An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
DPC Complaint Ref:
DPCRef:
Berlln DPA Ref:
Date: 31 January 2024
Complainant: -
Data Controller: Airbnb Ireland UC
RE:- v Airbnb
This document ;s a Decision of the Data Protection Commission of Ireland ("DPC")
in relation to DPC complaint reference, (the "Complaint"), submitted
11
by - Complainant"), against Airbnb Ireland UC ("Airbnb"), to the Berlin
Commissioner for Data Protection and Freedom of Information ("Berlin DPA") in its
capacity as the concerned supervisory authority and thereafter referred to the DPC
in its capacity as lead supervisory authority.
This Decision is made pursuant to the powers conferred on the DPC by section
113(2)(a) of the Data Protection Act 2018 ("the Act") and Article 60 of the General
Data Protection Regulation (•GDPR").
Communication of Draft Decision to "Supervisory Authorities Concerned"
In accordance with Articie 60(3) of the GOPR, the DPC is obliged to communicate
the relevant infonnation and submit a Draft Decision, in relation to a complaint
regarding cross border processing, to the supervisory authorities concerned for their
opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a Draft Decision in relation to
the matter to the "supervisory authorities concemecr. As Airbnb offers services
across the EU, and therefore the processing is likely to substantially affect data
subjects in evecy EU member state, the DPC in its role as lead supervisory authority
identified that each supervisory authority is a supervisory authority concerned as
defined in Article 4(22) of the GDPR. On this basis, the Draft Decision of the DPC in
relation to this complaint was transmitted to each supervisory authority in the EU
and EEA for their opinion.
- 1
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
Complaint Handling by the DPC - Tlmallna and Summary
1. The complaint was lodged with the Berlin DPA and thereafter was transferred to
the DPC, on 7 February 2020, to be handled by the DPC in its role as lead
supervisory authority. The Complainant alleged that, during the course of his
registration with the platform, Airbnb sought a copy of his Identity to complete the
registration process. The Complainant entered his email address and phone
number. He also ticked a box to be excluded from advertising emails. The
Complainant stated that once he was asked to submit his I.D. documentation, he
decided to abort the registration process. He provided his email address and
created a password to access an internal area within the platform and within this
area, he asked Airbnb to delete all his personal data and lo ensure that none of his
data was transferred to third parties. The Complainant stated that he was told that
it was not possible to delete his data without his I.D. The Complainant stated that
he did not consider Airbnb's request for I.D. to have any legal basis and that it was
an infringement of the principle of data minimisation by Airbnb. He also had
concems in relation to an alleged infringement of his right to erasure of his personal
data. The Complainant provided the DPC with copies of the correspondence he
exchanged with Airbnb.
2. The DPC notified Airbnb of the complaint by way of email and letter dated 25 May
2020 and provided Airbnb with a copy of the Complainant's complaint.
3. Airbnb reverted to the DPC by email dated 26 May 2020 indicating that it could not
locate an account related to the Complainant with the email address provided to it
and asked that the DPC confirm the Complainant's email address with him. By way
of response, the Complainant confirmed the email address that had been provided
and stated thatAirbnb had communicated with him through this email address. The
Complainant provided evidence of this communicatfon. In correspondence with the
DPC on 27 October 2021, Airbnb stated that without access to a specific account,
it would be limited in its abl!ity to respond to the specific questions raised by the
Complainant. Notwithstanding Alrbnb's lnablltty to locate an account linked with the
Complainant, it responded to the queries raised by the DPC on behalf of the
Complainant on 01 December 2021.
4. In relation to the Complainant's query as to why his data was not automatically
erased once his account had been deleted, Airbnb stated that account deletion is
2
An Coimisiun um
Chosaint Sonrai
Data Protect ion
Commission
a pem,anent deletion of personal data and closure of the Airbnb account. Having
regard to the request for proof of identity, Airbnb stated that, although it couldn't
confim, any specific actions taken in relation to the Complainant, in 2019 1.0.
verification represented Airbnb's preferred first-line method of authenticating
deletion requests.
