An Coimisitén um
Chosaint Sonrai
Data Protection
Commission
DPC Complaint Ref: pO
Date: 14 September 2023
Complainant: S|
Data Controller: Airbnb Ireland UC
RE: a. Airbnb Ireland UC
This document is a Decision of the Data Protection Commission of Ireland (“DPC”) in
relation to DPC complaint reference, PE (“Compiaint’), submitted by
(‘Complainant’), against Airbnb Ireland UC (“Airbnb’), to the Commissioner for
Personal Data Protection (“Cypriot DPA”) in its capacity as the concerned
supervisory authority and thereafter referred to the DPC in its capacity as lead
supervisory authority.
This Decision is made pursuant to the powers conferred on the DPC by section
113(2)(a) of the Data Protection Act 2018 (“the Act”) and Article 60 of the General
Data Protection Regulation (“GDPR’).
Communication of Draft Decision to “supervisory authorities concerned”
In accordance with Article 60(3) of the GDPR, the DPC is obliged to communicate the
relevant information and submit a Draft Decision, in relation to a complaint regarding
cross border processing, to the supervisory authorities concerned for their opinion and
to take due account of their views.
In accordance with its obligation, the DPC transmitted a Draft Decision in-relation to
the matter to the “supervisory authorities concerned”. As Aironb offers services
across the EU, and therefore the processing is likely to substantially affect data
subjects in every EU member state, the DPC in its role as lead supervisory authority
identified that each supervisory authority is a supervisory authority concerned as
defined in Article 4(22) of the GDPR. On this basis, the Draft Decision of the DPC in
relation to this complaint was transmitted to each supervisory authority in the EU and
EEA for their opinion.
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
mplaint Handlin h = Timeline an 1m:
The complaint was lodged with the Cypriot DPA on 22 December 2018 and
thereafter was transferred to the DPC, on 04 March 2019, to be handled by the
DPC in its role as lead supervisory authority. The Cypriot DPA advised that a
complaint was made to it by the data subject stating that Airbnb failed to
properly comply with an erasure request he had submitted to iton 18 December
2018. The Cypriot DPA set out to the DPC that, in correspondence to Airbnb
the Complainant informed Airbnb that he wished to withdraw his consent for
the “storing, using and sharing” of any information relating to him. Further, the
Cypriot DPA advised that the Complainant stated in his correspondence to
Airbnb that he would like any information relating to him or his properties,
“including ID information, contact information, personal details, company
information, address or locations, IP addresses, photographs etc., to be
permanently removed from any of the databases related to [Airbnb’s] service,
or third parties or partners of [Airbnb]”. The Complainant, through the Cypriot
CSA, provided the DPC with a copy of correspondence he received from Airbnb
dated 28 December 2018 in which Airbnb notified the Complainant that it had
started to carry out his deletion request and that it would delete his personal
data, except to the extent the GDPR permitted or required Airbnb to retain it.
The Cypriot DPA informed the DPC that the Complainant did not receive any
further notice from Airbnb in relation to his erasure request. The Complainant
attempted to create another account, on 14 February 2019, using the personal
data which he had assumed were deleted (name, phone number, email
address). He received a message in response from Airbnb which stated “A
while back you verified your phone number xxxxxxx. In a recent system update,
this phone number was deactivated, so we’re emailing you to make sure you
have up-to-date contact information on your Airbnb account. To update and
verify your information, please log in to Airbnb and edit your phone number
here.” The Cypriot DPA also provided the DPC with a copy of the
correspondence the Complainant had exchanged with Airbnb.
The DPC notified Airbnb of receipt of the complaint by email on 17 April 2019
and provided it with the correspondence received from the Cypriot DPA.
Airbnb responded by email on 07 May 2019. In its response, Airbnb informed
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
the DPC that the Complainant had operated eight accounts on Airbnb, which
were used to host a number of properties on the platform. Airbnb stated that
on 20 November 2018, the Complainant became involved in an argument with
a guest in one of his properties which led to the guest walking out. Airbnb stated °
that the Complainant pursued and assaulted the guest, punching and beating
the guest in the face with a metal pole. Airbnb stated that it understood that the
police were called and that the guest was hospitalised. Further, Airbnb stated
that the guest has provided it with the police report and medical evidence
detailing the serious injuries that he sustained as a result of the Complainant's
assault on him. Airbnb stated that the Complainant was suspended from Airbnb
as a result of this assault. Airbnb stated that the Complainant submitted an
erasure request in December 2018 but, due to the fact that the Complainant's
account comprises material evidence for the purpose of a potential criminal
prosecution against him, and potential civil litigation against him and/or Airbnb
by the guest who was assaulted, it was required to retain such material for the
time being. In this regard, Airbnb referred to Article 17(3)(b) (retaining data “for
compliance with a legal obligation’) and Article 17(3)(e) (retaining data for the
“establishment, exercise or defence of legal claims”). Airbnb stated that the
continued retention of the Complainant’s personal data complies with Article 5
of the GDPR and that it is transparent about the fact that it retains data where
required for legal reasons. Airbnb asserted that, given that the data comprises
evidence in a criminal matter and potential civil litigation, the retention is ‘
permitted under Article 6(1)(c) (“processing which is necessary for compliance
with a legal obligation to which the controller is subject”). Further, Airbnb stated
that its Privacy Policy notes: “We may retain and use your personal information
to the extent necessary to comply with our legal obligations”.
Airbnb stated that, aside from its obligation to not destroy evidence, such
retention would be in the legitimate interests of Airbnb, the guest who was
assaulted, the police and the public at large. Airbnb stated that on 18 December
2018, the Complainant wrote to Airbnb requesting the deletion of his data, and
in line with its policy, Aironb responded requesting a copy of his ID which the
Complainant provided later that day. Airbnb submitted that it responded to the
Complainant on 28 December 2018 stating that “Airbnb will delete your
personal data, except to the extent GDPR permits or requires us to retain that
data. For example, we retain data that is necessary for complying with laws to
which we are subject, for exercising the right of freedom of expression and
information (such as the content of reviews), and for the establishment,
exercise or defence of legal claims (such as information relating to user
disputes).” Airbnb stated that, as it had provided information on the action taken ‘
on the request within one month, it complied with its obligations
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
under Article 12 and that as the data was retained for legal reasons (per Article
17(3)), it also complied with its obligations under Article 17.
The DPC raised additional queries with Airbnb in correspondence dated 28
May 2019. Airbnb responded by email on 05 June 2019.
In response to the DPC’s query as to whether any of the Complainant's
personal data was deleted in response to his erasure request, Airbnb stated
that, while it is on notice of an alleged serious assault, it is not yet in a position
to determine what information is relevant to the criminal or civil cases which
may ensue. Airbnb stated that the Complainant’s public profile no longer
appears on the platform and that the Complainant was informed that Airbnb
would retain data for the establishment, defence or exercise of legal claims
such as information relating to a dispute. Airbnb stated that given the serious
legal issues that arose with the Complainant and his Airbnb account, it was
retaining his ID as relevant material and that the retention of this relevant
material is founded on a number of legal bases. Airbnb stated that, as the
Complainant, an Airbnb host, has allegedly perpetrated a serious assault on
an Airbnb guest, any data relating to his account may comprise evidence in a
criminal matter and it may give rise to potential civil litigation. Airbnb stated that,
in this context, the retention is based upon Article 6(1)(c), “processing which is
necessary for compliance with a legal obligation to which the controller is
subject’. Further, Airbnb asserted that such retention is in the legitimate
interests of Airbnb, the guest who was assaulted, the police and the public at
large. Airbnb submitted that its Privacy Policy states that personal information
may be retained and disclosed “for the purposes of our or a third party's
legitimate interest in keeping the Airbnb Platform secure, preventing harm or
crime, enforcing or defending legal rights ... or preventing damage’. Finally,
Airbnb asserted that such retention is necessary for the “purposes of providing
or obtaining legal advice or for the purposes of, or in connection with, legal
claims, prospective legal claims, legal proceedings or prospective legal
proceedings” or ‘is otherwise necessary for the purposes of establishing,
exercising or defending legal rights” based upon section 41(c) of the Data
Protection Act 2018. Airbnb stated that if it is the case that the injured party is
not going to take legal action and the statute of limitations in the relevant
jurisdiction has expired it would then be in a position to delete the account in
accordance with its legal obligations
The DPC reverted to Airbnb by email on 10 June 2019 requesting a copy of all
Airbnb privacy policies along with information/policies regarding ID retention
that had been in place since 25 May 2018. Airbnb responded by email on 13
4
10.
