An Coimisiun um
— Chosaint Sonrai
s Data Protection
Commission
DPC Ref:
DPC Complaint Ref: p |
Date: 20 July 2023
Complainant:
Data Controller: Airbnb Ireland UC
RE: (\ Airbnb Ireland uc
DECISION
This document is a decision of the Data Protection Commission (“DPC”) in relation to DPC Complaint
reference P| hereinafter referred to as the (“Complaint”), submitted by P|
(“Complainant”) against Airbnb Ireland UC (“Airbnb”) to the Berlin Commissioner for Data Protection
and Freedom of Information (“Berlin SA”), in its capacity as the concerned supervisory authority. The
Complaint was thereafter referred to the DPC in its capacity as lead supervisory authority (LSA).
This decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data
Protection Act 2018 (“the Act”) and Article 60 of the General Data Protection Regulation (“GDPR”).
Communication of Draft Decision to “supervisory authorities concerned”
In accordance with Article 60(3) GDPR, the DPC was obliged to communicate the relevant information
and submit a draft decision in relation to a complaint regarding cross border processing, to the
supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a draft decision in relation to the matter to the
“supervisory authorities concerned”. As Airbnb offers services across the EU, and therefore the
processing is likely to substantially affect data subjects in every EU member state, the DPC in its role
as LSA identified that each supervisory authority is a supervisory authority concerned as defined in
Article 4(22) GDPR. On this basis, the draft decision of the DPC in relation to this Complaint was
transmitted to each supervisory authority in the EU and EEA for their opinion.
Complaint Handling by the DPC — Timeline and Summary
1. The Complaint that is the subject of this decision was originally submitted to the Berlin SA on 1
January 2019. The Complaint concerns Airbnb’s handling of a subject access request and an
erasure request made by the Complainant on 6 July, 2018 as well as Airbnb’s initial response to
those data protection rights requests by seeking a copy of ID from the Complainant.
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
The background was as follows: the Complainant claimed that Airbnb had failed to comply with
two erasure requests he submitted on 18 September 2015 and 12 October 2015 (prior to the
application of the GDPR on 25 May 2018). When the Complainant logged back into his Airbnb
account on 9 June 2018, the Complainant discovered his account was still active. The Complainant
submitted an access request on 6 July 2018 by email, requesting for Airbnb to provide access to
his personal data as well as any further information about the processing of his personal data.
“| hereby make use of my right according to the GDPR and demand full access to information.
1am particularly interested
a) what data you have stored about me
b) where you got this data from,
c) if they were not entered by me when registering, on what legal basis you obtained the data
and
d) to whom you have transferred them.
| expressly object a transfer to third parties.”
In addition to the email requesting access to his personal data, the Complainant also asked why
his previous erasure requests had not been carried out in 2015, and in addition requested the
erasure of his Airbnb account. “Furthermore, | expect an explanation as to why you have not
deleted my account, despite two requests (on 18.09.2015 and on 12.10.2015), both by email to
[email protected]). To avoid misunderstandings: the account should be DELETED, not
DISABLED.”
On 6 July 2018, Airbnb sent an email to the Complainant acknowledging receipt of his email. On
17 July 2018, Airbnb contacted the Complainant via email acknowledging receipt of the
Complainant’s access request and erasure request. “You’ve informed us that you would like to
exercise two of the rights provided by the GDPR, namely the right of access to your data and the
right to have your data erased.” Airbnb requested a copy of the Complainant’s proof of identity
in order to verify that the person making the requests was actually the person entitled to do so.
On 18 July 2018, in response to Airbnb’s email of 17 July 2018, the Complainant refused to provide
a copy of his identity. “What | find is unacceptable, however, is that | should send you a copy of
my ID. Neither for the initial registration, nor for bookings or the deletion of the account is or was
the sending of a copy of an ID required.”
Upon refusal by the Complainant to provide a copy of his ID, Airbnb contacted the Complainant
on 19 July 2018. It acknowledged that he would not like to give a copy of his proof of identity and
it went on to say that “since we still have to authenticate your request via the contact from the e-
mail address on file, | can offer you that we can call you. Would it be possible to do so under the
telephone number provided?” On 23 July 2018 the Complainant agreed to this. Airbnb conducted
a telephone call with the Complainant on 31 July 2018 to authenticate his requests.
10.
11.
12.
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
On 30 August 2018, Airbnb responded to the Complainant’s access request providing a copy of
specific elements of the Complainant’s personal data. In its response to the Complainant, Airbnb
did not mention or provide details in relation to the handling of the erasure request.
On 11 September 2018, the Complainant contacted Airbnb noting his dissatisfaction with Airbnb’s
response, claiming it to be incomplete and noting Airbnb’s failure to contain certain information
sought concerning the data processing in accordance with Airbnb’s obligations under GDPR. “/
requested full information (i.e. everything that a data subject can request in accordance with
GDPR). \n addition the Complainant noted the response lacked clarity (the Complainant alleged
the email attaching his personal data was written in English and contained unsorted table
columns with incomprehensible column headings). “Your answer is limited to the transmission of
allegedly all data stored with you. All other information is missing. In addition, the data
compilation is incomplete: At least credit card information is missing, as well as information on
the computers used for logins.” The Complainant noted the obligation for Airbnb, in accordance
with the GDPR, to provide information “in a form which is “transparent, concise, easily accessible
and easy to understand, and that clear and plain language”.
On 13 September 2018, Airbnb acknowledged receipt of the Complainant’s email.
On 7 February 2020, the Berlin SA transferred the Complaint to the DPC in its capacity as LSA. The
DPC notified Airbnb of the Complaint by letter dated 13 May 2020 and raised certain queries in
respect of Airbnb’s obligations pursuant to the GDPR relating thereto.
On 27 May 2020 Airbnb responded to the DPC, providing a screenshot of its response to the
Complainant which had been sent on the same date. In its response, Airbnb stated it believed
that the two 2015 pre-GDPR erasure requests had been identified as spam and as such were not
properly delivered due to there being no text contained in the body of the emails. It stated in
respect of the access and erasure requests of 6 July 2018, that following confirmation of the
Complainant's identity, the access file was provided on 28 August 2018 and the erasure of the
Complainant’s account was “commenced on 29 August 2018.” In response to the Complainant’s
queries regarding further information in relation to the data processing, Airbnb stated it was “not
in a position to answer your specific queries with reference to the access file provided in 2018, due
to the fact that we no longer hold a copy of this access file and [the Complainant’s] Airbnb account
has been deleted.” As regards the communication in English, Airbnb stated its automatic
processes are “set up to provide the cover email in English; however, if a data subject requests a
translation into a language such as German, [Airbnb] can facilitate this request.”
Airbnb apologised for any difficulties the Complainant experienced with the form and layout of
the access file provided, noting that it was “an early iteration of our access file production
following the introduction of the GDPR.” Airbnb stated it was in the process of amending the
production of access files, “to refine the clarity and navigability”. Airbnb stated it had no record
of credit card data having been added to the Complainant’s account and that it does not store
descriptions of devices used to log into user accounts. In response to the Complainant’s queries
3
An Coimisitén um
Chosaint Sonrai
Data Protection
Commission
on “Which data? From where? On what legal basis? Transferred to whom?”, Airbnb referred the
Complainant to the sections 2, 3, 4 and 7 of its Privacy Policy providing a link thereto, stating that
it could not provide specificity due to the deletion of the account.