5. With regard to the Complainant's request for a confirmation from Airbnb that his
data was not shared with any third parties, Airbnb stated that it does not sell user
data for advertising purposes. It further stated that it does not review, scan or
analyse messaging communications to send third party marketing messages to
users and it does not sell, review or anatyse any of these communications. Airbnb
stated that it could not address this matter with specificity given that it could not
locate any account linked with the Complainant.
6. The DPC reverted to the Complainant notifying him of the progress of his
complaint. The DPC advised the Complainant that Airbnb provided further
information regarding its position in respect of the concerns identified in his
complaint and set out the contents of Ajrbnb's email dated 01 December 2021.
7. The DPC invited the Complainant to submit his comments, if any, in relation to the
information provided by Airbnb and also invited him to ~tout any outstanding
concerns he had in relation to the issues raised in his initial complaint.
8. The Complainant reverted to the Berlin DPA by letter dated 03 February 2022
stating that he was not satisfied with Alrbnb's response and that his complaints had
not been addressed or resolved.
9. In summary, therefore, the DPC was unable to arrange or facilitate within a
reasonable time an amicable resolution of the complaint through the mechanism
of its complaint handling process.
Conduct of Inquiry
10. Acting in its capacity as lead supervisory authority, the DPC issued a Notice of
Commencement of Inquiry, Including a request for information, to Airbnb on 08
December 2022.
3
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
11. The DPC notified Airbnb that the Inquiry would seek to examine and assess
whether Airbnb had complied with its obligations as a data controller under the
GDPR and the Act in respect of the relevant processing operations which are the
subject matter of the complaint.
12. The DPC notified Airbnb that the scope of the Inquiry concerned an examination
and__assessment of the following:
a) Whether Airbnb had a lawful basis for requesting the Complainant's I.D. at
the point of registration of an account.
b) Whether Airbnb had a lawful basis for requesting a copy of the
Complainant's I.D. in order to verify his ident9 so that he could delete his
account.
c) Whether Airbnb complied with the principle of data minimisation when
requesting a copy of the Complainant's I.D. in order to verify his account
and when processing personal data relating to same.
d) Whether Airbnb complied with principles of transparency and provision of
infonnation at the point when the Complainant's personal data was collected
from him.
13. The DPC notified the Complainant, by email and letter including a request for
infonnation, sent to the Berlin DPA on 18 November, 2022 that an Inquiry had
commenced In relation to his complaint. In his response received 6y the DPC on
26 September, 2023 the Complainant confirmed that he attempted to register with
Airbnb as a guest on 11 May, 2019. He also confinned that he did not provide
Airbnb with a copy of his ID as he cancelled his registration because "/ did not
agree with the demanded data processing. During the erasure reqtJest, I was told
that this would only work with an ID copy. Which I refused."
14. On 12 January 2023, Airbnb provided the DPC with its response to the questions
posed in the DPC's Notice of Commencement. Airbnb stated at the outset that this
inquiry relates to a Complainant that it has not been able to link with an Airbnb
account.
4
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
15. Airbnb stated that in the circumstances, Airbnb was being asked a number of
specific questions regarding an account that it cannot locate and which it suspected
was deleted following the Complainant's request a number of years ago. Airbnb
stated that, as such, it was restricted in its ability to respond to certain of the
questions included in the Commencement Notice.
16.Airbnb stated that It does not require new Airbnb users creating their accounts to
provide 1.0. documents as part of registering an account, and can confirm that in
2019 when the Complainant seemed to have Joined the platfonn, such a
requirement would not have been imposed on him. Airbnb also stated that
regarding verification of the Complainant's identity for the purpose of exercising his
erasure request it appeared that in this instance the Complainant was not required
to provide his I.D. document either. Airbnb stated that it had, however, a policy of
requesting I.D. verification for deletion requests under Article 17 of the GDPR,
which was in place in 2019 but was replaced in 2020 by two-factor authentication
methods and other authentication methods that do not require I.D. documents.