11.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
June 2019 providing copies of the requested policies.
The DPC provided an update to the Complainant which issued via the Cypriot
DPA on 02 September 2019 and a further update which issued to the Cypriot
DPA on 18 November 2019.
The Complainant responded to the Cypriot DPA by email dated 27 November
2019. In his response, the Complainant re-asserted his complaint that Airbnb
had not properly complied with his erasure request and that it had no lawful
basis to retain his personal information. The Complainant stated that the
incident Airbnb was referring to did not concern a guest who had booked
through his personal account or with whom he had any relationship
whatsoever. The Complainant stated that in September 2018 a visitor booked
an apartment owned by a third party, in an apartment complex. The
Complainant stated that he was the manager of the said apartment and that he
was physically assaulted by the guest. He stated that both a written complaint
and criminal prosecution was filed for this incident. The Complainant stated that
Airbnb blocked access to his personal account which he asserted had nothing
to do with the incident or with the property booked by the guest who physically
assaulted him. The Complainant stated that he requested that Airbnb erase all
data related to him but that he did not receive any reply from it. The
Complainant stated that he subsequently tried to create a new account but that
he received a message stating that he was not allowed to use the services of
the website on the basis of data retained by Airbnb. The Complainant submitted ,
that his personal account was not associated in any way with the booking
completed by this guest, the guest in question or the property in which this guest
stayed.
The DPC outlined the Complainant’s response to Airbnb via email on 28
January 2020.
Airbnb responded to the DPC by email on 11 February 2020 clarifying its
position. Airbnb stated that the Complainant created six different Airbnb
accounts under several aliases and email addresses. Airbnb stated that
“certain of these Airbnb accounts” were created under the name of the
apartment complex i, of which the Complainant was the
supervisor. Airbnb stated that the Complainant was also an Airbnb host of
certain apartments in that complex. Airbnb stated that the guest had booked a
listing in this apartment complex, which was advertised on an Airbnb account
belonging to the Complainant’s father. Airbnb stated that, while it had received
two different versions of the incident, the guest had provided supporting
evidence of his claim, including a police report and medical evidence detailing
5
12
13.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
the serious injuries that he sustained. Airbnb stated that the guest claimed that,
during an altercation, the Complainant assaulted him with a metal pole. The
guest in question called the police and, after the police arrived, the guest was
taken to hospital. Airbnb stated that the Complainant (i) was a host of other
listings at the same apartment complex; (ii) was the supervisor of the entire
complex; (iii) was closely connected to the host of the listing in which the guest
was staying (i.e. his father); (iv) appeared to be responsible for responding to
guest complaints at the complex when they were escalated by the front desk
manager (regardless of whether or not he is a host of those listings); and (v)
was involved in an alleged assault which is subject to an on-going criminal
investigation. On this basis, Airbnb maintained that the right of erasure does
not apply because the retention is both necessary “for compliance with a legal
obligation” in accordance with Article 17(3)(b) and for the “establishment,
exercise or defence of legal claims” in accordance with Article 17(3)(e). Airbnb
asserted that the Complainant's accounts contained material evidence for the
purpose of a potential criminal prosecution against him, and potential civil
litigation against him and/or Airbnb by the guest in question. Airbnb stated that,
further to its interaction with the DPC, it had carried out an additional review of
the Complainant’s accounts. Airbnb stated that, based on this review, it found
that five of the Complainant's accounts contained limited information and low
activity. Airbnb stated that, subject to obtaining specialist legal advice, it may
be in a position to delete these five accounts but that it was acutely aware of
the need to exercise caution in deleting any information, as it did not wish to
impede, or be viewed as impeding, any potential criminal and/or civil
investigation. Airbnb stated that once it is satisfied that any criminal case and/or
any civil claim(s) have been fully concluded, subject to the relevant applicable
statutes of limitations, and that the information is no longer necessary in light
of the above purposes, it would then process the Complainant’s deletion
request pursuant to applicable laws.
The DPC outlined Airbnb’s position to the Complainant in correspondence sent
via the Cypriot DPA on 10 March 2020.
The Complainant responded via correspondence which was provided to the
DPC by the Cypriot DPA on 15 April 2020. In his response, the Complainant
confirmed that the guest in question had made their reservation through his
father’s Airbnb account. The Complainant stated that until September 2018, he
only had one account with Airbnb and that after the incident and his account
was locked, he submitted an erasure request to Airbnb. The Complainant
stated that he then attempted to create a new account and realised that Airbnb
had retained his personal data. The Complainant stated that he attempted to
create new accounts to see whether Airbnb continued to retain his personal
6
14.
6.
16.
17.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
information, despite his repeated requests for erasure. The Complainant :
confirmed that there was an assault case registered against him in the courts
in Cyprus. The Complainant stated that it was for the Courts to make a
determination in relation to the case, not Airbnb. The Complainant reiterated
his earlier points, that he had nothing to do with the reservation made by the
guest through the Airbnb platform, that the guest did not book any. property
owned by him and that the apartment the guest rented was through a third party
account, which happened to belong to his father. The Complainant asserted
that he did not manage the property the guest booked. He stated that his father
manages his own properties in the complex, and that his father has a
management contract with another company.
The DPC raised further queries with Airbnb by email on 05 May 2021 and it
also outlined the Complainant's response to Airbnb’s submissions.
Airbnb responded by email on 19 May 2021. In its response, Airbnb set out to
the DPC that it continued to retain the Complainant's suspended accounts
because of the fact that he had been implicated in a serious incident at a listing,
to which he had very close personal and business ties. Airbnb stated thatitwas .
of the understanding that criminal and civil proceedings involving the
Complainant and the guest in question were ongoing, but that discussions
around a potential settlement had taken place. Airbnb suggested that if the
Complainant was in a position to provide it with appropriate documentation,
such as official court documentation and/or sworn affidavits, which could allow
Airbnb to verify that these legal proceedings, including any appeal processes,
had concluded or that these legal proceedings had otherwise been conclusively
resolved, it would review its position and determine whether the deletion of the
Complainant's accounts was possible, in the circumstances. Airbnb also
suggested that the Complainant provide it with official court record numbers
and any other relevant references or material relating to these legal
proceedings, which would enable Airbnb to satisfy itself of the status of such
proceedings. Airbnb confirmed that it had not received any requests for
information from law enforcement agencies or from the legal representatives of
the parties in relation to the incident in question. Airbnb asked the DPC whether
its procedure could be paused to allow for a possible resolution of the matter
between the parties, pending further engagement.
The DPC reverted to Airbnb by email on 01 June 2021 and confirmed that it
would put Airbnb’s response to the Complainant in an attempt to amicably
resolve the complaint.
The DPC outlined Airbnb’s response to the Complainant in correspondence
7A
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
which issued to the Cypriot DPA on 16 June 2021. The DPC issued further
correspondence to the Complainant on 29 December 2021, as it had not
received any response to its letter of 16 June 2021.
18 The DPC received the Complainant's response to its letters of 16 June 2021
and 29 December 2021 via correspondence that was provided by the Cypriot
DPA on 18 March 2022. In his response, the Complainant stated that his
private dispute with a third party in a local civil court had nothing to do with
Airbnb and stated that he would not be providing any further personal data,
especially as Airobnb was currently withholding his personal data and refusing
to delete it despite his several requests. The Complainant asserted that by
refusing to delete his personal data as requested, Airbnb was acting in
contravention of the GDPR.
12. Despite its efforts during the complaint handling phase, the DPC was unable
to facilitate the amicable resolution of this complaint. Therefore, the unresolved
issues in relation to this complaint at the end of the DPC’s complaint handling
process were as follows:
a) Whether Airbnb properly complied with the Complainant’s erasure request
pursuant to Article 17;
b) Whether Airbnb has a lawful basis for the retention of the Complainant's
personal data in circumstances where he has exercised his right to erasure;
c) Whether Airbnb has complied with the principle of data minimisation where it
has retained the Complainant's personal data following the processing of his
erasure request;
d) Whether Airbnb complied with principles of transparency and provision of
information in respect of the Complainant's erasure request and in circumstances
where it retained the Complainant’s personal data following the processing of his
erasure request.
fF Inqui
2. Acting in its capacity as lead supervisory authority, the DPC commenced an
Inquiry in relation to this matter by issuing a Notice of Commencement of
Inquiry to Airbnb on 07 October 2022.
2B.