13. The Complainant was dissatisfied by Airbnb’s response of 27 May 2020, and made various
comments and raised queries relating thereto by email of 3 August 2020 to the Berlin SA, which
was transferred to the DPC on 14 October 2020. The Complainant did not accept, inter alia, that
his data had been erased and queried why Airbnb erased his data immediately after responding
to his access request before he could review them.
14, The DPC notified Airbnb of the content of the Complainant’s email of 3 August 2020 and
requested Airbnb’s views arising therefrom. Airbnb responded by email of 9 December 2020
largely reiterating its response of 27 May 2020 and stating that the Complainant’s “access and
deletion requests were processed in accordance with [the Complainant’s] request and in order to
meet the time limits set out in the GDPR”. \n addition, it provided a German translation of its
response of 27 May 2020 and of the email itself. Airbnb confirmed it had no record of the
Complainant adding credit card details to their Airbnb account, and stated that even though the
Complainant’s account had been deleted, the uploading of payment information would have
been retained pursuant to section 6.3 of its Privacy Policy. Airbnb stated “Airbnb retains certain
categories of personal data following the deletion of an Airbnb account. This includes records of
certain activities, including uploading payment information”. The DPC wrote to the Complainant
conveying Airbnb’s responses via the Berlin SA on 24 March 2021.
15. The Complainant reverted to the Berlin SA on 13 July 2021 and re-iterated his dissatisfaction with
Airbnb’s response to both the Complainant’s access and erasure requests and highlighted his
dissatisfaction with initially being asked to provide a copy of his ID. The Complainant advised that
he did not agree to the amicable resolution of his Complaint.
Conduct of Inquiry
16. Acting in its capacity as LSA, the DPC commenced an Inquiry in relation to this matter by writing
to Airbnb on 22 December 2022.
17. The DPC advised Airbnb that the Inquiry commenced by the Commencement Notice would seek
to examine and assess whether Airbnb had complied with its obligations under the GDPR and the
Act, in particular under Articles 5, 6, 12, 15 and 17 of the GDPR in respect of the relevant
processing operations which are the subject matter of the Complaint.
18. The DPC advised Airbnb that the scope of the Inquiry concerned an examination and assessment
of the following:
19;
20.
yA
22.
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
Issue 1: Whether Airbnb’s provision of the personal data and information concerning the
processing of that personal data in response to the Complainant’s access request was
compliant with the GDPR and the Act.
Issue 2: Whether Airbnb’s handling of the Complainant’s access request was compliant with
the GDPR and the Act insofar as the information provided to the Complainant was in a
concise, transparent, intelligible and easily accessible form using clear and plain language.
Issue 3: Whether Airbnb’s handling of the Complainant’s erasure request was compliant
with the GDPR and the Act.
Issue 4(a): Whether Airbnb’s obligation to provide information on action taken in response
to the access and erasure requests without undue delay pursuant to Article 12(3) GDPR was
suspended until after the verification of the Complainant’s identity by phone call on 31 July
2018.
Issue 4(b): Whether Airbnb had a lawful basis for requesting a copy of the Complainant’s ID,
and upon the Complainant's refusal to provide same, whether Airbnb had a lawful basis to
thereafter request a telephone call in order to verify the Complainant's identity in
circumstances where he had submitted a request for access and erasure pursuant to Articles
15 and 17 GDPR.
In order to progress the matter, the DPC posed specific queries regarding the access request and
the erasure request and the manner in which those requests were handled by Airbnb.
The DPC also informed the Complainant via letter dated 23 December 2022, which was issued to
the Complainant via the Berlin SA, that an Inquiry had commenced in relation to their Complaint.
The DPC provided the Complainant the opportunity to withdraw any information previously
provided and asked whether the Complainant had any new information they wished to submit
regarding their Complaint. On 9 February 2023, the Berlin SA wrote to the DPC to inform it that
the Complainant had not responded to the DPC’s update.
On 23 January 2023 Airbnb responded to the queries raised by the DPC in its Commencement
Notice. In its response Airbnb stated that its identity verification policies and procedures are in
place to protect the Airbnb platform and its users in accordance with its obligations under GDPR,
in a manner that facilitates and safeguards the rights of data subjects under the GDPR. Airbnb
stated it diligently reviews policies and procedures to ensure they comply with all applicable laws,
reflect best industry practice and are consistent with the ever-changing legal, social and
technological landscape within which Airbnb operates.
Airbnb noted that at the time it received the Complainant’s access and erasure requests in 2018,
ID verification represented the preferred method of authenticating access and erasure requests,
5
23.
24.
25;
26.
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
given the probative value of ID verification and the safety and security issues relating to the
nature of the Airbnb platform, including the need to preserve accounts that may be necessary for
travel abroad or which may be an important element of an individual's livelihood and the need
to avoid disclosing such information to the wrong person.
Airbnb informed the DPC that in accordance with its commitment to updating its practices in
alignment with best practice and regulatory expectations in the data protection space, it has since
revised its practices so that two-factor authentication methods and other authentication
methods are used instead of ID verification.
Airbnb referred to previous communications with the DPC in the context of another statutory
inquiry and DPC decision as regards changes made to its authentication methods and referred to
the following extract of the communication sent to the DPC; “Airbnb is committed to complying
with data protection law and to enhancing its compliance on an on-going basis. Prior to the DPC’s
decision, Airbnb had already begun the process of removing IDs from its suite of authentication
methods, which began in earnest in August 2020 with the launch of our privacy portal, an account
tool for facilitating data subject rights in a manner which utilises two-factor authentication
instead of ID verification." In line with the principle of data minimisation, the privacy portal does
not require users to provide additional personal data to Airbnb in order to authenticate their
requests. This tool is now the preferred method for authenticating erasure requests due to its
enhanced security features. In light of these security features, users who submit erasure requests
through other channels, such as email, are directed to this portal in the first instance.
Notwithstanding the primacy of the privacy portal, Airbnb also facilitates the manual
authentication of requests received through other channels, for example by email or phone.
However, Airbnb no longer uses IDs to authenticate requests.”
Airbnb noted that the DPC requested comprehensive responses to various queries, to include
supplemental documentation and input from third parties, if necessary, in relation to an Airbnb
user account that was deleted in 2018. Airbnb stated that while it had endeavoured to respond
to the DPC in as comprehensive a manner as possible, difficulties arose in investigating certain of
the underlying factual and contextual issues in a historical case such as this where the relevant
account no longer exists.
As regards the Complainant’s access request, Airbnb stated it received the access request on 6
July 2018. Airbnb advised that due to the deletion of the Complainant’s access file, it does not
have a record of precisely what would have been provided. However Airbnb stated that access
files generally in 2018 included the following categories of data: account information, including
profile details, preferences and contact information; listing and reservation data; identity
verification information (including ID documents where provided); financial information, such as
1 “The portal can be access through the “Privacy & sharing” section of user accounts, and can also be reached
through section 6 of our privacy policy which leads users to this data subject rights Help Centre page containing
links to the account portal page.”
27.
28,
29.
30.