Airbnb stated that in 2019 it facilitated alternative authentication methods to I.D.
verification and, based on the information provided to it in this complaint, including
material from the Complainant, the evidence suggests that the Complainant's
deletion request was authenticated through account login and his account was
subsequently deleted.
17. In response to the DPC's question as to the legal basis relied upon by Airbnb for
requesting a copy of the Complainant's 1.0. in order to verify his identity at the
registration stage and subsequently to enable him to delete his partially created
account, Airbnb stated that it does not require new users creating their accounts to
provide I.D. documents as part of registering an account, and would not have
imposed this requirement on the Complainant. Airbnb stated that since it cannot
relate any account to the Complainant, it was unable to specifically comment on
the basis for a request of the Complainant's I.D. documentation (if any) prior to his
deletion request. Airbnb stated that where it requested I.D.'s to authenticate
deletion requests In the past, it relied on a variety of legitimate Interests including
its legitimate Interests in verifying the authenticity of the request and the legitimate
interests of account holders generally in ensuring that their accounts were not
deleted in Illegitimate or otherwise inappropriate circumstances, in accordance with
Article 6( 1)(f) of the GDPR.
18. In response to whether Airbnb considered it both necessary and proportionate to
request a copy of members' 1.0. to verify their Identity so that they can delete their
account, particularly in circumstances where no I.D. had previousfy been provided
5
An Coimisiun um
Chosaint Sonrai
Data Protect io n
Commission
Airbnb stated that although it believes that it fulfilled the Complainant's erasure
request without requiring 1.0. in this instance, in 2019, 1.0. verification represented
its preferred method of authentication for erasure requests, given the probative
value of 1.0. verification and the safety and security issues relating to the nature of
the Airbnb platfonn, including the need to preserve accounts that may be
necessary for travel abroad or which may support an important element of an
individual's livelihood. Airbnb stated that the corroborative value of requesting 1.0.
was not dependant or predicated on there being a p~existing I.D. on a user's
account, and instead fonned part of a holistic approach to identity identification,
carried out wJth reference to the totality of infonnation available to Airbnb. Airbnb
stated that given that it was and is necessary for it to design, implement and
maintain robust safety and security measures, it believes that I.D. verification
formed part of a necessary and proportionate suite of measures, which included
alternative verification measures where appropriate, designed to protect the
platform, community and all those associated with it. However, Airbnb stated that
as clarified previously, it no longer uses I.D. documents to authenticate deletion
requests.
19.Airbnb stated that in 2019, I.D. verification represented the preferred method of
authentication, given the probative value of I.D. verification and the safety and
security issues relating to the nature of the platform, but alternative verification
methods were facilitated where possible and appropriate. Airbnb stated that based
on the information available to it, it appears that one such method, namely account
login, was ultimately used tQ authenticate the Complainant's deletion request.
20. In relation .to the OPC's query concerning any data minimisation efforts used by
Airbnb in respect of the subject matter of this complaint. Airbnb stated that based
on the infonnation provided to it in the complaint, the evidence suggests that the
Complainant's deletion request was authenticated through account login as an
alternative to I.D. verification, with the effect that no processing of I.D.
documentation took place.
21. In response to what, if any, reasonable doubts Airbnb had as to the Complainant's
identity, which led it to consider it necessary to request I.D. in the context of
processing the Complainant's erasure request, Airbnb stated that in circumstances
where it has very little information in relation to the underlying facts, Alrbnb is not
in a position to comment on any reasonable doubts in existence at the time in
question.