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
The DPC advised Airbnb that the Inquiry would seek to examine and assess
whether or not Airbnb had complied with its obligations under the GDPR and
the Act, in particular under Articles 5, 6, 12 and 17 of the GDPR in respect of
the relevant processing operations which are the subject matter of the
complaint.
The DPC issued a letter to the Complainant informing him that an Inquiry had
commenced in relation to his complaint. This letter was sent to the Cypriot DPA
on 07 October 2022 for onward transmission to the Complainant. No
submissions were received from the Complainant in respect of that notification.
Airbnb responded, by letter dated 11 November 2022, to the queries raised by
the DPC in its Notice of Commencement of Inquiry dated 07 October2022.
Before addressing the DPC’s queries, Airbnb set out a number of preliminary
overarching comments. Airbnb stated that the Complainant's accounts are being
retained on foot of Cypriot legal advice, following a serious incident at an Airbnb
listing that was/is the subject matter of a police investigation and legal
proceedings. Airbnb further stated that, on 19 May 2021, it requested, through
the DPC, that the Complainant produce evidence that would assist Airbnb in
determining whether the underlying legal issues warranted ongoing retention of
these accounts. Airbnb stated, however, that the Complainant refused to engage
with these attempts to resolve the complaint.
Airbnb submitted that, in the absence of engagement by the Complainant and in
light of the Notice, it re-engaged with Cypriot legal counsel to review its legal
position based on the information available to it. Airbnb stated that following
receipt of further advice and given the lapse of time since the incident in
question, Airbnb assessed that it could carry out targeted deletion of personal
data relating to the Complainant, subject to the DPC’s agreement with this
course of action. Airbnb stated that it is in the process of reviewing the
Complainant's personal data to identify the information that can be deleted in’
the circumstances. Airbnb stated that notwithstanding the proposed deletion of
such data, it will continue to retain material connected with or relevant to the
incident in question, both for the purpose of this statutory inquiry and any related
legal processes, as well as in relation to any current or prospective legal claims,
including to defend claims against Airbnb. Airbnb further stated that it was
advised by Cypriot legal counsel to retain such information until the end of the
Cypriot statutory limitation period, which will run until 22 November 2024.
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
Airbnb submitted, however, that if it receives satisfactory evidence that the
underlying legal issues have been conclusively resolved, it will review this with
Cypriot counsel with a view to deleting the retained information based on that
evidence, subject to retaining such information as is necessary until the end of
this statutory inquiry and any related legal processes. Airbnb further submitted
that it will continue to retain certain residual data for safety, security and legal
compliance purposes.
In order to progress matters, the DPC sought further clarification from Airbnb in
relation to the status of the Complainant, the guest and the property owner on
the platform. The DPC queried whether, at the time of the alleged assault, the
guest who was allegedly assaulted was a registered user of Airbnb staying in a
property advertised by the Complainant on the Airbnb platform. The DPC further
queried what the Complainant's relationship was to the property and, if the
Complainant was not the registered host of the property rented by the guest who
was allegedly assaulted, why the Complainant's Airbnb account and personal
information held on his Airbnb account has been associated with the alleged
assault incident. The DPC also asked how Airbnb can justify retaining the
Complainant's personal data on his Airbnb account in connection with an alleged
assault that took place in a property that was not associated with the
Complainant's Airbnb account.
In response to these queries, Airbnb submitted that, by way of summary of the
details provided in its previous responses to the DPC, the guest in question was
an Airbnb user staying in an Airbnb listing hosted by the Complainant's father.
Airbnb stated that this accommodation listing forms part of a group of Airbnb
properties that the Complainant is connected to by close business and personal
ties, including the fact that he worked at the complex where the guest was
staying and hosts Airbnb listings at this complex.
Airbnb stated that information relating to the incident in question, including
lengthy communications from the Complainant regarding the incident, are
“contained in certain of the complainant’s accounts”. Airbnb submitted that it had
been advised by Cypriot legal counsel to retain the Complainant's suspended
Airbnb accounts in light of the incident in question and resulting civil and criminal
legal proceedings. Airbnb reiterated that it is in the process of reviewing the
Complainant’s personal data to identify what/if any information that can now be
deleted.
Airbnb submitted that many of the facts described by it, including the existence
of civil and criminal legal proceedings, were acknowledged by the Complainant
in his communications with Airbnb and in information and materials provided to
10
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
the DPC by the Complainant, with the Notice itself at paragraph 15 referring to
an acknowledgment from the Complainant to the DPC that there is “‘an assault
case registered against him in the courts in Cyprus, but that it was for the Courts
to decide on this and not Airbnb’”. Airbnb stated that the Complainant's
communications with Airbnb include messages from the Complainant on behalf
of his and his father’s property companies in relation to the incident in question
and the related legal proceedings.
Airbnb submitted that the Complainant is attempting to rely on arbitrary lines of
demarcation between a number of separate Airbnb accounts that are linked by
common commercial and personal connections and which relate to properties in
the same commercial property complex, making them a network of associated
accounts, while also failing to acknowledge the “crucial” fact that substantive
material relating to this incident is “contained in certain of his accounts’.
In response to the DPC’s query as to when Airbnb received the Complainant’s
erasure request, Airbnb stated that the Complainant submitted a number of
deletion requests across a number of accounts but that his first deletion request
was made on 18 December 2018. Airbnb provided the DPC with a copy of this
deletion request.
When asked by the DPC when it had first responded to the Complainant's
request, Airbnb stated that it responded to the request on 18 December 2018,
asking that he verify his identity for the purpose of authenticating his deletion
request. Airbnb stated that, once authenticated on 28 December 2018, it
informed the Complainant that his personal data would be deleted unless Airbnb
was permitted or required to retain data. Airbnb provided a copy of this’
correspondence. Airbnb stated that it ultimately retained the Complainant's
accounts for the reasons explained in its previous responses to the complaint.
In response to the DPC’s request for a schedule of the categories of data
retained by Airbnb following the processing of the Complainant's erasure
request pursuant to Article 17, Airbnb submitted that it has retained each of the
Complainant’s accounts, a number of which were created following the incident,
in their entirety. Airbnb advised that the personal data retained comprises
various account information provided by the Complainant or generated in
connection with his use of the Airbnb platform, for example “account information
including profile details, preferences and contact information; listing and
reservation data; reviews data; identity verification information, in particular a
copy of the Complainant's Cypriot identity card; financial information such as
bank account and credit card details used for transactions on the platform, and
tax information relating to applicable tax requirements; communications on and
11
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
relating to the Airbnb platform for example messages with other users and
emails to Airbnb; and technical logs relating to activities on the platform, for
example account login records, IP addresses, device details, etc.”
Airbnb submitted that, to date, it has not deleted any personal data in the
Complainant's accounts based on the advice of Cypriot legal counsel that all
accounts should be retained in their entirety, for reasons that include the
potential.need to preserve a broader set of evidence that may be used in civil
and criminal legal proceedings. Airbnb stated that it is currently in the process of
reviewing the Complainant's personal data to identify information that can now be
deleted in the circumstances. Airbnb stated that it will however continue to retain
any information it considers to be relevant to the incident in question or
necessary in the context of Airbnb’s engagement with this statutory inquiry and
any related legal processes. Airbnb stated that it will also retain certain residual
personal data for safety, security and legal compliance reasons, for example
limited account information which it retains for security reasons associated with
identifying connections between Airbnb accounts, activity logs that are used to
enhance its security processes, and information that it is required to retain to
comply with laws, such as under record-keeping and anti-money laundering
obligations.
In response to the DPC’s query as to the legal basis for retaining each category
of personal data following the processing of the Complainant’s erasure request
and why the retention of this data was necessary and proportionate, Airbnb
submitted that it has retained the Complainant's accounts on the basis of
sections 41(b) and (c) and sections 60(3)(a)(ii) and (iv) of the Data Protection
Act 2018, relating respectively to the investigation of criminal offences and the
contemplation or existence of legal proceedings (with sections 41(c) and
60(3)(a)(iv) to be read in conjunction with Article 17(3)(e) of the GDPR). Airbnb
posited that where it is required to retain information for legal compliance
purposes, for example transactional information required for compliance with
record-keeping obligations, it relies on Article 17(3)(b) of the GDPR.
Airbnb stated that it also retains this personal data on the basis of the legitimate
interests of those involved in or otherwise connected with the underlying police
investigation and legal proceedings, including the wider public interest in
preserving the integrity of police investigations and judicial processes, and the
legitimate interests of Airbnb, its users, partners and those otherwise associated
with the platform in keeping the Airbnb platform safe, in accordance with Article
6(1)(f) of the GDPR.
