbnb provided the DPC with the Terms of Service, Privacy Policy and Identity
12
[LOGO]
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
Verification Help Centre materials which were in effect when the request for identity verification was made on 19 October 2019. Airbnb submitted that certain sections of its Terms of Service 2019 and Privacy Policy 2019 inform individuals about Airbnb's identity verification practices.
49. Section 2.3 of the Terms of Service 2019 states that "Airbnb may make access to and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform, subject to certain conditions or requirements, such as completing a verification process".
50. Section 2.4 of the Terms of Service 2019 states:-
"User verification on the internet is difficult and we do not assume any responsibility for the confirmation of any Member's identity. Notwithstanding the above, for transparency and fraud prevention purposes, and as permitted by applicable laws, we may, but have no obligation to (i) ask Members to provide a form of government identification or other information or undertake additional checks designed to help verify the identities or backgrounds of Members, (ii) screen Members against third party databases or other sources and request reports from service providers, and (iii) where we have sufficient information to identify a Member, obtain reports from public records of criminal convictions or sex offender registrations or an equivalent version of background or registered sex offender checks in your local jurisdiction (if available)."
51. Section 8.1.1 of the Terms of Service 2019 states:-
"Subject to meeting any requirements (such as completing any verification processes) set by Airbnb and/or the Host, you can book a Listing available on the Airbnb Platform by following the respective book process..."
52. Section 2.1.1 of Airbnb's Privacy Policy 2019 states that "when a person signs up for an Airbnb Account, Airbnb requires certain information such as person's first name, last name, email address and date of birth, and that Airbnb may collect identity verification information, such as images of government issued ID, passport national ID card, or driving licence as permitted by applicable laws, or other authentication information, to help create and maintain a trusted environment". Section 2.1.1 of Airbnb's Privacy Policy also states that "to use certain features of the Airbnb platform (such as booking or creating a Listing), we may ask you to provide additional information, which may include your address, phone number, and a profile picture...".
13
An Coimisiún um Chosaint Sonraí
Data Protection Commission
53. Section 3.2 of Airbnb's Privacy Policy states:-
"We may use the personal information to create and maintain a trusted and safer environment such as to verify or authenticate information or identifications provided by you (such as to verify your Accommodation address or compare your identification photo to another photo you provide)..."
54. Section 4.6 of Airbnb's Privacy Policy 2019 also sets out that Airbnb may engage with third party companies and individuals who may be located outside of the EEA to provide services to it including services to help verify users' identification.
55. With respect to the above notices available on Airbnb's website at the time the Complainant was requested to provide his ID in order to verify his identity, the DPC is of the view that the Complainant was on notice that he may be required to verify his identity, including by providing a copy of his photographic ID and image/s.
# Existence of a lawful basis
56. Article 6(1)(f) of the GDPR states "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child".
57. The DPC notes that Airbnb has claimed that it relied on the legitimate interests of the host in question, who required that the identities of prospective guests be verified by ID verification, and its legitimate interests in facilitating this host's prerogative, which was a safety and security measure that benefitted the legitimate interests of the Airbnb community and those associated with it as a whole, in accordance with Article 6(1)(f) of the GDPR. The DPC notes that Airbnb stated its request for a supplemental image of the Complainant was made to ensure that the individual submitting the ID document was indeed the person in the ID photo, as part of the pursuit of these legitimate interests.