6
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
22. The DPC queried when and how Airbnb first notified the Complainant of its Terms
of Service, Identification Verification Policy and Privacy Policy and requested It to
supply the DPC with copies of same which applied at the time the Complainant
attempted to register as a member and that applied at the time Airbnb requested a
copy of the Complainant's I.D. in 2019. In response to this Airbnb stated that the
lack of infonnation available to it leaves it unable to respond to specific questions
such as this. Airbnb stated however, that based on information provided to it by the
DPC, it appears that the Complainant created an Airbnb account on 11 May 2019
and subsequently submitted a deletion request on 12 May 2019. Airbnb included
copies of its applicable tenns of service "Attachment 2 - Terms of Service (2019Y
and privacy policy "Attachment 3-Privacy Policy (2019)"with its response. Airbnb
stated:-
"Sections 2.4 and B. 1. 1 of the terms of service informed individuals about
Airbnb's identity verification practices. as did sections 2.1.1, 2.1.3, 2.1.5, 3.2,
and 4.6 of the privacy policy, which also contained links to Help Centre material
regarding Airbnb's identity verification practices. Links to these terms and
policies were made available to users during the account creation process. 11
23. In response to the DPC's query to Airbnb to confirm whether the Complainant's
erasure request was given effect to, completed and the date that all data was
deleted, Airbnb stated again that in light of the lack of information available to it in
relation to this complaint It was unable to fully respond to certain questions such
as this. Airbnb stated however, that based on the information that has been
provided to it, it believed that the Complainant submitted a deletion request on 12
May 2019 and that this request was authenticated by account login at some point
between 12 May 2019 and 21 May 2019, after which point the Complainant's
account was deleted. Airbnb stated that this was supported by the evidence
provided by the Complainant that Airbnb responded to him on 21 May 2019, in
which response Airbnb confirmed that his account would be deleted. Airbnb stated
that while It was not in a position to confirm the precise date on which the
Complainant's account was deleted, given how quickly he requested the deletion
post--creation, it was likely that deletion of an account with such minimal activity
would have been completed promptly, for example in a matter of days. Airbnb also
stated that the fact that it cannot locate an account connected with the Complainant
provides further evidence that the Complainant's erasure request was given effect
to and his account was deleted.
7
An Coimisiun um
- Chosaint Sonrai
Data Protection
Commission
Notification of the Preliminary Draft Decision to the Data Controller
24. The DPC provided Airbnb with a copy of its Preliminary Draft Decision on 7
November 2023 and invited submissions from Airbnb.
25.By correspondence dated 9 November 2023, Airbnb stated that it did not intend
to make any final submissions in respect of the Preliminary Draft Decision.
Notification of the Preliminary Draft Decision to the Complainant
26. The DPC provided the Complainant with a copy of its Preliminary Draft Decision
via the Berlin DPA, on 14 November 2023, and invited any submissions by 5
December 2023.
27. By correspondence dated 3 December 2023, the Complainant submitted his
response to the DPC's preliminary draft decision where he stated
"If the elements already discussed are included there once again, then it suits me
fine."
28. The DPC has carefully considered the submissions of the Complainant in making
this Decision.
Relevant and reasoned Obiectlons from "supervisory authorities
concerned"
29. Having transmitted the Draft Decision on 20 December 2023 to the "superv•sory
authorities concemed" in accordance with Article 60(3) of the GDPR, the DPC did
not receive any relevant and reasoned objections under Article 60(4) of the
GDPR.
30.Given that no relevant and reasoned objections were received from any of the
supervisory authorities concerned within a period of four weeks, after having been
consulted on 20 December 2023, the DPC did not revise the Draft Decision.
Applicable Law
31.For the purposes of its examination and assessment of this complaint, the DPC
has considered the following Articles of the GDPR:
8
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
• Article 5
• Article 6
• Article 12
• Article 13
• Article 17
Analysis and Findings of Inquiry
Issue A - Whether Airbnb had a lawful basis for requesting a copy of the
Complainant's I.D. in order to verify his identity at account creation stage
32. During the course of the Inquiry, Airbnb stated that it does not require new Airbnb
users creating their accounts to provide 1.0. documents as part of registering an
account and that it would not have imposed this 1.0. requirement in 2019 on the
Complainant. It went on to state that it cannot relate any account to the
Complainant and is therefore unable to specifically comment on the basis for a
request for the Complainant's r.o. documentation (if any) prior to his deletion
request.