An Coimisiin um
Chosaint Sonrai
Data Protection
Commission
bank account and credit card details used for transactions on the platform; communications on
and relating to the Airbnb platform, for example redacted messages with other users and emails
to Airbnb; and technical logs relating to activities on the platform, for example account login
records.
As regards responding to the access request, Airbnb stated that the individuals who handled the
Complainant’s request misunderstood or failed to appreciate the scope of the Complainant’s
access request and omitted a response to the Complainant’s broader questions about the
processing of his personal data, for which Airbnb apologised. Airbnb stated it responded to the
Complainant’s access request on the terms of specific queries raised by the DPC, sent to Airbnb
during the amicable resolution process. “Unfortunately it appears that the individuals handling
the complainant’s request misunderstood or failed to appreciate the scope of the complainant’s
access request and omitted a response to his broader questions about the processing of his
personal data, an omission that we apologise for.” Airbnb stated it responded to those questions
sent by the DPC as part of its response to the Complaint, and would answer any additional
questions during the Inquiry process.
With regards to the personal data provided to the Complainant, Airbnb stated that due to the
deletion of the Complainant’s account and access file, it could not confirm the scope of the
personal data provided. However Airbnb stated it could confirm it withheld certain information
from the access file on the basis of Article 15(4) GDPR, such as any third party personal data and
confidential/commercially sensitive Airbnb information. Airbnb informed the DPC that the
Complainant’s broader Article 15 questions were not responded to but that Airbnb ultimately
answered the specific questions raised by the DPC on behalf of the Complainant during the
complaint handling process.
As regards the categories of personal data that were not provided and the corresponding legal
basis for withholding that personal data from the Complainant, Airbnb stated it could not confirm
the precise scope of the personal data provided and withheld. Airbnb confirmed the categories
of data which would have been withheld on the basis of Article 15(4) GDPR were, for example,
any third party personal data and confidential / commercially sensitive Airbnb information.
As regards retention of information by Airbnb, Airbnb stated that it did not require upon
registration credit card details or other payment information at the time of account creation.
Airbnb informed the DPC that these details are only required for substantive use of the platform,
for example where a guest is making a booking or where a host is setting up a payment method
for receipt of reservation payments. Airbnb advised that it had no record of the Complainant ever
adding a credit card to his account. Airbnb advised that it retains certain log data relating to
Airbnb accounts for security reasons, and could not find evidence in these of logs of a credit card
or other payment method having been added to the Complainant’s account. Due to the account
having been deleted, Airbnb stated it could not comment further.
31.
32;
33.
34.
BA.
36.
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
With regard to the DPC’s query as regards Airbnb’s handling of the Complainant’s access request
and why it did not communicate to the Complainant in German so as to be clear and
comprehensible in accordance with the principle of transparency, Airbnb referred to its response
of 27 May 2020 stating that its practice was to issue access file cover emails in English unless the
data subject requested the communication in their preferred native language. Airbnb stated that
it did provide the Complainant a German language translation of both of its responses on 9
December 2020.
With regard to the DPC’s query on the subject of Airbnb’s automatic processes to issue cover
emails to access requests in English, Airbnb advised that if a user submits an access request
through the privacy portal the automated process produces a cover email in the user’s identified
language. If the request is made outside this channel, such as by email, the default position is to
produce an English language version of the cover email unless a request is made for the
communication in a preferred language. Airbnb stated it will be looking into making
improvements to its processes in this area.
With regard to the access file, the DPC requested Airbnb to advise and demonstrate how Airbnb
currently meets its obligations under Article 12(1) GDPR in responding to access requests and to
advise and demonstrate how the access form has been improved. Airbnb stated that the access
files it provides to data subjects comply with Article 12(1) of the GDPR as the personal data is set
out in clearly described tabs corresponding with the categories of personal data included. Airbnb
stated there is an explanatory tab titled “Read me” which explains the nature, form and contents
of the file to data subjects, therefore constituting a roadmap for review. Airbnb advised it has
also published an article on its Help Centre which explains the structure and contents of these
access files. Airbnb stated it was looking at ways to enhance its access files with a view to
rendering them more readily accessible and understandable from a data subject perspective.
As regards Airbnb’s handling of the erasure request, the DPC asked why Airbnb had not
responded to the Complainant’s erasure requests of 2015. In response, Airbnb referred to its
response of 27 May 2020 and advised that the two erasure requests appeared to have routed to
its spam inbox due to a technical issue associated with the body of the emails containing no text,
which in turn generated emails to the Complainant notifying him that the emails [erasure
requests] had not been sent properly.
Airbnb confirmed to the DPC, in response to the DPC query as regards the date it received the
Complainant’s erasure request and the further query as to any action taken on the erasure
request, that it acknowledged the erasure request on 17 July 2018. It then began a process of
authenticating and processing the erasure request.
In response to the DPC query as to when Airbnb completed the erasure request and then erased
the data, Airbnb informed the DPC that due to the deletion of the account that is subject to this
Inquiry, it is unable to confirm precisely when the account was deleted. However, according to
37.
38.
39.
40.
An Coimisiin um
Chosaint Sonrai
Data Protection
Commission
Airbnb the deletion would have been completed shortly after the commencement of the deletion
process.
In response to the DPC query as regards a delay in informing the Complainant on action taken on
the erasure request, Airbnb reiterated that it acknowledged the Complainant’s access and
deletion requests on 17 July 2018, and commenced the process of deletion on 29 August 2018,
within a calendar month of the request being authenticated on 31 July 2018.
The DPC posed a query as regards whether Airbnb had a lawful basis for requesting a copy of the
Complainant’s ID, and upon the Complainant’s refusal to provide same, whether Airbnb had a
lawful basis to thereafter request a telephone call with the Complainant in circumstances where
he had submitted a request for access and erasure pursuant to Articles 15 and 17 GDPR. In
response to this query, Airbnb clarified its understanding as regards data subjects’ rights
requests, as informed by data protection regulatory guidance, such as the right of access and
right of erasure are not effective until the identity of the data subject has been determined.
Airbnb quoted an extract of the DPC’s own guidance document on data subject access requests.
Airbnb clarified that its understanding is that an obligation to provide information on action taken
on an access request and a deletion request is triggered only when the requests are in effect
which, as guidance such as that published by the DPC has clarified, is when the identity of the
data subject has been verified.
In response to the query regarding the legal bases relied upon for requesting a copy of the
Complainant’s ID on receipt of his erasure request and upon the Complainant’s refusal to provide
ID, requesting a telephone call with the Complainant, Airbnb stated that it relied on a variety of
legitimate interests, including its legitimate interests in verifying the authenticity of the requests
and the legitimate interests of the account holder in ensuring their personal data was not
disclosed or deleted in illegitimate or otherwise inappropriate circumstances, in accordance with
Article 6(1)(f) of the GDPR.