12
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
%_Inresponse to the DPC’s query in respect of the data minimisation efforts carried
A.
out by Airbnb in relation to this retained data, Airbnb submitted that it had been
advised by Cypriot legal counsel to retain the Complainant's deactivated,
accounts in their entirety, for reasons that include the potential need to preserve
a broader set of evidence that may be used in civil and criminal legal
proceedings. Airbnb stated that in light of the legal advice it received, it believes
the retention of the Complainant's accounts was adequate, relevant and
necessary for the underlying processing purposes. Airbnb stated that it is now
in the process of reviewing the Complainant's personal data to identify the
information that can be deleted in the circumstances, save for data more
particularly described above, which is being retained for specific purposes and
is limited to data necessary for those specific purposes.
Airbnb submitted that material relating to the incident in question will be retained
until 22 November 2024, being the end of the Cypriot statutory limitation period.
Airbnb stated that if it receives satisfactory evidence that the underlying legal
issues have been conclusively resolved, it will review this with Cypriot counsel
with a view to deleting this material based on that evidence. Airbnb stated that
notwithstanding this, it will retain such information as is necessary for the
purpose of Airbnb’s engagement with this statutory inquiry and any related legal
processes, until the expiration of such processes. Airbnb further stated that it will
retain certain information for (i) safety and security purposes, for a period of five
years from the deletion of the relevant account and (ii) legal compliance
purposes, for the associated periods prescribed by law.
In response to the DPC’s query as to the processing this data undergoes
following the processing of the Complainant's erasure request, Airbnb submitted
that material relating to the incident in question is not being actively processed
but rather retained, save for use in its investigation of the incident and its
responses to this complaint and inquiry. It stated that material retained for safety
and security purposes is used for a variety of security related processes,
including preventative measures such as identifying suspended users
resurfacing on the platform, and security-enhancement processes such as
security product and procedure improvement. Airbnb stated that material
retained for legal compliance reasons is processed in accordance with
underlying legal obligations; for example, identify verification information
retained to comply with anti-money laundering legislation will be verified for
authenticity and then retained for evidentiary reasons which include auditing
purposes.
Airbnb stated that the data is being retained and used for specific purposes and
that it is not processed for reasons that are unconnected to these purposes.
13
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
In response to the DPC’s query as to the legitimate interest for retaining each
category of personal data, Airbnb reiterated that it retains all the accounts on the
basis of the legitimate interests of those involved in or otherwise connected with
the underlying police investigation and legal proceedings, including the broader
public’s interest in preserving the integrity of police investigations and judicial
processes; the legitimate interests of Airbnb to be able to exercise its legal rights
and to defend itself against legal claims; and the legitimate interests of Airbnb,
its users, partners and those otherwise associated with the platform in keeping
the Airbnb platform safe, in accordance with Article 6(1)(f) of the GDPR.
In response to the DPC’s queries regarding the legal obligation Airbnb was
referring to and the legislation that places this obligation on Airbnb, Airbnb
submitted that at the time in question it was concerned that the police
investigation and any related legal processes in Cyprus meant that Airbnb was
potentially legally obliged to retain the Complainant’s accounts for reasons such
as evidentiary purposes. Airbnb stated that, having reviewed this matter again
with Cypriot counsel, its position is that it has been unable to determine if a legal
requirement exists, but that retention remains necessary for litigation and
attendant liability reasons.
In response to the DPC’s query in respect of why it considered it both necessary
and proportionate to retain each category of personal data for the purposes of
pursuing the identified legitimate interest and the data minimisation efforts
carried out by Airbnb in relation to this data, Airbnb submitted that it had been
advised by Cypriot legal counsel to retain the Complainant's accounts in their
entirety, for reasons that include the potential need to preserve a broader set of
evidence that may be used in civil and criminal legal proceedings. Airbnb stated
that it believed that this rendered the retention of the Complainant's account
adequate, relevant and necessary, and by extension proportionate, within the
meaning of the data minimisation principle under Article 5(1)(c) of the GDPR.
Airbnb once again stated that it was in the process of reviewing the
Complainant's personal data to identify the information that can be deleted in
the circumstances, save for data relating to the incident in question and certain
residual data being retained for safety, security and legal compliance purposes.
In response to the DPC’s query as to the balancing test conducted by Airbnb
when considering what categories of personal data were necessary to retain for
achieving the purpose of pursuing the identified legitimate interests, Airobnb
submitted that the Complainant’s accounts are being retained following a serious
incident at an Airbnb listing that was/is the subject matter of a police
14
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
investigation and legal proceedings. Airbnb submitted that the rights of the
parties to those proceedings and those otherwise associated with those
proceedings (including Airbnb’s right to avoid liability for the premature
destruction of evidence), the wider public interest in preserving the integrity of
police investigations and judicial processes and Airbnb’s need to act prudently
in such circumstances, collectively outweigh the Complainant's right to delete
these accounts under Article 17 of the GDPR. Airbnb stated that similarly, the
retention of certain limited data for security reasons has no significant impact on
the Complainant, but serves to help Airbnb protect its platform and those
connected with it, including to identify and restrict the Complainant's attempts to
create further accounts on the platform. Airbnb submitted that it carried out a
balancing test and reached the conclusion that the identified legitimate interests
are not overridden by the Complainant's interests or fundamental rights and
freedoms in circumstances where a number of important issues and
prerogatives, including issues of platform safety and broader societal
importance, override his right to erase personal data from the Airbnb platform, ,
under Article 17 of the GDPR.
Airbnb stated that section 41(c) of the Data Protection Act 2018 permits ongoing
processing of personal data for purposes which are different to the original
processing purposes, for the following reasons: where the processing is
necessary for the purposes of providing or obtaining legal advice or for the
purposes of, or in connection with, legal claims, prospective legal claims, legal
proceedings or prospective legal proceedings; where the processing is
otherwise necessary for the purposes of establishing, exercising or defending
legal rights. Airbnb stated that it is retaining these accounts on foot of Cypriot
legal advice relating to legal proceedings, including the aforementioned civil and
criminal proceedings, and the attendant legal rights connected with these
proceedings, which include Airbnb’s right to protect itself from any liability flowing
from the destruction of important evidence and otherwise to defend itself from
claims related to the incident itself.
The DPC asked Airbnb to provide it with any notifications/requests it received
from either party or law enforcement that the Complainant's personal data would,
be required for the purpose of a legal claim/prospective claim. In response,
Airbnb stated that it is on notice of the existence of police investigations and
legal proceedings but it has not received any formal requests for information in
relation to the incident. Airbnb stated that it wished to clarify its previous
statements to the DPC wherein it advised that it had received a copy of a police
report, when in fact the guest had informed Airbnb that he had reported the
incident to the police. Airbnb stated that, in light of advice of Cypriot counsel,
15
51.
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
and in order to take steps to resolve the complaint, it asked the Complainant to
produce evidence that would assist it in determining whether the underlying legal
issues warranted ongoing retention of these accounts. Airbnb stated that the
Complainant has refused to engage with these attempts to resolve the
complaint. |
The DPC asked Airbnb to provide it with a copy of the notice that was provided
to Airbnb of the alleged assault which it had referred to in its correspondence of
05 June 2019. In response, Airbnb stated that on 22 November 2018, the
Complainant's father and a representative of the family business called Airbnb
to report the incident, which resulted in an investigation that involved calls and
emails between Airbnb, the host and his representative, the guest and the
Complainant. Airbnb stated that, as such, Airbnb’s initial notification of the
incident came in the form of a phone call from the Complainant’s father, which
was logged. Airbnb stated that the guest provided Airbnb with hospital
documentation and photographic evidence of his injuries, and the guest also
referred to making a report to the police. Airbnb stated that ultimately, Airbnb’s
investigations resulted in the Complainant's accounts and his father’s accounts
being suspended.
The DPC posed specific queries in relation to the current status of the
Complainant’s erasure request and asked Airbnb whether it had received a
request from law enforcement/police or any legal representatives for information
or a request to retain information in relation to the alleged assault. Airbnb
responded that it has not received any formal requests, however it stated that it
has been advised by Cypriot legal counsel to retain the Complainant's accounts
which it is doing on the basis of sections 41(b) and (c) and sections 60(3)(a)(ii)
and (iv) of the Data Protection Act 2018, and the legal obligations and legitimate
interests detailed in its responses to the DPC.