33. The DPC has closely examined the infonnation supplied by the Complainant with
this complaint. It appears from that evidence that a request for a photocopy of proof
of identity was first made by Airbnb on 12 May, 2019 at 03:55 in a letter to the
Complainant which began as follows: "We understand that you would like to
exercise one ofyour rights under the General Data Protection Regulation (GDPR),
namely the right of erasure ..... .. We kindly ask you to re-send your request and to
attach a photocopy of yourp roof of identity.• A second communication was sent
to the Complainant on 13 May, 2019 by Airbnb at 01:39 which stated as follows:
"To provide us with a copy of your government ID, to verify your identity as the
account holder, please log into your a ccount within the next 3 days. Once we
confirm a successful log in, we will be able to proceed." From the evidence provided
by the Complainant, the ID ~uest made by Airbnb to the Complainant arose in
the context of his erasure request only. No evidence has been provided to the DPC
to show that a request for a copy of photographic ID was made by Alrbnb at an
earlier stage during the registration/account creation process - albeit that both the
9
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
registration process and the request for erasure were initiated by the Complainant
within a short space of time between 11 and 12 May, 2019.
34. From the evidence supplied by the Complainant, the DPC is satisfied that
Alrbnb's request for a copy of photographic ID arose in this case in the
context of the request for erasure. Therefore, in the absence of evidence that
a copy of photographic ID was sought from the Complainant by Airbnb
during the course of the account creation process, the DPC finds that Airbnb
did not Infringe the GDPR In relation to that specific matter.
Issue B - Whether Alrbnb had a lawful basis for requesting a copy of the
Complainant's ID In order to verify his identitv so that he could delete his
account
35.Article 5(1 )(a) of GDPR states that personal data shall be "processed lawfully, fairly
and in a transparent manner in relation to the data subject".
36. According to the documents supplied by the Complainant, on 12 May 2019 after
submitting an erasure request to Airbnb on that date he received a reply stating,
among other things, the following: "We understand that you would like to exercise
one of your rights under the General Data Protection Regulation (GDPR), namely
the right oferasure. As a data controller, Alrbnb has to verify that the person making
the request is, in fact, the data subject entitled to make it, We (sic) have
implemented identification and verification procedures to ensure that we do not
edit, delete or hand over personal information at the request of, or to a person
impersonating a data subject. We kindly ask you to re-send us your request and to
attach a photocopy of your proof of Identity."
37.Airbnb advised the DPC that at the time the Complainant submitted his erasure
request in May 2019 I.D. verification was the preferred method of authenticating
deletion requests. Alrbnb went on to confirm that his erasure request was
authenticated by account login at some point between 12 May 2019 and 21 May
2019, after which point the Complainant's account was deleted.
38.Article 4(2) of the GDPR defines "processing"as ·any operation or set ofoperations
which is performed on personal data or on sets of personal data, whether or not by
automated means, such as collection, recording, organisation, structuring, storage,
10
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
adaption or a"sratlon, retrieval, consultation, use, disclosure by transmis sion,
dissemination or otherwise making available, allgnm&nt or combination, restriction,
erasure or destruction".
39. Article 6( 1)(f) of the GDPR states that the processing of personal data shall be
lawful only if and to the extent 'Yhs processing is necessary for the purposes ff
legitimate interest pursued by the controller or by a third party, except where such
interests are overridden by the Interest of the fundamental rights and freedoms of
the data subject which require protection of personal data, in particular where the
data subject is a child".
40. The DPC notes that Airbnb has stated that where it requested I.D.s to authenticate
deletion requests in the past. it relied on a variety of legitimate interests including
Its legitimate interests in verifying the authenticity of the request and the legitimate
interests of account holders generally in ensuring their accounts were not deleted
in illegitimate or otherwise inappropriate circumstances, in accordance with Article
6(1 )(f) of the GDPR. While the DPC considers that a legitimate interest does exist
for Airbnb to ensure that it does not delete personal data in an illegitimate or
Inappropriate circumstance, in this instance Airbnb has not demonstrated to this
inquiry that the request for a copy of the Complainant's ID was either necessary or
proportionate for the completion of the erasure request as Airbnb was able to
confirm his identity through other means - i.e. in this instance by account login.