As regards why Airbnb considered it necessary and proportionate to request a copy of a user’s ID
to verify their identity where they have submitted a request for access or erasure, especially in
circumstances where the user had not previously provided their ID to Airbnb before and Airbnb
have nothing to verify it against, Airbnb informed the DPC that in 2018 ID verification represented
the preferred method of authentication for access and deletion requests, given the probative
value of ID verification and the safety and security issues relating to the nature of the Airbnb
platform, including the need to preserve accounts that may be necessary for travel abroad or
which may be an important element of an individual’s livelihood and to avoid disclosing such
information to the wrong person. Airbnb stated that the corroborative value of requesting ID was
not dependent or predicated on there being a pre-existing ID on a user’s account, and instead
formed part of a holistic approach to identity verification, carried out with reference to the
totality of information available to Airbnb. Airbnb advised that given it was and is necessary for
it to design, implement and maintain robust safety and security measures, Airbnb believes that
ID verification formed part of a necessary and proportionate suite of measures, which included
9.
An Coimisiin um
Chosaint Sonrai
Data Protection
Commission
alternative verification measures where appropriate, designed to protect the Airbnb platform
and community and all those associated with it. However, Airbnb clarified it no longer uses
identity documents to authenticate access and deletion requests.
41. Asregards why Airbnb considered it necessary and proportionate to request a phone call to verify
the Complainant’s identity, Airbnb informed the DPC that it was necessary and proportionate to
request a phone call to verify the Complainant’s identity in circumstances where Airbnb needed
to exercise care and diligence and verify the identity of the requester, and where a phone call
was a convenient alternative verification method that the Complainant was amenable to. Airbnb
informed the DPC that this was a precautionary step to supplement the engagement with the
Complainant by email, to ensure that the individual communicating by email was the account
holder in question.
42. With regard to reasonable doubts pursuant to Article 12(6) GDPR that Airbnb had, if any,
concerning the Complainant’s identity such that Airbnb considered it necessary to first request a
copy of the Complainant’s ID and subsequently to request a telephone call, Airbnb informed the
DPC that in circumstances where the underlying account has been deleted, it could not comment
on any reasonable doubts in existence at the time in question.
43. As regards compliance with the requirements of Article 12(3) in relation to the processing of
access and erasure requests, Airbnb reiterated that on 6 July 2018 the Complainant submitted
his access and deletion requests and Airbnb responded on 17 July 2018, commencing a process
of authenticating and processing the requests.
44. As regards other methods of identity verification, and why other methods are not offered to a
user to verify their identity in the first instance, Airbnb reiterated that in 2018 ID verification
represented the preferred method of authentication, given the probative value of ID verification
and the safety and security issues relating to the nature of the Airbnb platform, but alternative
methods were facilitated where possible and appropriate, as was the case with the Complainant.
45. In response to the DPC’s request to provide a record of the identity verification telephone call of
31 July 2018 including time and date, Airbnb stated that given the account has been deleted, it
does not have a record of this call beyond the timestamped material in the Complaint
documentation provided by the DPC, which provides evidence that the call took place.
Notification of the Preliminary Draft Decision to the Data Controller
46. The DPC provided a copy of the Preliminary Draft Decision to Airbnb on 22 March 2023 and
requested Airbnb to provide submissions in relation to the content by close of business on 12
April 2023.
47. Airbnb provided its submissions to the DPC on 12 April 2023. Airbnb responded to the DPC’s
preliminary finding that the practice of requesting ID for authentication purposes constitutes
10
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
“collection” within the meaning of “processing” as so defined in Article 4(2) of the GDPR. Airbnb
made reference to the European Data Protection Board (“EDPB”) guidelines on the concepts of
controller and processor? (the “Guidelines”), in which the EDPB emphasises the following aspect
of the definition of “processing”:“any operation or set of operations which is performed on
personal data or on sets of personal data’.? Airbnb stated that in the earlier version of the
Guidelines’, the EDPB included the following description of “processing”:
“[iJn Article 4(2) processing is defined as a concept including a wide array of operations ranging
from collection, storage and consultation to use, dissemination or otherwise making available and
destruction. In practice, this means that all imaginable handling of personal data constitutes
processing”®
Airbnb stated that this demonstrates that Article 4(2) requires that the operation or set of
operations be “performed on” personal data and, in the earlier version of the Guidelines, the
EDPB outlined the need for this to involve actual “handling” of personal data.
48, Furthermore, Airbnb stated that the Spanish supervisory authority, La Agencia Espafiola de
Proteccion de Datos (“AEPD”), has published guidelines for data protection by default®, in which
the AEPD considers the examples of activities which fall within the concept of “processing” under
Article 4(2) of the GDPR’. Airbnb stated that the AEPD provided the example of the receipt of a
CV constituting “collection” and therefore processing, of personal data while the publication of a
vacancy for a relevant job does not constitute processing. Airbnb asserted that, for the purposes
of the Preliminary Draft Decision, the publication of a [job] vacancy can be viewed as analogous
to a request for personal data, such as an ID, and that the receipt of the CV can be treated as
analogous to the receipt of the ID, with the effect that, in the present case, the processing cannot
have taken place in circumstances where no ID was received by Airbnb.
49. In addition, Airbnb referred to the EDPB Twitter decision®, in which the EDPB traced the DPC’s
rationale for not reprimanding Twitter for certain ancillary activities relating to a data breach,
which according to Airbnb are relevant for present purposes. Airbnb cited the following extract
from paragraph 139 of the EDPB Twitter decision for illustrative purposes:
“In its Draft Decision, the [DPC] explained its decision to not issue a reprimand by recalling the
argument put forward by TIC in its submissions in relation to the Preliminary Draft Decision,
? Guidelines 07/2020 on the concepts of controller and processor in the GDPR (Version 2.1), adopted on 7 July
2021.
3 See paragraph 42 of the Guidelines
4 Guidelines 07/2020 on the concepts of controller and processor in the GDPR (Version 1.0), adopted on 2
September 2020 (the “Original Guidelines”).
5 See paragraph 77 of the Original Guidelines
® https://www.aepd.es/sites/default/files/2020-10/guia-proteccion-datos-por-defecto-en.pdf
’ Page 10 of the AEPD Guidelines.
® Decision 01/2020 on the dispute arisen on the draft decision of the Irish Supervisory Authority regarding
witter International Company under Artic GDPR, Adopted on 09 November 2020
11
An Coimisitn um
Chosaint Sonrai
Data Protection
Commission
contending that the infringements of Article 33(1) and Article 33(5) GDPR do not compromise
“processing operations”, while Article 58(2)(b) GDPR provides supervisory authorities with the
power to issue reprimands where processing operations have infringed provisions of the GDPR.
The [DPC] considered that the term ‘processing operation(s)’ appears 50 times in the GDPR and
seems to be used to denote the treatment or use of, in other words things that are done to,
personal data by a controller, but that at the same time the definition of “processing” provided
by the GDPR is very broad, which makes it arguable that given that a breach is something affecting
or done to, personal data, it follows that the notification obligation (insofar as it inherently must
entail an examination of what has happened to personal data or how it has been affected) is
intrinsically connected or one or more processing operations. The [DPC] did not consider it
necessary to definitely conclude on the meaning on the meaning and effect of the term
“processing operations” in the Draft Decision, but “on balance” considered that TIC’s legal
argument was “a stateable one”, deciding not to proceed with the issuing of a reprimand to TIC”
(emphasis added).