The DPC, by correspondence dated 22 March 2023, issued additional queries
to Airbnb. Airbnb responded to these queries by letter dated 05 April 2023.
Airbnb submitted that, to date, it has not been a party to legal proceedings
concerning the incident. Airbnb stated that, as set out in its previous response
of 11 November 2022, the Complainant himself acknowledged the existence of
legal proceedings relating to the incident at the Airbnb listing, with the effect that
Airbnb’s potential involvement in legal proceedings relating to the relevant
incident was, and is, a real risk. Airbnb stated that it is important to bear in mind
that the risk of legal proceedings involving Airbnb extends to the guest in
question initiating legal proceedings against Airbnb or otherwise attaching
Airbnb to legal proceedings within the permissible statutory limitation periods.
16
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
Airbnb submitted that it reasonably anticipated that proceedings were likely on
the basis that a serious incident occurred at an Airbnb listing, which
subsequently resulted in legal proceedings involving the Complainant and the
guest in question.
Airbnb submitted that given the serious nature of this incident and the
contentious nature of this complaint, coupled with the fact that the relevant
statutory limitation periods in Cyprus have not expired, Airbnb has a reasonable
basis upon which to take the position that legal proceedings concerning its role
in this incident remain a possibility.
Airbnb submitted that its Cypriot lawyers advised that it was prudent to retain
the Complainant’s accounts in light of the incident in question, in particular in
case the information in the accounts was important evidence in legal
proceedings.
Airbnb submitted that the retention period corresponds with the relevant
statutory limitation periods for legal proceedings in Cyprus. Airbnb stated that,
in other words, it has been advised by Cypriot legal counsel to retain information
relating to the incident in question until the statutory time limits for related legal
proceedings have elapsed.
Airbnb submitted that in December 2018, it was not in a position to decide what
data points were or were not relevant for potential legal proceedings relating to
this incident and so it was prudent to retain the accounts in their entirety. Airbnb
stated that it has gathered and documented its analysis in a legitimate interests’
assessment (‘LIA’) document (a copy of which was provided to and considered
by this Inquiry) which captures its assessment of retention from the time of the
incident up until the present day. Airbnb stated that this LIA relates to Cypriot
legal advice and litigation-related matters and has, accordingly, been marked
as legally privileged and confidential. Aironb submitted that, in short, it retains
this data for the valid and important purpose of preserving information that does
/may constitute material evidence in relation to a serious incident, in
circumstances where this retention is necessary to preserve the information and
where the balancing of competing rights clearly favours Airbnb and all those
connected with the platform and this incident, including the broader community,
for the reasons already outlined in its previous response and in the legitimate
interests assessment document provided. Airbnb submitted that in terms of the
data retained by it going forward, it is prepared to delete certain of the
Complainant's personal data save for data relating to the incident in question,
which it says it will retain until the expiration of the.relevant statutory limitation
17
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
periods (unless there is satisfactory evidence that the underlying issues relating
to the parties involved have been conclusively resolved in a manner that allows
Airbnb to delete the data) and the conclusion of this inquiry and any related legal
processes. Airbnb stated that, in addition, certain limited residual data will
continue to be retained for the security and legal compliance purposes already
outlined.
ision h ntré
57. The DPC provided Airbnb with a copy of its preliminary Draft Decision and invited
submissions by 27 July 2023.
68 By email dated 27 July 2023, Airbnb stated that it noted the DPC’s findings in
the Preliminary Draft Decision and that it had no substantive submissions to
make on it at that juncture.
ificati reliminary Draft Decision to th
2. The DPC provided the Complainant with a copy of its Preliminary Draft Decision
via the Cypriot DPA, on 28 July 2023, and invited any submissions by 25 August
2023.
@. The Cypriot DPA communicated to the DPC, on 09 August 2023, that the
Complainant had responded that he agreed with the Preliminary Draft Decision
and did not have anything else to add or comment.
Relevant and Reasoned Objections from “supervisory authorities concerned”
61. Having transmitted the Draft Decision, on 16 August 2023, to the “supervisory
authorities concerned” in accordance with Article 60(3) of the GDPR, the DPC
did not receive any relevant and reasoned objections under Article 60(4) of the
GDPR.
€2 Given that no relevant and reasoned objections were received from any of
the supervisory authorities, within a period of four weeks, after having
been consulted, the DPC did not revise the Draft Decision.
18
An Coimisiin um
Chosaint Sonrai
Data Protection
Commission
Applicable Law
63 For the purposes of its examination and assessment of this complaint, the DPC
has considered the following Articles of the GDPR:
Article 5
Article 6
Article 12
Article 17
is and Findi F Ingui
Issue A — Whether Aii lawful is for the retention of the
Complainant’s personal data in circumstances wher is exercis: i
right to erasure
64 The Complainant contends that Airbnb retained his personal data unlawfully
after he had requested that Airbnb delete his personal data and after he had
withdrawn consent for processing his personal data.
©. The Complainant submitted, by correspondence dated 27 November 2019, that,
“irrespective of any personal court proceedings pending against any person who
also maintains an account with Airbnb’, it has no right to retain his personal
information. The Complainant submitted that the incident which occurred did not
concern a guest who had booked through the Complainant's Airbnb account or
with whom he has any relationship whatsoever. He submitted that in September
2018 a visitor booked an apartment which was privately owned by a third party.
The Complainant stated that the apartment in question is located in an
apartment complex and that certain apartments within the complex are managed
by him, but not the apartment which the visitor concerned booked in this
instance. The Complainant submitted that “there is a cases against me which is
under police investigation, accusing and personally prosecuting me:of a case
that is registered for trial in an official district court...[...]...for which | was the
victim...”.
€. The Complainant submitted, by correspondence dated 3 April 2020, that “the
assault case is in court... [...]... this case has been registered in court and we
have been offered by the guest to withdraw the charges for mutual benefit and
resolution of any disputes out of court’. The Complainant submitted that “the
guest filed a complaint against me for assault, but we also lodged a
19
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
complaint...”. The Complainant submitted that “Airbnb were never asked to
provide the relevant information...”. The Complainant further submitted that “we
filed a civil action against him for several thousands of [euro], in relation to false
allegations (which were proven in court), defamation caused and assault” and
that “[Airbnb] also have the obligation to be informed on the case, both by the
District Court and by [his] lawyers, which they have not done so far’.
67. Airbnb, by correspondence dated 5 June 2019, submitted:-
“First, given that [the Complainant], as an Airbnb host, has allegedly
perpetuated a serious assault on an Airbnb guest, any data relating to his
account may comprise evidence in a criminal matter and potential civil litigation.
In this context, the retention is based upon Article 6(1)(c), ‘processing which is
necessary for compliance with a legal obligation to which the controller is
subject’ ... [...]...Further, even leaving aside our obligation to not destroy
evidence, such retention is in the legitimate interests of Airbnb, the guest who
was assaulted, the police and the public at large, based upon Article 6(1)(f)
GDPR... [...]... Finally, such retention is necessary for the ‘purposes of
providing or obtaining legal advice or for the purposes of, or in connection with,
legal claims, prospective legal proceedings’ or ‘is otherwise necessary for the
purposes of establishing, exercising or defending legal rights’[...]
If it is the case that the injured party is not going to take legal action and the
statute of limitations in the relevant jurisdiction has expired we will then be in a
position to delete the account in accordance with our legal obligations.”
68 Airbnb, by correspondence dated 11 November 2022, submitted:-
“_..the complainant's accounts are being retained on foot of Cypriot legal advice
following a serious incident at an Airbnb listing that was / is the subject matter
of a police investigation and legal proceedings. On 19 May 2021, we requested,
through the DPC, that the complainant produce evidence that would assist
Airbnb in determining whether the underlying legal issues warranted ongoing
retention of these accounts. However, the complainant has refused to engage
with these attempts to resolve the complaint.
In the absence of engagement by the complainant and in light of the Notice, we
have reengaged with Cypriot legal counsel to review our legal position based
on the information that is available to Airbnb. Following receipt of further advice
and given the elapse of time since the incident in question, Airbnb has assessed
that it can carry out targeted deletion of personal data relating to the
complainant, subject to the DPC’s agreement with this course of action. In this
regard, Airbnb is in the process of reviewing the complainant's personal data to
identify the information that can be deleted in the circumstances.