41.Airbnb contended that it had fulfilled the Complainant's erasure request without
requiring I.D. documentation in this instance. It stated that in 2019, when the
Complainant made his erasure request I.D. verification was the preferred method
of authentication for erasure request given the probative value of I.D. verification
and the safety and security issues relating to the nature of the Airbnb platform. This
included the need to preserve accounts that may be necessary for travel abroad
or which may support an important element of an individual's livelihood. It
continued that the corroborative value of requesting 1.0. was not dependent or
predicated on there being a pre-existing I.D. on a user's account, and Instead
formed part of a holistic approach to Identity verification, carried out with reference
to the totality of information available to Alrbnb.
42. Airbnb stated that given that It was and Is necessary to design, implement and
maintain robust safety and security measures, It believes that 1.0. verification
formed part of a necessary and proportionate suite of measures, which included
altematNe verification measures where appropriate, designed to protect the Airbnb
11
An Coimisiun um
Chosaint Sonrai
Data ProEection
Commission
platfonn and community and aH those associated with it. It further clarified t hat it
no longer uses I.D. documents to authenticate deletion requests.
43. The DPC notes A irbnb's view that it fulfilled the Complainant's erasure request
without requiring I.D. documentation in this instance. However, as outlined above,
Airbnb sent a communication to the Complainant in response to his erasure
request on 12 May 2019 that specifically asked him to re-send his request "and to
attach a photocopy of your proof of identity." The DPC considers that Airbnb's
request to the Complainant to provide a copy of his I.D. in order for him to exercise
his rights pursuant to Article17 of the GDPR constituted the collection of personal
data. This was data processing as per the definition set out in Article 4(2) of the
GDPR. In this case, the DPC does not consider that the legitimate interest pursued
by thecontroller constitutes a valid lawful basis under Article 6 for that specific data
processing activity.
44. The DPC finds that, in the specific circumstances of this complaint, the
legitimate interest pursued by the controller does not constitute a valid
lawful basis under Article 6 of the GDPR for seeking a copy of the
Complainant's I.D. in order to process his erasure request.
Issue C - Whether AJrbnb complied with the principle of data mlnimlsatJon
when requesting a copy of the Complalnant's ID In order to verify his account
and when processing personal data relating to same.
45. Article 5(1 )(c) of the GDPR states "personal data shall be adequate, relevant and
limited to what is necessary In relation to the purposes for which they are processed
("data minimisation")."
46. Article 12(6) of the GDPR states that "without prejudice to Article 11, where the
controller has reasonable doubts concerning the identity of the natural person
making the requests referred to in Articles 15 to 21, the controller may request the
provision of additional information necessary to confirm the identity of the data-
subject".
4 7. The DPC notes that Alrbnb has advised that it was not in a position to comment on
any reasonable doubts In existence at the time of the erasure request about the
identity of the Complainant given that the underlying account has been deleted.
The DPC considers that Airbnb has not sufficiently demonstrated to this inquiry
12
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
that it had reasonable doubts concerning the identity of the individual who had
made the erasure request such as would have justified it seeking to confirm their
identity by the provision of a copy of their I.D. In addition, the DPC does not
consider that the request for I.D. was either necessary or proportionate in
circumstances where a user has requested the erasure of their personal data,
especially in circumstances where there were less data-driven solutions available
to Airbnb to confinn the Complainant's identity. As such Airbnb has not
demonstrated that it had a reasonable doubt as to the user's identity In accordance
with Article 12(6).
48. The DPC is of the view that other methods were available to Airbnb in May 2019
when the Complainant made his erasure request that would have negated the need
for Airbnb to request a copy of his ID. Airbnb has failed to provide evidence to this
Inquiry to demonstrate that it first attempted to utilise other tools it already
possessed, such as authentication through account login (the method
subsequently used after the Complainant did not comply with the request to provide
a copy of I.D.).
49. In the circumstances of this Complainant's case, the DPC is not satisfied that
Alrbnb gave adequate consideration to the principle of data minimisation when it
sought a copy of the Complainant's I.D. on foot of his erasure request in May 2019.