58. Noting that the platform Airbnb operates by bringing hosts and members who are unknown to each other into a situation where they may actually meet in person at the host's premises, or elsewhere, the DPC agrees that a legitimate interest exists in Airbnb ensuring it has adequate safety and security measures in place to protect users of the platform. The service operated by Airbnb is, therefore, significantly different to a purely online service such as a social media platform. Given that Airbnb members stay at the premises of a host "in the real
14
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
world", the DPC recognises the importance of verifying the identity of guests to ensure that they are who they say they are. However, as set out at paragraph 21 above, regarding whether the Complainant was provided with other means of identity verification, Airbnb stated that the ID requirement was selected by the host and that as such Airbnb respected this decision and facilitated this requirement. Given that other means of validating this guest's identity were not attempted in the first instance, the DPC finds that it was not necessary to process the photo ID and supplemental image in pursuit of the legitimate interest as a first resort. Airbnb prioritised the rights of the host over the rights of the guest (i.e. the Complainant), and failed to give due consideration to the fact that other identification methods could have been applied to authenticate the Complainant's identity in the first instance. While the DPC acknowledges that Airbnb can request ID verification documents given the 'real world' interactions members of the platform often have, a request of this nature should not be the first attempt at ID verification. In a decision adopted by the DPC on 9 January, 2023 in the case of v Airbnb Ireland UC (Case Reference Number
the DPC found that Airbnb validly relied on Article 6(1)(f) as the legal basis for processing the complainant's photographic ID in that case once all other efforts that it had deployed to verify her identity were unsuccessful. In that case, for example, Airbnb stated that it had initially attempted to verify the complainant's identity, without requesting a copy of ID on the basis of information (name, address and dates of birth) submitted by the complainant in the identity verification flow by comparing these details against reliable external databases. In the present case, however, Airbnb made no such attempts to verify the Complainant's identity by other less intrusive means prior to seeking a copy of photographic ID and this case differs fundamentally from the above referenced case in that regard. Had Airbnb first deployed other efforts to verify the Complainant's identity without achieving a successful outcome, it would have been in a better position to justify thereafter seeking a copy of photographic ID and may have been able to ground that data processing in the legal basis of Article 6(1)(f). However, without having made other attempts to verify the Complainant's identity prior to seeking a copy of photographic ID, the DPC does not consider that Airbnb could rely on Article 6(1)(f) as the legal basis for processing this complainant's photographic ID and supplemental image.
59. In those circumstances, therefore, the DPC finds that Airbnb did not validly rely on Article 6(1)(f) of the GDPR as the legal basis for processing this Complainant's photographic IDs and supplemental image.
15
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
Issue B – Whether Airbnb complied with the principle of data minimisation when processing a copy of the Complainant’s ID and photograph in order to verify his account.
60. Article 5(1)(c) of the GDPR states "personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation").
61. In the circumstances of this Complainant's case, the DPC is not satisfied that Airbnb gave adequate consideration to the principle of data minimisation when it sought from the Complainant a photo which "clearly shows all the information on your badge." The Complainant was not given any opportunity to reduce the amount of data shared to Airbnb from his photographic ID. In the circumstances of this case, the Complainant was not informed by Airbnb that redactions could be applied to data contained on his official ID and he was, instead, requested to submit a photo of his ID showing all the information on it.
62. Accordingly, there is no evidence that Airbnb sought in this case to minimise the amount of personal data sent to it with the Complainant's photo ID.
63. The DPC finds, therefore, that in the particular situation that arose in this Complainant's case, Airbnb's requirement that the Complainant verify his identity by submitting an unredacted copy of his photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR.
Issue C: Whether Airbnb complied with the Conditions for Consent by making the Complainant’s ability to complete his booking conditional on the Complainant submitting his ID and photograph in order to verify his identity.
64. The Complainant contends that his ability to complete his booking was conditional on him submitting a copy of his ID and a supplemental image to verify his identity.
65. Airbnb submitted that it relies on legitimate interests under Article 6(1)(f) of the GDPR as the legal basis for the collection and retention of ID documents and supplementary images in order to verify a party's identity and that this processing was not carried out on the basis of consent under Article 6(1)(a) or under Article 7 of the GDPR.
Article 6(1)(a) of the GDPR states "processing shall be lawful only if and to the extent that... [...]the data subject has given consent to the processing of his
16
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
or her personal data for one or more specific purposes".
67. Article 7(1) of the GDPR states "[w]here processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data."
68. Article 7(4) of the GDPR states "[w]hen assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract".
69. Given Airbnb's submissions that it did not rely on the complainant's consent in respect of the processing of his personal data, and rather that it relied on legitimate interest as per Article 6(1)(f) of the GDPR, the question of obtaining the consent of the Complainant did not occur in this case and therefore the matter of whether or not the conditions for consent were complied with does not arise for consideration. However, that being said, the DPC has made a finding at paragraph 59 above that Airbnb did not validly rely on Article 6(1)(f) of the GDPR as the legal basis for processing the Complainant's photographic IDs and supplemental image.