Notwithstanding the proposed deletion of such data, Airbnb will continue to 55
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
retain material connected with or relevant to the incident in question, both for
the purpose of this statutory inquiry and any related legal processes, as well as
in relation to any current or prospective legal claims, including to defend claims
against Airbnb. We have been advised by Cypriot counsel to retain such
information until the end of the Cypriot statutory limitation period, which will
elapse six years from the date of the incident in question that is on 22 November
2024. If, however, we received satisfactory evidence that the underlying legal
issues have been conclusively resolved, we will review this with Cypriot counsel
with a view to deleting the retained information based on that evidence, subject
to retaining such information as is necessary until the end of this statutory
inquiry and any related legal processes. In addition, Airbnb will continue to
retain certain residual data for safety, security and legal compliance purposes.”
Airbnb submitted:-
“Airbnb also retains this personal data on the basis of the legitimate interests of
those involved in or otherwise connected with the underlying police investigation
and legal proceedings, including the wider public interest in preserving the.
integrity of police investigations and judicial processes, and the legitimate
interests of Airbnb, its users, partners and those otherwise associated with the
platform in keeping the Airbnb platform safe, in accordance with Article 6(1)(f) of
the GDPR.”
The DPC notes Airbnb’s submission that it was put on notice of the existence of
police investigations and legal proceedings but it has not received any formal
requests for information in relation to the relevant incident.
The DPC notes Airbnb’s submissions that it would like to clarify its previous
statements to the DPC that it had received a copy of a police report, when in fact
the guest had informed Airbnb that he had reported the incident to the police and
that in light of advice from Cypriot legal counsel, it asked the Complainant to
produce evidence that would assist it in determining whether the underlying legal
issues warranted ongoing retention of these accounts. However, the
Complainant has refused to engage with these attempts. 5
The DPC notes Airbnb’s submission that it has not received any formal requests
from police/law enforcement for information or to retain information relating to’
the alleged assault. The DPC also notes Airbnb’s submission that it has not
received any formal requests from legal representatives of the guest for
information or to retain information relating to the alleged assault for the
purposes of civil proceedings. The DPC further notes Airbnb’s submission that
it had, however, been advised by legal counsel to retain the Complainant's
21
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
accounts and that it was continuing to retain this personal data on the basis of
sections 41(b) and (c) and sections 60(3)(a)(ii) and (iv) of the Data Protection
Act 2018, and the legal obligations and legitimate interests it already outlined.
The Law
73. Article 6(1)(f) of the GDPR states that processing shall be lawful only if and to
the extent that “processing is necessary for the purposes of the legitimate
interests pursued by the controller or by a third party except where such interests
are overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data, in particular where the data
subject is a child’.
Analysis
' 74 The DPC notes Airbnb’s submission that it retained each of the Complainant's
accounts, a number of which were created following the incident, in their entirety.
7%. The DPC notes Airbnb’s submission that the personal data retained comprises
various account information provided by the Complainant or generated by his
use of the Airbnb platform, for example: account information including profile
details, preferences and contact information; listing and reservation data;
reviews data; identity verification information, in particular a copy of the
Complainant's Cypriot identity card; financial information such as bank account
and credit card details used for transactions on the platform, and tax information
relating to applicable tax requirements; communications on and relating to the
Airbnb platform for example messages with other users and emails to Airbnb;
and technical logs relating to activities on the platform, for example accounts
login records, IP addresses, device details, etc.
7%. The DPC notes that Airbnb claimed that it retained the Complainant's personal
data on the basis of the legitimate interests of those involved in or otherwise
connected with the underlying police investigation and legal proceedings,
including the wider public interest in preserving the integrity of police
investigations and judicial processes, and the legitimate interests of Airbnb, its
users, partners and those otherwise associated with the platform in keeping the
Airbnb platform safe, in accordance with Article 6(1)(f) of the GDPR.
77. Foracontroller to rely on Article 6(1)(f) GDPR, three conditions must be met: (i)
the controller or a third party must have a legitimate interest (legitimate interest);
(ii) processing is necessary for the purposes of the legitimate interest
(necessary); (iii) such interests are not overridden by the interests or
fundamental rights and freedoms of the data subject which require protection of
22
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
personal data (balance of interests).
7 First condition: Legitimate Interests. In its LIA, Airbnb listed its legitimate
interests as:
e the interests of those involved in or otherwise connected with the
underlying police investigation and legal proceedings relating to the
incident, including the wider public interest in preserving the integrity of
police investigations and judicial processes;
e the interests of Airbnb in exercising its right to protect itself from any
liability flowing from the destruction of important evidence and otherwise
to defend itself from claims related to the incident itself; and
e the interests of Airbnb, its users, partners and those associated with the
platform in keeping the Airbnb platform safe.
7 The DPC agrees that Airbnb fulfils the first condition regarding the existence
of legitimate interests.
&. Second condition: Necessity. In its LIA, Airbnb stated the following with regard
to this condition:
e Airbnb has been advised by Cypriot legal counsel that retention of the
Complainant's accounts in their entirety, until the end of the relevant
Cypriot statutory limitation period (6 years), is necessary and
proportionate. Airbnb is not in a position to determine which data
should be retained. In light of Cypriot law advice, any aspects of the
Complainant's accounts could constitute evidence for the purpose of
these proceedings and this is not currently determinable by Airbnb
without further information. Airbnb therefore retains the Complainant's
accounts in order to preserve the integrity of any legal proceedings,
which includes Airbnb’s right to protect itself from any liability flowing
from the destruction of important evidence and to defend itself from
any claims relating to the incident.... Certain account information is
being retained for broader security purposes, including preventative
measures such as identifying suspended users such as the
complainant resurfacing on the platform, and security-enhancement
processes such as security product and procedure improvement, and
is limited to material necessary for these specific purposes.
81. The DPC agrees that Airbnb fulfils the second condition with regard to necessity.
& Third condition: balance of interests. In its LIA, Airbnb stated the following
with regard to this condition:
23
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
The Complainant’s accounts are being retained following a serious
Incident at an Airbnb listing that resulted in a police investigation and
legal proceedings. Airbnb has an existing relationship with the
Complainant and has informed him that it is retaining his accounts and
why such retention is necessary. The retention of the Complainant's
suspended accounts in this manner means that the Complainant's
personal data is not generally being actively processed; rather, his
account and personal data are being retained pending the completion of
associated legal processes. As such, this serves as a mitigating measure
with respect to the impact of the processing on the Complainant, save
for the prevention of the Complainant re-joining the Airbnb platform
which is addressed in and prohibited by the Terms. Moreover, with a
view to reassessing its retention in light of any developments around
these legal processes, Airbnb has sought to engage with the
Complainant. However, these attempts have been unsuccessful due to
the failure of the Complainant to respond.
Similarly, the retention of certain limited data for security reasons serves
to help Airbnb to protect its platform and those connected with it,
including to identify and restrict the Complainant's attempts to create
further accounts on the platform (instances of which Airbnb had identified
in the aftermath of the incident).
In the circumstances, the rights of the parties to those proceedings and
those otherwise associated with those proceedings (including Airbnb’s
right to avoid liability for the premature destruction of evidence), the
wider public interest in preserving the integrity of police investigations
and judicial processes and Airbnb’s need to act prudently in such
circumstances collectively outweigh the Complainant's right to delete
these accounts under Article 17 GDPR.
In addition, Airbnb has also assessed its retention of the Complainant’s
_ accounts in light of a potential objection under Article 21(1) GDPR. In
this regard, Airbnb has determined that, for the reasons outlined above:
(i) there are compelling legitimate grounds for the processing which
override the interests, rights and freedoms of the Complainant; and (ii)
the retention is necessary for the establishment, exercise or defence of
legal claims, including Airbnb’s right to protect itself from ‘any liability
flowing from the destruction of important evidence and to defend itself
from any claims relating to the incident.
In conclusion, Airbnb has carried out a balancing test and concluded that
the identified legitimate interests specified above are not overridden by
the Complainant's interests or fundamental rights and freedoms in
circumstances where a number of important issues and prerogatives,
24
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
including issues of platform safety and broader societal importance,
override his right to erase personal data from the Airbnb platform under
Article 17 GDPR.
8&8 With regard to the third condition, balance of interests, the DPC is satisfied that
Airbnb’s legitimate interests in retaining the Complainant's data until the
expiration of the Cypriot statutory limitation period are not overridden by the
Complainant's interests or fundamental rights and freedoms. The DPC notes:
and accepts Airbnb’s position that a number of important issues and
prerogatives, including issues of platform safety and broader societal
importance, override the Complainant's right to erase personal data from the
Airbnb platform under Article 17 of the GDPR. The DPC is of the view that Airbnb
has demonstrated compliance with Article 6(1)(f) of the GDPR for this
processing and retention of the entirety of the Complainant's personal data on
all of his accounts.