50. The DPC finds, therefore, that in the particular situation that arose in this
Complainant's case, Alrbnb has not demonstrated that reasonable doubts existed
concerning the Complainant's identity that would have necessitated the application
of Article 12(6) of the GDPR.
51. Furthermore, the DPC finds that, in the specific circumstances of this
complaint, the request by Airbnb that the Complainant verify his identity by
way of submission of a copy of his I.D. constituted an Infringement of the
principle of data minimisation, pursuant to Artlcle 5(1)(c) of the GDPR.
Issue D: Whether Airbnb complied with principles of transparency and
provision of infonnatlon where the Complainant's personal data was
collected
52. Article 13(1 )(c) of the GDPR states "where personal data relating to a data subject
are collected from the data subject, the controller shall, at the time when personal
data are obtained, provide the data subject with the purposes of the processing for
13
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
which the personal data are intended as well as the legal basis for the processing'
and Article 13(1Xd) of the GDPR states "where personal data relating to a data
subject are collfJcted from the data subject, the controll9f shall, at the time when
personal data are obtained, provide the data subject with, where the processing is
based on point (f) of Article 6(1), the legitimate interests pursued by the controller
or by a third party".
53. In its response to the DPC dated 12 January 2023 Airbnb stated that it was unable
to link the complaint to an Airbnb account. It continued that based on the
information provided to it by the DPC, it appeared that the Complainant created an
Airbnb account on 11 May 2019 and subsequently submitted a deletion request on
12 May 2019. Airbnb then provided a copy of the applicable terms of service and
privacy policy that were in place at the time of the account creation and erasure
request in 2019.
54.Section 2.4 of the Tenns of Service 2019 states:-
"User verification on the internet is difficult and we do not assume any
responsibility for the confirmation ofany Member's Identity. Notwithstanding the
above, for transparency and 'fraud prevention purposes, and as permitted by
applicable laws, we may, but have no obligation to (i) ask Members to provide
a form of government Identification or other information or undertake additional
checks designed to help verify the identities or backgrounds of Members, (ii) -
screen Members against third party databases or other sources and request
reports from service providers, and (iii) where we have sufficient information to
identify a Member, obtain reports from public records of criminal convictions or
sex offender registrations or an equivalent version of background or registered
sex offender checks in your local jurisdiction (if available)."
55. Section 2.3 of the Terms of Service 2019 states that "Airbnb may make access to
and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform,
subject to certain conditions or requirements, such as completing a verification
process".
56. Section 4.2 of the Terms of Service 2019 states that a person "can register an
Airbnb Account using an email address and creating a password, or through your
account, or through your account with certain third-party social networking
services".
57. Section 2.1.1 of Airbnb's Privacy Polley 2019 states that "when a person signs up
for an Airbnb Account, Airbnb requires certain information such as person's first
14
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
name, last name, email address and date of birth, and that Airbnb may collect
identity verification information, such as images ofgovernment issued ID, passport
national ID card, or driving licence as permitted by applicable laws, or other
authentication information, to help create and maintain a trusted environment."
58. Section 3.2 of Airbnb's Privacy Policy 2019 states that "Airbnb may use, store, and
process personal information to create and maintain a trusted and safer
environment, such as to detect and prevent fraud, security incidents and other
harmful activity; to verify or authenticate information or identifications provided by
a person; to verify the accommodation address; to compare the identifications
photo to another photo the person provides; to conduct checks against databases
and other information sources to the extent permitted by applicable laws and with
a person's consent where required". Section 3.2 of Alrbnb's Privacy Policy 2019
states that "Airbnb processes this personal information for these purposes given
its legitimate interest in protecting the Airbnb Platform, to measure the adequate
performance of its contract with the person, and to comply with applicable laws".
59. With respect to the above notices available on Airbnb's website in May 2019 when
the Complainant was requested to provide a copy of his 1.0. the DPC is of the view
that the complainant was on notice that he may be required to verify his identity
including by providing a copy of photographic ID.
60. Having reviewed Airbnb's privacy policies and terms of service that were in place
In May 2019, the DPC is satisfied that there was sufficient Information within those
documents to infonn members that Airbnb may seek a copy of photographic ID to
verify identity.