50. Airbnb stated that the basis for the DPC’s conclusion that a request for ID constituted
“processing” within the meaning of Article 4(2) of the GDPR is therefore unclear to Airbnb and
this conclusion does not appear to align with the common understanding of the concept of
“orocessing”. Airbnb stated that in the present case, although ID was requested from the
Complainant, it was ultimately never provided, with the effect that the impugned processing
never in fact occurred.
51. Airbnb stated that in light of its point above, it respectfully submits that the request for ID from
the Complainant in order to authenticate his data subject rights requests cannot reasonably be
considered to constitute “processing” within the meaning of Article 4(2) of the GDPR and,
therefore, that the related findings of infringement cannot be maintained.
52. Airbnb also noted an erroneous reference by the DPC to the date of 30 August 2018 at paragraph
82 (previously 70) as the date that Airbnb authenticated the Complainant’s requests. Airbnb
noted the Complainant’s requests were authenticated on 31 July 2018. The DPC has amended
this paragraph to reflect the correct date in this decision.
53. The DPC has carefully considered Airbnb’s submissions in making this decision.
Notification of the Preliminary Draft Decision to the Complainant
54. The DPC provided the Complainant with a copy of the Preliminary Draft Decision, via the Berlin
SA, on 13 April 2023. In its letter, the DPC requested that the Complainant provide their
submissions in relation to the Preliminary Draft Decision within 2 weeks of the date of receipt of
the letter following its provision by the Berlin SA.
55. The Berlin SA responded on 14 June 2023 informing the DPC that the Complainant had not
responded to the Preliminary Draft Decision.
12
An Coimisiin um
Chosaint Sonrai
Data Protection
Commission
Relevant and Reasoned Objections and Comments from “supervisory authorities concerned”
56. Having transmitted the draft decision on 16 June 2023 to the “supervisory authorities concerned”
in accordance with Article 60(3) of the GDPR, the DPC did not subsequently receive any relevant
or reasoned objections under Article 60(4). An opinion, which was not expressed as a formal
objection, in relation to the draft decision was received from the Comissdo Nacional de Protecao
de Dados (CNPD).
57. The DPC gave careful consideration to the opinion received from the CNPD. However the DPC did
not consider that it was necessary to revise the draft decision in light of that opinion.
Applicable Law
58. For the purposes of its examination and assessment of this Complaint, the DPC has considered
the following Articles of the GDPR:
e Article 5
e Article 6 -
e Article 12
e Article 15
e Article 17
Findings of Inquiry
59. The DPC notes that two erasure requests were submitted by the Complainant to Airbnb in 2015
- on 18 September 2015 and 12 October 2015. However, for the following reasons the DPC is not
considering those matters any further in this decision: (i) the two erasure requests appear to have
been routed to Airbnb’s spam inbox due to a technical issue associated with the fact that the
body of the emails sent by the Complainant to Airbnb allegedly contained no text, (which in turn
allegedly generated emails to the Complainant notifying him that the emails [erasure requests]
had not been sent properly); and (ii) those erasure requests (insofar as they could be considered
to be valid erasure requests in the alleged absence of text in the body of the emails concerned)
were submitted to Airbnb over two years prior to the application of the GDPR and therefore these
matters fall outside the scope of the cooperation and consistency mechanism.
Issue 1: An examination of whether Airbnb’s provision of the personal data and information
concerning the processing of that personal data in response to the Complainant’s access request
was compliant with the GDPR and the Act.
60. In accordance with Article 15 GDPR, a data subject has the right to obtain from the data controller
a copy of the personal data undergoing processing, and certain additional information concerning
13
61.
62.
63.
An Coimisitin um
Chosaint Sonrai
Data Protection
Commission
the processing and the data subject’s rights as prescribed by Articles 15(1)(a) to (h) of the GDPR.
The scope of the personal data to be provided under Article 15(1) GDPR comprises full and
complete information on all data relating to the data subject undergoing processing in order for
the data subject to be aware of, and to verify the lawfulness of the processing.
The Complainant, as part of the Complaint submitted on 1 January 2019, highlighted his concerns
regarding the personal data provided to him by Airbnb. The Complainant noted that upon
registration of an account with Airbnb in the summer of 2015, he provided his name, date of
birth, telephone and credit card number. According to the Complainant, Airbnb failed to properly
comply with his access request in failing to provide a copy of full and complete information.
The Complainant submitted an access request for a copy of his personal data to Airbnb on 6 July
2018 via email, where he requested full access to his information and outlined the data he was
particularly interested in. Airbnb responded to the Complainant via email on 17 July 2018
requesting for the Complainant to provide a copy of his ID. The Complainant refused this request
on 18 July 2018. The DPC notes that upon the Complainant’s refusal to provide a copy of his ID,
Airbnb offered an alternative method of authenticating his requests through the completion of a
telephone call. On 31 July 2018, Airbnb authenticated the Complainant’s requests via telephone
call. Airbnb provided the Complainant with access to some of his personal data via email on 30
August 2018. The Complainant noted in his Complaint that he was not provided with access to
credit card personal data or data as regards devices used to log in to his Airbnb account. The
Complainant also noted that Airbnb failed to provide information on the processing of his
personal data including the sources from where his data had been gathered, the legal basis of the
processing, or the third parties with whom his data had been shared.
In response to queries raised by the DPC on 23 January 2023, Airbnb advised the DPC that the
individuals dealing with this access request had misunderstood or failed to appreciate the scope
of the personal data to be provided to the Complainant. Airbnb advised the DPC that when it
received the complaint from the DPC, due to the DPC’s formulation of the Complainant’s request
[in the DPC letter of 13 May 2020], it responded to the access request as per the DPC’s
formulation of the request. The DPC, in the letter of 13 May 2020, had formulated the Complaint
as follows:
“The Data Subject believes that Airbnb’s response to his access request was unsatisfactory for
several reasons: Airbnb’s response was in English and contained abbreviations that the Data
Subject did not understand; the Data Subject considers that Airbnb’s response was incomplete
as it did not include his credit card information which he provided while setting up his account
or information about the devices used to sign into his account; Airbnb’s response also did not
contain any information regarding where his data had been gathered from, the purposes of
the processing, and with whom his data had been shared. The Data Subject wishes for Airbnb
to comply with his access and erasure requests in that order.”
® DPC letter 13 May 2020
14
64.
65.
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
The DPC then outlined the next steps in order to progress the complaint and requested Airbnb to
take the following steps:
1. “Write to the Data Subject by 27 May 2020, responding to the substance of their access
request in accordance with the provisions of Article 15 of the GDPR. In so doing, Airbnb
should:
a) Provide access to the personal data that it holds, process or controls in relation to
the Data Subject to the extent that such personal data falls within the scope of
their access request and set out explicitly how the completed access request
complies with Article 15 of the GDPR; OR ;
b) Notify the Data Subject in writing of the refusal of their access request (whether
in whole or in part), setting out a statement of the reasons for that refusal and
outlining the basis for any statutory restrictions relied upon.
2. Confirm to the DPC that the above action has been taken by Airbnb. If Airbnb has
previously completed the access request in a manner it considers consistent with Article
15 GDPR, please provide evidence to the DPC.
3. Provide an explanation for why Airbnb did not action the Data Subject’s erasure requests
in 2015. Write to the Data Subject by 27 May 2020, responding to the substance of their
erasure request in accordance with the provisions of Article 17 of the GDPR.”?