&. On the basis of the foregoing, the DPC is satisfied that Airbnb validly relied on
Article 6(1)(f) of the GDPR as the lawful basis for the retention of the
Complainant's personal data.
— Whether Airbn! i mplied wi i : re
rsuan' icle 17
&. The DPC notes the Complainant's contention that Airbnb failed to properly give
effect to his erasure request, which he submitted to it on 18 December 2018.
The Complainant informed Airbnb that he wished to withdraw his consent for the
“storing, using and sharing” of any information relating to him. The Complainant
informed Airbnb that he would like any information relating to him or his
properties, “including ID information, contact information, personal details,
company information, address or locations, IP addresses, photographs etc., to
be permanently removed from any of the databases related to [Airbnb’s] service,
or third parties or partners of [Airbnb]’.
&. The DPC notes that, during the course of the Inquiry, Airbnb stated that the
Complainant had been suspended from Airbnb as a result of an incident that
occurred on 20 November 2018 at an Airbnb listing. Airbnb stated that it
responded to the Complainant's erasure request of 18 December 2018 on the
same date requesting that he verify his identity for the purpose of authenticating
his deletion request. Airbnb stated that, once authenticated on 28 December
2018, it informed the Complainant that his personal data would be deleted
unless it was permitted or required to retain data.
25
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
Airbnb submitted to the DPC that ultimately Airbnb retained the Complainant's
accounts on foot of legal advice following an incident that occurred on 20
November 2018 which Airbnb stated “was/is the subject matter of a police
investigation and legal proceedings”. Airbnb submitted that it had been advised
by Cypriot legal counsel to retain the Complainant's suspended Airbnb accounts
in light of the incident in question and resulting civil and criminal legal
proceedings.
Airbnb submitted that it has:-
“not deleted any personal data in the complainant's accounts based on the
advice of Cypriot legal counsel that all accounts should be retained in their
entirety, for reasons that include the potential need to preserve a broader set of
evidence that may be used in civil and criminal legal proceedings. However, as
stated earlier in this letter, Airbnb is currently in the process of reviewing the
complainant's personal data to identify information that can now be deleted in
the circumstances. Airbnb will, however, continue to retain any information that
it considers to be relevant to the incident in question or necessary in the context
of Airbnb’s engagement with this statutory inquiry and any related legal
processes. Airbnb will also retain certain residual personal data for safety,
security and legal compliance reasons, for example limited account information
which we retain for security reasons associated with identifying connections
between Airbnb accounts, activity logs that are used to enhance our security
processes, and information that we are required to retain to comply with laws,
such as under record-keeping and anti-money laundering obligations.”
Airbnb stated that it will continue to retain material connected with or relevant to
the incident in question, both for the purpose of the statutory inquiry and any
related legal processes, as well as in relation to any current or prospective legal
claims, including to defend claims against Airbnb and it stated that it was advised
by Cypriot counsel to retain such information until the end of the Cypriot statutory
limitation period, which will elapse six years from the date of the relevant
incident, that is on 22 November 2024.
Airbnb submitted that many of the facts described by it, including the existence
of civil and criminal legal proceedings, were acknowledged by the Complainant
in his communications with Airbnb and in information and materials provided to
the DPC by the Complainant.
Airbnb submitted that if, however, it receives satisfactory evidence that the
underlying legal issues have been conclusively resolved, it will review the matter
with Cypriot counsel, with a view to deleting the retained information based on
26
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
that evidence, subject to retaining such information as is necessary until the end
of this statutory inquiry and any related legal processes.
@ The DPC notes Airbnb’s submission that it has retained each of the
Complainant's accounts, a number of which were created following the incident,
in their entirety.
98 The DPC notes that Airbnb did not delete any personal data in the Complainant's
accounts based on the advice of Cypriot legal counsel that all accounts should
be retained in their entirety, it says, for reasons that include the potential need to
preserve a broader set of evidence that may be used in civil and criminal legal
proceedings. The DPC notes Airbnb’s submission that in the circumstances, the
rights of the parties to those proceedings and those otherwise associated with
those proceedings (including Airbnb’s right to avoid liability for the premature
destruction of evidence), the wider public interest in processing the integrity of
police investigations and judicial processes and Airbnb’s need to act prudently
in such circumstances collectively outweigh the Complainant's right to erasure
of those accounts under Article 17 of the GDPR.
9% The DPC notes Airbnb’s submission:-
“We have retained the complainant's accounts on the basis of sections 41(b)
and (c) and sections 60(3)(a)(ii) and (iv) of the Data Protection Act 2018, relating
respectively to the investigation of criminal offences and the contemplation or
existence of legal proceedings (with sections 41(c)) and 60(3)(a)(iv) to be read
in conjunction with Article 17(3)(e) of the GDPR).
Where we are required to retain information for legal compliance purposes, for
example transactional information required for compliance with record-keeping
obligations, we rely on Article 17(3)(b) of the GDPR.
Airbnb also retains this personal data on the basis of the legitimate interests of
those involved in or otherwise connected with the underlying police investigation
and legal proceedings, including the wider public interest in preserving the
integrity of police investigations and judicial processes, and the legitimate
interests of Airbnb, its users, partners and those otherwise associated with the
platform in keeping the Airbnb platform safe, in accordance with Article 6(1)(f) of
the GDPR.” : -
The Law
%. Article 17(1) of the GDPR states:-
“The data subject shall have the right to obtain from the controller the erasure of.
27
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
personal data concerning him or her without undue delay and the controller shall
have the obligation to erase personal data without undue delay where one of the
following grounds applies:
(a) the personal data are no longer necessary in relation to the purposes for
which they were collected or otherwise processed;
(b) the data subject withdraws consent on which the processing is based
according to point (a) of Article 6(1), or point (a) of Article 9(2), and where
there is no other legal ground for the processing;
(c) the data subject objects to the processing pursuant to Article 21(1) and there
are no overriding legitimate grounds for the processing, or the data subject
objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data have to be erased for compliance with a legal obligation in
Union or Member State law to which the controller is subject;
() the personal data have been collected in relation to the offer of information
society services referred to in Article 8(1).”
%. Article 17(3)(e) of the GDPR states “Paragraphs 1 and 2 shall not apply to the
extent that processing is necessary... [...]...for the establishment, exercise or
defence of legal claims’.
Analysis
97. The DPC notes Airbnb’s claim that it retained the Complainant's accounts on the
basis of sections 60(3)(a)(ii) and (iv) of the Data Protection Act 2018, relating
respectively to the investigation of criminal offences and the contemplation or
existence of legal proceedings with sections 41(c) and 60(3)(a)(iv) to be read in
conjunction with Article 17(3)(e) of the GDPR.
%. The DPC also notes that Airbnb has claimed that Article 17(1) of the GDPR does
not apply to the extent that Airbnb’s processing of the Complainant's personal
data is necessary for the establishment, exercise or defence of legal claims. With
regard to Article 17(3)(e) of the GDPR, the DPC is of the view that Airbnb has
demonstrated that Article 17(1) does not apply to the extent that processing was
necessary in this case for the establishment, exercise or defence of legal claims.
In light of the serious nature of the alleged incident that occurred involving the
Complainant and another individual who, at the time of the incident was a guest
at an Airbnb listing, the DPC is of the view that Airbnb has sufficiently
demonstrated that it was necessary and proportionate to process the entirety of
28
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
the Complainant's personal data on his accounts for the establishment, exercise’
or defence of legal claims. Therefore, the DPC is of the opinion that Airbnb validly
relied on Article 17(3)(e) of the GDPR for not giving effect to the Complainant's
erasure request.
9. Inthe circumstances, therefore, the DPC finds that Airbnb validly relied on Article
17(3)(e) and that it did not infringe Article 17(1) of the GDPR, when it restricted
the Complainant's right of erasure of his personal data held on his Airbnb
accounts.
where it has rated the Complainant’s personal data following the processing
of his erasure request
100. The DPC notes, having regard to the data minimisation principle, Airbnb’s
submission that Airbnb had been advised by Cypriot legal counsel to retain the
Complainant's deactivated accounts in their entirety, for reasons that include the
potential need to preserve a broader set of evidence that may be used in civil
and criminal legal proceedings and Airbnb’s submission that in light of this, it’
believes the retention of the Complainant's accounts was adequate, relevant
and necessary for the underlying processing purposes. The DPC notes in
particular that in December 2018 Airbnb stated it was not in a position to decide
what data points were or were not relevant for potential legal proceedings
relating to the relevant incident and that it is prepared to delete certain of the
Complainant's personal data save for data relating to the relevant incident, which
it will retain until the expiration of the relevant statutory limitation period. The
DPC also notes Airbnb’s submission that it is in the process of reviewing the
Complainant's personal data to identify the information that can bedeleted.