61 . In that regard, therefore, and In the circumstances of this
Complainant's case, the DPC finds that Alrbnb complied with the
requirements set out in Article 13(1) of the GDPR with regard to the provision
of Information to the data subject.
Decision on Infringements of the GDPR
62. Following the investigation of the complaint against Airbnb Ireland UC, the OPC is
of the opinion that in the circumstances of this Complainant's case, Airbnb Ireland
UC Infringed the General Data Protection Regulation as follows:
15
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
• The DPC finds that, in the specific circumstances of this complalnt,
the legitimate interest pursued by the controller does not constitute
a valid lawful basis under Article 6 of the GDPR for seeking a copy of
the Complainant's J.D. In order to process his erasure requesL
• The DPC finds that, In the specific circumstances of this complaint,
the request by Airbnb that the Complainant verify his identity by way
of submission of a copy of his I.D. constituted an infringement of the
principle of data minimisation, pursuant to Article 5(1)(c) of the
GDPR.
Remedial measures undertaken bv Airbnb Ireland UC
63. It is noted that Airbnb has confirmed that it has discontinued the practice of
requesting a copy of I.D. in order verify erasure requests.
64. The DPC also notes that in this particular case after the initial request by Airbnb
for the Complainant to submit a·copy of his proof of identity in order to have his
erasure request processed, the Complainant's erasure request was authenticated
through account login and his request was subsequently processed.
Judicial remedies with respect to the decision of the DPC
65. In accordance with Article 78 of the GDPR, each natural or legal person has the
right to an effective judicial remedy against a legally binding decision of a
supervisory authority conceming them. Pursuant to Section 150(5) of the Act, an
appeal to the Irish Circuit Court or the Irish High Court may be taken by a data
subject or any other person (this includes a data controller) affected by a legally
binding decision of the DPC within 28 days of receipt of notification of such
decision. An appeal may also be taken by a data controller within 28 days of
notification; under Section 150(1) against the issuing of an enforcement notice
and/or infomiation notice by the DPC against the data controller; and under Section
142, against any imposition upon it of an administrative fine by the DPC.
16
An Coimisiun um
Chosaint Sonrai
Data Protection
Commission
Exercise of Corrective Power by the DPC
66. In deciding on the corrective powers that are to be exercised in respect of the
infringements of the GDPR outlined above, I have had due regard to the
Commission's power to impose administrative fines pursuant to Section 141 of the
2018 Act. In particular, I have considered the criteria set out in Article 83(2) (a) -
(k) of the GDPR. When imposing corrective powers, I am obliged to select the
measures that are effective, proportionate and dissuasive in response to the
particular infringements. The assessment of what Is effective, proportionate and
dissuasive must be made in the context of the objective pursued by the corrective
measures, for example re--establishing compliance with the GDPR or punishing
unlawful behaviour (or both)1• I find that an administrative fine would not be
necessary, proportionate or dissuasive in the particular circumstances in relation
to the infringements of the Articles of the GDPR as set out above.
67. In llght of the extent of the Infringements Identified above, the DPC hereby
Issues a reprimand to Alrbnb Ireland UC, pursuant to Article 58(2)(b) of the
GDPR.
[Note: In a Decision of the DPC in the case of IN-22-9-2 dated 28 September 2023, an
order was made with regard to the revision of Airbnb's internal policies and procedures
concerning the seeking of I.D. in the verification process for users of the Alrbnb platform.
The order in that Decision, when complied with by Airbnb, will prevent infringements of
Articles 5(1 )(c) occurring to data subjects in the Mure similar to those that occurred in this
case. Accordingly, a further order is not now required in this Decision.
Signed: _ _ _____,1--,1.......=-.::::.........;.;;;..;;..'---
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
1
See the Article 29 Data Protection Working Party 'Guidelines on the application and setting of administrative
fines for the purposes of Regulation 2016/679, at page 11.
17
An Coimisiun um
Chosaint Sonraf
Data Protection
Commission
18