Airbnb stated that it responded to those queries [outlined in the DPC’s formulation of the
Complainant’s request] on 27 May 2020.
The DPC notes that Airbnb responded originally to the access request providing a limited set of
personal data to the Complainant. The DPC further notes that Airbnb has advised that any data
not provided to the Complainant would have been due to the fact that the data had not been
registered to the Complainant’s account, that Airbnb did not at the time include certain data in
the formulation of its access file production, or that certain sensitive/confidential data would not
have been provided as per Article 15(4) of the GDPR. However, the DPC notes that certain
information was erroneously withheld from the Complainant (such as the sources from where his
data had been gathered or the legal basis of the processing) and it was only arising from
intervention by the DPC that Airbnb then provided the Complainant with the additional
information.
On the basis of the above, the DPC finds that Airbnb infringed Article 15(1) of the GDPR at the
time of first processing the Complainant’s access request by not providing him with access to
1° DPC letter 13 May 2020
15
66.
67.
68.
69.
70.
An Coimisitn um
Chosaint Sonrai
Data Protection
Commission
all of his personal data that was being processed by Airbnb on the date of receipt of his access
request.
Issue 2: An examination of whether Airbnb’s handling of the Complainant’s access request was
compliant with the GDPR and the Act insofar as the information provided to the Complainant
was in a concise, transparent, intelligible and easily accessible form using clear and plain
language.
Article 12(1) of the GDPR states that “The controller shall take appropriate measures to provide
any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22
and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily
accessible form using clear and plain language”.
According to the Complainant, in his Complaint submitted to the Berlin SA, some of the
information provided to him from Airbnb was in English, with incomprehensible column
headings, some of which were abbreviated and the data was unsorted. Airbnb explained that the
provision of the cover email in English accompanying the access file was due to an automated
process. However, if a data subject requested a translation into another language, such as
German, Airbnb could facilitate this. As regards the form and layout of the access file containing
the data, Airbnb explained this was due to an early procedure of access file production and that
Airbnb has worked to refine the clarity and navigability of its access files.
During the course of the Inquiry, Airbnb explained that if a user submits an access request
through the privacy portal the automated process produces a cover email in the user’s identified
language. Airbnb further stated it would be looking to make improvements to its processes in this
area.
Regarding the form and layout of the access file, during the course of the Inquiry Airbnb explained
that the form of the access files it provides to data subjects complies with Article 12(1) GDPR.
Airbnb explained that it sets out the personal data in clearly described tabs corresponding with
the categories of personal data included, in addition to an explanatory tab titled “Read me” which
explains the nature, form and contents of the file to data subjects, constituting a roadmap for
review. Airbnb advised the DPC that a help centre article had been published which explains the
structure and contents of its access files.
The DPC notes that the Complainant submitted his access and erasure requests by email (i.e.
outside of the privacy portal) using the German language. However, the DPC does not accept that
the Complainant should have to specify to Airbnb the language in which he wanted to be
responded to. Once the data protection rights requests were made by the Complainant in the
German language, it follows that any communications that followed from Airbnb to the
Complainant regarding those requests should have been issued to him by Airbnb in the German
language. Airbnb had previously communicated with the Complainant in German prior to the
provision of his access file.
16
71.
Tas
73.
74,
75,
76,
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
Following the intervention of the DPC on 2 November 2020, through forwarding the
Complainant’s comments to Airbnb’s responses of 27 May 2020, Airbnb only then provided a
German translation copy of its responses of 27 May 2020 to the Complainant on 9 December
2020.
On the basis of the above, the DPC finds that Airbnb infringed Article 12(1) of the GDPR at the
time of first processing the Complainant’s access request by failing to provide the Complainant
with an access file that was of a concise, transparent, intelligible and easily accessible form.
The cover email was provided in English rather than in German, and the data provided to the
Complainant was not of a transparent nature, due to the abbreviation of some column
headings and unsorted data.
Issue 3: An examination of whether Airbnb’s handling of the Complainant’s erasure request was
compliant with the GDPR and the Act.
Further to his Complaint regarding Airbnb’s handling of his access request, the Complainant also
in his Complaint outlined his dissatisfaction with Airbnb’s handling of his erasure request.
According to Article 17 GDPR, “The data subject shall have the right to obtain from the controller
the erasure of personal data concerning him or her without undue delay”.
The DPC notes that the Complainant submitted a valid request for erasure, pursuant to Article 17
of the GDPR, to Airbnb on 6 July 2018. The Complainant noted that, following the reactivation of
his Airbnb account on 9 June 2018, he requested on 6 July 2018 that his Airbnb account be
deleted. On 17 July 2018, Airbnb acknowledged the Complainant’s erasure request and requested
the Complainant to submit a copy of his ID so as to commence a process of authenticating and
processing the requests, which the Complainant refused on 18 July 2018. Airbnb suggested
thereafter that it conduct a telephone call to which the Complainant agreed and the telephone
call took place on 31 July 2018. Following this, Airbnb proceeded with the erasure request, and
commenced the erasure process on 29 August 2018.
However, a period of over twenty-two months elapsed between the date of lodging of the
erasure request (6 July 2018) and the date on which Airbnb provided information to the
Complainant on action taken in relation to it (27 May 2020), That delay is examined further below
in the context of Article 12(3) of the GDPR.
Issue 4 (a): Whether Airbnb’s obligation to provide information on action taken in response to
the access and erasure requests without undue delay pursuant to Article 12(3) GDPR was
suspended until after the verification of the Complainant’s identity by phone call on 31 July
2018.
a7
77.
78.
79.
80.
81.
82.
An Coimisidn um
Chosaint Sonraf
Data Protection
Commission
Article 12(3) GDPR stipulates “The controller shall provide information on action taken on a
request under Articles 15 to 22 to the data subject without undue delay and in any event within
one month of receipt of the request. That period may be extended by two further months where
necessary taking into account the complexity and number of the requests. The controller shall
inform the data subject of any such extension within one month of receipt of the request, together
with the reasons for the delay. Where the data subject makes the request by electronic form
means, the information shall be provided by electronic means where possible, unless otherwise
requested by the data subject.”
The DPC notes that the Complainant submitted both his access and erasure requests on 6 July
2018. Airbnb stated that it “acknowledged the Complainant’s access and deletion requests on 17
July 2018 and then began a process of authenticating and processing the requests.” \n the first
instance Airbnb sought a copy of ID from the Complainant on 17 July 2018 and this request was
rejected by the Complainant on 18 July 2018. As an alternative means of verifying the authenticity
of the requests, Airbnb offered to conduct a telephone call to which the Complainant agreed on
23 July 2018. Airbnb conducted a telephone call with the Complainant on 31 July 2018 and, at
that point, it was satisfied with the authenticity of the requests.
Airbnb stated it commenced the erasure process on 29 August 2018 and provided a copy of the
access file on 30 August 2018, one month after the telephone call had taken place.
On 27 May 2020, following the DPC’s intervention, Airbnb wrote to the Complainant and
informed him that the process of erasure had commenced on 29 August 2018.