# Issue D: Whether Airbnb complied with principles of transparency and provision of information where the Complainant's personal data was collected
70. Article 13(1)(c) of the GDPR states "where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with the purposes of the processing for which the personal data are intended as well as the legal basis for the processing" and Article 13(1)(d) of the GDPR states "where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with, where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party".
71. Airbnb notified the DPC of the Privacy Policy, the Terms of Service and identity verification Help Centre materials which were in effect at the time the Complainant joined the Airbnb platform in July 2013. Airbnb's 2011 Privacy Policy states that it uses and processes information about users to help create and maintain a trusted and safer environment on the platform, such as verifying any identifications provided by users. Airbnb stated that links to these documents were made available to the Complainant during the account creation
17
An Coimisiún um Chosaint Sonraí
Data Protection Commission
process.
72. As set out from paragraph 45 - 54 above, Airbnb directed the DPC to particular sections of the 2011 and the 2019 Privacy Policy along with the 2012 and 2019 Terms of Service which inform users that Airbnb engages in identity verification practices and the reasons why this practice is utilised.
73. The DPC is satisfied that, taking all of the above submissions and supporting evidence into account, Airbnb, at the time of requesting copies of the Complainant's ID and image, set out the intended purposes of the processing and the legitimate interests pursued by Airbnb. The DPC finds that Airbnb met the transparency requirements of Article 13 of the GDPR.
# Decision on infringements of the GDPR
74. Following the investigation of the complaint against Airbnb Ireland UC, the DPC is of the opinion that in the circumstances of this Complainant's case, Airbnb Ireland UC infringed the General Data Protection Regulation as follows:
- The DPC finds that Airbnb did not validly rely on Article 6(1)(f) of the GDPR as the legal basis for processing the Complainant's photographic IDs and supplemental image.
- The DPC finds that in the particular situation that arose in this Complainant's case, Airbnb's requirement that the Complainant verify his identity by submitting an unredacted copy of his photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR.
# Remedial measures undertaken by Airbnb Ireland UC
75. It is noted that Airbnb has confirmed that it has discontinued the practice of allowing its hosts to request ID from prospective guests. However the DPC notes that Airbnb continues to use identity verification requirements depending on the circumstances of individual bookings on its general platform.
# Exercise of Corrective Power by the DPC
76. In deciding on the corrective powers that are to be exercised in respect of the infringements of the GDPR outlined above, I have had due regard to the
18
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
Commission's power to impose administrative fines pursuant to Section 141 of the 2018 Act. In particular, I have considered the criteria set out in Article 83(2)(a)-(k) of the GDPR. When imposing corrective powers, I am obliged to select the measures that are effective, proportionate and dissuasive in response to the particular infringements. The assessment of what is effective proportionate and dissuasive must be made in the context of the objective pursued by the corrective measures, for example re-establishing compliance with the GDPR or punishing unlawful behaviour (or both)¹. I find that an administrative fine would not be necessary, proportionate or dissuasive in the particular circumstances in relation to the infringements of the Articles of the GDPR as set out above.
77. In light of the extent of the infringements identified above, the DPC hereby issues a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the GDPR.
78. In light of the infringements identified above and to prevent similar infringements occurring with regard to data subjects in the future, the DPC proposes to order Airbnb pursuant to Article 58(2)(d) of the GDPR to revise its internal policies and procedures to ensure that the seeking of photographic ID and supplemental photographs in the verification process for users is used only where necessary, proportionate and in accordance with the GDPR for the purpose for which the personal data is collected and processed, having regard, in particular, to Airbnb's legal obligations and the issue of whether less privacy intrusive verification methods are available and effective. Details of compliance with this order should be provided to the DPC by Airbnb by Thursday, 21 December 2023.
# Judicial remedies with respect to the Decision of the DPC
79. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of receipt of notification of such decision. An appeal may also be taken by a data controller within 28 days of notification; under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under
¹ See the Article 29 Data Protection Working Party 'Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679, at page 11.
19
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
Section 142, against any imposition upon it of an administrative fine by the DPC.
Signed: Tony Delaney
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
20