The timeline of events, therefore was as follows:
° 6 July 2018: Access and Erasure Requests submitted by the Complainant
° 17 July 2018: Acknowledgement sent by Airbnb and request for copy of ID
° 18 July 2018: Complainant rejected request to provide a copy of ID
e 19 July 2018: Airbnb proposed telephone call as alternative to providing ID
° 23 July 2018: Complainant agreed to telephone call
° 31 July 2018: Telephone call took place between Airbnb and Complainant
e 29 Aug 2018: Airbnb commenced erasure process
e 30 Aug 2018: Access file supplied to Complainant by Airbnb
° 27 May 2020: Airbnb informed Complainant that erasure had commenced in August 2018.
From the above timeline of events, firstly it is clear that the Complainant was not informed by
Airbnb until 27 May 2020, following the intervention of the DPC in the handling of the Complaint,
of the action taken by Airbnb in relation to his erasure request of 6 July 2018. A period of over
twenty-two months had elapsed between the date of lodging of the erasure request and the date
on which Airbnb provided information to the Complainant on action taken in relation to it.
Secondly, with regard to the access request, some time was lost as the above timeline shows
18
83.
84.
85.
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
between 6 July 2018 when the access request was lodged and 30 August 2018 when the access
file was supplied to the Complainant by Airbnb. For example, the telephone call which verified
the authenticity of the requests did not take place until 31 July 2018 — twenty-five days after the
request was lodged. This delay in verifying the authenticity of the requests was contributed to in
the main by Airbnb which in the first instance took ten days to acknowledge the requests and
then contributed to a further delay by seeking a copy of ID to verify identity rather than
requesting a telephone call to authenticate the access and erasure requests. The EDPB adopted
guidelines on 18 January 2022 on data subject rights. At section 5.3 it gives guidance on the
timing for the provision of access. In that regard, it states at para. 157” the following: “The time
limit starts when the controller has received an Art. 15 request, meaning when the request reaches
the controller through one of its official channels. It is not necessary that the controller in fact has
taken notice of it. However, when the controller needs to communicate with the data subject due
to the uncertainty regarding the identity of the person making the request there may be a
suspension in time until the controller has obtained the information needed from the data subject,
provided the controller has asked for additional information without undue delay.... Example:
Following the reception of the request, a controller reacts immediately and asks [for] the
information it needs to confirm the identity of the person making the request. The latter replies
only several days later and the information that the data subject sends to verify the identity does
not seem sufficient which requires the controller to ask for clarifications. In this situation there
will be a suspension in time until the controller has obtained enough information to verify the
identity of the data subject.” [Underline emphasis added].
In the present case, given that Airbnb took no action for the first ten days after receipt of the
requests and where it then began an unnecessary pursuit of obtaining a copy of ID from the
Complainant which contributed to a further delay in actioning the requests, the DPC finds that
Airbnb failed to comply in this case with the requirements of Article 12(3) of the GDPR.
On the basis of the above, the DPC considers that Airbnb failed to provide information to the
Complainant on the actions taken on his access and erasure requests within one month of
receipt of the requests and therefore failed in its obligations under Article 12(3) GDPR.
Issue 4 (a): Whether Airbnb had a lawful basis for requesting a copy of the Complainant’s ID,
and upon the Complainant’s refusal to provide same, whether Airbnb had a lawful basis to
thereafter request a telephone call in order to verify the Complainant’s identity in
circumstances where he had submitted requests for access and erasure pursuant to Articles 15
and 17 GDPR.
Article 5(1)(a) GDPR states that personal data shall be “processed lawfully, fairly and in a
transparent manner in relation to the data subject.”
4 Guidelines 01/2022 on data subject rights — Right of access
2 This is now paragraph 159 in the revised Guidelines 01/2022 on data subject rights — Right of access adopted
on 28 March 2023.
19
An Coimisitn um
Chosaint Sonrai
Data Protection
Commission
86. Airbnb advised that its identity verification policies and procedures are in place to protect the
Airbnb platform and its users, in accordance with its obligations under the GDPR in a manner that
facilitates and safeguards the rights of data subjects under the GDPR.
87. Airbnb advised the DPC that at the time the Complainant submitted his access and erasure
requests in 2018, shortly after the introduction of the GDPR, ID verification was the preferred
method of authenticating access and deletion requests, given the probative value of ID
verification and the safety and security issues associated with the nature of the Airbnb platform.
The DPC notes that the Complainant had logged into his Airbnb account on 9 June 2018, utilising
the password-forgotten function and discovered it was still active, prior to the submission of his
erasure request of 6 July 2018.
88. Article 4(2) of the GDPR defines “processing” as “any operation or set of operations which is
performed on personal data or on sets of personal data, whether or not by automated means,
such as collection, recording, organisation, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure or destruction.”
89. Article 5(1)(c) of the GDPR states that “Personal data shall be adequate, relevant and limited to
what is necessary in relation to the specific purposes for which they are processed.”
90. Article 6(1)(f) of the GDPR states that the processing of personal data shall only be lawful if and
to the extent “the processing is necessary for the purposes of legitimate interest pursued by the
controller or by a third party, except where such interests are overridden by the interests of
fundamental rights and freedoms of the data subject which require protection of personal data,
in particular where the data subject is a child.”
91. Article 12(6) of the GDPR states that “Without prejudice to Article 11, where the controller has
reasonable doubts concerning the identity of the natural person making the request referred to in
Articles 15 to 21, the controller may request the provision of additional information necessary to
confirm the identity of the data subject.”
92. As per Article 12(6), Airbnb may request the provision of additional information necessary to
confirm the identity of the data subject should it have any reasonable doubts concerning the
person’s identity.
93. The DPC notes that Airbnb has claimed legitimate interests pursued by the controller as the lawful
basis for requesting a copy of ID in order to verify the authenticity of the request and verify the
account holder to ensure that their personal data was not disclosed or deleted in illegitimate or
otherwise inappropriate circumstances, in accordance with Article 6(1)(f) of the GDPR. While the
DPC considers that a legitimate interest does exist in Airbnb ensuring it does not disclose or delete
personal data in an illegitimate or inappropriate circumstance, in the instance of this case Airbnb
20
94.
95.
96.
97,
98.
99.
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
has not demonstrated to this inquiry that the request for a copy of the Complainant’s ID was
either necessary or proportionate for the completion of the access and erasure requests as
Airbnb was able to verify the Complainant’s identity through other means. The DPC is of the view
that other methods were available to Airbnb at the time that would have negated the need for
Airbnb to request a copy of ID. Airbnb has failed to provide evidence in this Inquiry to
demonstrate that Airbnb first attempted to utilise other tools it already possessed, such as the
completion of a telephone call.
The DPC notes that Airbnb was subsequently able to authenticate the Complainant’s rights
requests through the completion of a telephone call between the Complainant and Airbnb.
Airbnb has advised the DPC that the telephone call was a convenient alternative verification
method that the Complainant was amenable to.
The DPC considers the request to provide a copy of his ID in order to verify his identity so as the
Complainant could exercise his rights pursuant to Articles 15 and 17 of the GDPR constituted the
collection of personal data. This was data processing as per Article 4(2) of the GDPR. In this case,
the DPC does not consider that the legitimate interest pursued by the controller constitutes a
valid lawful basis under Article 6 for that specific data processing activity.
The DPC notes that Airbnb has advised it is not in a position to comment on any reasonable
doubts in existence at the time in question in circumstances where the underlying account has
been deleted. The DPC considers that Airbnb has not sufficiently demonstrated to this Inquiry
that it had reasonable doubts in this case as to the Complainant's identity such as would have
justified it requesting to provide additional information to confirm identity through the provision
of a copy of the Complainant’s ID. Further, the DPC does not consider that the request for ID was
either necessary or proportionate in circumstances where there were less data-driven options
available to Airbnb to confirm the Complainant’s identity. As such, Airbnb has not demonstrated
that it had reasonable doubts as to the Complainant’s identity in accordance with Article 12(6).
The DPC finds that Airbnb’s request that the Complainant verify his identity by way of
submission of a copy of his ID constituted an infringement of the principle of data minimisation,
pursuant to Article 5(1)(c) of the GDPR. This infringement occurred in circumstances where less
data-driven solutions to the question of identity verification were available to Airbnb.
The DPC finds that Airbnb has not demonstrated that reasonable doubts existed concerning
the Complainant’s identity that would have necessitated the application of Article 12(6) of the
GDPR.
The DPC finds that, in the specific circumstances of this Complaint, the legitimate interest
pursued by Airbnb did not constitute a valid, lawful basis under Article 6(1)(f) of the GDPR for
seeking a copy of the Complainant’s ID in order to process his access and erasure requests.
21
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
100. With regard to the telephone call made by Airbnb to the Complainant-on 31 July 2018 (to which
the Complainant was amenable) Airbnb informed the DPC that it relied on Article 6(1)(f) as the
lawful basis for a variety of legitimate interests including its legitimate interest in verifying the
authenticity of the requests and the legitimate interests of the account holder in ensuring that
their personal data was not disclosed or deleted in illegitimate or otherwise inappropriate
circumstances. It stated that this was a precautionary step to supplement the engagement with
the Complainant by email to ensure that the individual communicating by email was the account
holder in question.
101. The DPC considers that the telephone call to the Complainant was a proportionate and
appropriate form of contact in this case to verify the authenticity of the access and erasure
requests. In particular, where an erasure request sought the deletion of an individual’s Airbnb
account, Airbnb had strong legitimate interests and good reason to exercise caution in verifying
the authenticity of the request prior to commencing the deletion process through contacting the
requester by an alternative method to that used to submit the request. Accordingly, the DPC is
of the view that Airbnb could rely on Article 6(1)(f) as the lawful basis for contacting the
Complainant by telephone after receiving his access and erasure requests in order to verify the
authenticity of those requests.
Decision on infringements of the GDPR
102. Following the investigation of the Complaint against Airbnb Ireland UC, the DPC is of the opinion
that Airbnb Ireland UC infringed the General Data Protection Regulation as follows:
° Article 5(1)(c) of the GDPR
The DPC finds that Airbnb’s request that the Complainant verify his identity by way of submission
of a copy of his ID constituted an infringement of the principle of data minimisation, pursuant to
Article 5(1)(c) of the GDPR. This infringement occurred in circumstances where less data-driven
solutions to the question of identity verification were available to Airbnb.
Co) Article 6(1)(f) of the GDPR
The DPC finds that, in the specific circumstances of this Complaint, the legitimate interest pursued
by Airbnb did not constitute a valid lawful basis under Article 6(1)(f) of the GDPR for seeking a
copy of the Complainant’s ID in order to process his access and erasure requests.
e Article 15(1) of the GDPR
The DPC finds that Airbnb infringed Article 15(1) of the GDPR at the time of first processing the
Complainant's access request by not providing him with access to all of his personal data that was
being processed by Airbnb on the date of receipt of his access request.
22
An Coimisidn um
Chosaint Sonrai
Data Protection
Commission
° Article 12(1) of the GDPR
The DPC finds that Airbnb infringed Article 12(1) of the GDPR at the time of first processing the
Complainant’s access request by failing to provide the Complainant with an access file that was
of a concise, transparent, intelligent and easily accessible form.
° Article 12(3) of the GDPR
The DPC finds that Airbnb failed to provide information to the Complainant on the actions taken
on his access and erasure requests within one month of receipt of the requests and therefore
failed in its obligations under Article 12(3) of the GDPR.
Remedial measures undertaken by Airbnb Ireland UC
103. In respect of the Complainant’s request for access to his personal data submitted on 6 July 2018
pursuant to Article 15 of the GDPR, it is noted that Airbnb eventually provided the Complainant
with access to his personal data, and any explanations for data not provided to the Complainant,
on 27 May 2020.
104. In respect of the Complainant’s access request and the failure of Airbnb to provide the
Complainant with his access file and cover email in German, the DPC notes the Complainant was
provided with a German translation copy of Airbnb’s responses on 9 December 2020 following
the DPC’s intervention in the matter.
105. With regard the Airbnb seeking a copy of ID to verify access or erasure requests, Airbnb confirmed
to the DPC that it no longer uses this method to authenticate requests.
Judicial remedies with respect to the decision of the DPC
106. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an
effective judicial remedy against a legally binding decision of a supervisory authority concerning
them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High
Court may be taken by a data subject or any other person (this includes a data controller) affected
by a legally binding decision of the DPC within 28 days of notification such decision. An appeal
may also be taken within 28 days of notification by a data controller: under Section 150(1) against
the issuing of an enforcement notice and/or information notice by the DPC against the data
controller; and under Section 142, against any imposition upon it of an administrative fine by the
DPC.
Exercise of Corrective Power by the DPC
107. In deciding on the corrective powers that are to be exercised in respect of the infringements of
the GDPR outlined above, | have had due regard to the Commission’s power to impose
administrative fines pursuant to Section 141 of the 2018 Act. In particular, | have considered the
23
An Coimisiin um
Chosaint Sonrai
Data Protection
Commission
criteria set out in Article 83(2)(a) — (k) of the GDPR. When imposing corrective powers, | am
obliged to select the measures that are effective, proportionate and dissuasive in response to the
particular infringements. The assessment of what is effective, proportionate and dissuasive must
be made in the context of the objective pursued by the corrective measures, for example re-
establishing compliance with the GDPR or punishing unlawful behaviour (or both)*. | find that an
administrative fine would not be necessary, proportionate or dissuasive in the particular
circumstances in relation to the infringements of the Articles of the GPDR as set out above. For
the reasons outlined, | find that no administrative fine should be imposed in respect of these
infringements.
108. In light of the infringement of Article 12(1) in the case of this data subject, | find it necessary
that the controller bring its data processing into compliance to prevent similar infringements
occurring with regard to data subjects in the future in similar circumstances. Accordingly, the
DPC hereby orders Airbnb to revise its internal policies and procedures as regards the default
position to provide a cover email in English when a data protection rights request is received
outside the privacy portal so that data subjects do not have to provide a separate request to
receive communications from Airbnb in their preferred language. Airbnb is requested to
provide details of its revised internal policies and procedures to the DPC by 20 September,
2023.
109. In light of the extent of the infringements identified above, the DPC hereby issues a reprimand
to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the GDPR.
sneer a,
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
13 See the Article 29 Data Protection Working Party ‘Guidelines on the application and setting of administrative
fines for the purposes of Regulation 2016/679’, at page 11.
24