The Law
101. Article 5(1)(c) of the GDPR states “personal data shall be adequate, relevant
and limited to what is necessary in relation to the purposes for which they
processed (“data minimisation’)’.
Analysis
102 In the particular circumstances of this Complainant's case, and given the serious
nature of the alleged incident that occurred involving the Complainant and
another individual who, at the time of the incident was a guest at an Airbnb
listing, the DPC is of the view that Airbnb’s retention of the Complainant's
personal data was adequate, relevant and limited to what was necessary in
29
An Coimisitén um
Chosaint Sonrai
Data Protection
Commission
relation to the purposes for which it retained the Complainant's personal data.
In circumstances where legal proceedings have not yet concluded in relation to
the incident concerned, the DPC considers that efforts to minimise the level of
personal data retained without the prior agreement of all parties to the
proceedings could prejudice the outcome of those proceedings.
103 In the circumstances of this particular case, therefore, the DPC finds that
Airbnb’s' retention of the Complainant's personal data in its entirety across a
number of his accounts did not infringe the principle of data minimisation that is
set out in Article 5(1)(c) of the GDPR.
Issue D — Whether Airbnb complied with principles of transparency and
’ provision of information in respect to the Complainant’s erasure request and_in
circumstances where it has retained the Complainant's personal data following
the processing of his erasure request
104. The DPC notes Airbnb’s submission:-
“The complainant submitted a number of deletion requests across a number of
accounts, but his first deletion request was made on 18 December 2018 (please
see document entitled ‘Attachment 1 - December 2018 deletion request’
attached to the cover email accompanying this letter).”
106. In addition Airbnb stated:-
“Airbnb responded to the complainant on 18 December 2018, requesting that he
verify his identity for the purpose of authenticating his deletion request. Once
authenticated on 28 December 2018, we informed the Complainant that his
personal data would be deleted unless we were permitted or required to retain
data (please see document entitled ‘Attachment 1 - 18 December 2018 deletion
request’ attached to the cover email accompanying this letter).”
106. The DPC notes that Airbnb received the Complainant’s erasure request on 18
December 2018. Airbnb responded to the Complainant on 18 December 2018
requesting that the Complainant re-send his erasure request and attach a
photocopy of his proof of identity. Airbnb received a copy of the Complainant's
ID and erasure request/s by email'on 18 December 2018. The Complainant
sought an ‘update from Airbnb on 20 December 2018 and 21 December 2018.
Airbnb responded to the Complainant by email on 28 December 2018 stating
that it understood that he would like it to close his account and/or delete all his
account information pursuant to his rights under the GDPR.
30
107.
108.
109.
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
Airbnb’s correspondence to the Complainant of 28 December 2018 stated:-
“As you have provided us with sufficient documentation to prove your identity,
we’ve started to carry out your deletion request. Airbnb will delete your personal
data, except to the extent GDPR permits or requires us to retain that data. For
example, we retain data that is necessary for complying with laws to which we
are subject, for exercising the right of freedom of expression and information
(such as the content of reviews), and for the establishment, exercise or defence
of legal claims (such as information relating to user disputes).
Processing your request will take some time, but as a first step, we have
deactivated your account...[...]...Unless we inform you that we require more
time, it will take up to one month from the date of your initial request for us to
finish processing your deletion request...”
The DPC also notes Airbnb’s submissions that “ultimately Airbnb retained the
complainant's accounts” and that the “complainant's accounts have not been
deleted” for the reasons outlined in its responses to the DPC.
The DPC notes that the Complainant did not receive any further nctice or
information from Airbnb to inform him of the reasons for not taking action on
his erasure request and on the possibility of lodging a complaint with a
supervisory authority and seeking a judicial remedy.
The Law
110.
111.
Article 12(4) of the GDPR states that “[i]f the controller does not take action on
the request of the data subject, the controller shall inform the data subject
without undue delay and at the latest within one month of receipt of the reasons
for not taking action and on the possibility of lodging a complaint with a
supervisory authority and seeking a judicial remedy’.
Recital 59 GDPR offers further clarity with regard to the controller's obligations:
“The controller should be obliged to respond to requests from the data subject
without undue delay and at the latest within one month and to give reasons
where the controller does not intend to comply with any suchrequests.”
Analysis
112
The Complainant submitted his erasure request to Airbnb on 18 December
2018. However, the DPC notes that Airbnb ultimately did not give effect to the
Complainant's erasure request and the Complainant did not receive any further
31
13.
114.
» 16
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
update or notice in that respect from Airbnb. The Complainant found out for the
first time that Airbnb had not erased his personal data on 14 February, 2019
when he attempted to create another Airbnb account. This attempt prompted
Airbnb to send him a message to the effect that his phone number which had
been verified was deactivated “...so we’re emailing you to ensure you have up-
to-date contact information on your Airbnb account. To update and verify your
information, please log in to Airbnb and edit your phone number here.”
Therefore, prior to that date, and further to its communication with him on 28
December, 2018 Airbnb had not made contact with the Complainant to update
him to the effect that it did not intend to take action on his erasure request by
deleting his accounts and to set out the reasons for that decision. It is important
to note that Airbnb’s previous communication to the Complainant on 28
December, 2018 stated, among other things, that “... Unless we inform you that
we require more time, it will take up to one month from the date of your initial
request for us to finish processing your deletion request...” Given that the
Complainant did not receive any further communication from Airbnb in relation
to his erasure request between 28 December, 2018 and 14 February, 2019 it
was reasonable to conclude that Airbnb had fully processed his erasure request
of 18 December, 2018 by that stage and that all his personal data had been
erased.
In that regard, therefore, Airbnb failed to inform the Complainant without undue
delay and, at the latest, within one month of receipt of the request, of the reasons
for not taking action on his erasure request and on the possibility of lodging a
complaint with a supervisory authority and seeking a judicial remedy, as is
required by Article 12(4).
The DPC finds that Airbnb infringed Article 12(4) of the GDPR with respect
to its handling of the Complainant’s erasure request by failing to inform him
without delay and at the latest within one month of receipt of the request
of the reasons for not taking action on it and on the possibility of lodging
a complaint with a supervisory authority and seeking a judicial remedy.
ision on infringem f the GDPR
Following the investigation of the complaint against Airbnb Ireland UC, the DPC
is of the opinion that, in the circumstances of this Complainant’s case, Airbnb
Ireland UC:
e infringed Article 12(4) of the GDPR with respect to its handling of the
Complainant's erasure request by failing to inform him without delay and
An Coimisién um
Chosaint Sonrai
Data Protection
Commission
at the latest within one month of receipt of the request of the reasons for
not taking action on it and on the possibility of lodging a complaint with a
supervisory authority and seeking a judicial remedy.
Exercise ‘ive P. he DP.
116.
117.
In deciding on the corrective powers that are to be exercised in respect of the
infringement of the GDPR outlined above, | have had due regard to the
Commission’s power to impose administrative fines pursuant to Section 141 of
the 2018 Act. In particular, | have considered the criteria set out in Article
83(2)(a) — (k) of the GDPR. When imposing corrective powers, | am obliged to
select the measures that are effective, proportionate and dissuasive in response
to the particular infringements. The assessment of what is effective,
proportionate and dissuasive must be made in the context of the objective
pursued by the corrective measures, for example re-establishing compliance
with the GDPR or punishing unlawful behaviour (or both)’. | find that an
administrative fine would not be necessary, proportionate or dissuasive in the
particular circumstances in relation to the infringement of one Article of the
GDPR as set out above. Furthermore, | have had regard to the fact that the
infringement of Article 12(4) regarding the handling of the Complainant's erasure
request in this case does not appear to have arisen from a systemic set of issues
but was particular in the circumstances of this case. For the reasons outlined, |
find that no administrative fine should be imposed in respect of this infringement. ,
In light of the extent of the infringement identified above, the DPC hereby
issues a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of
the GDPR.
jicial rei lies with t to the Decisi f th:
418 In accordance with Article 78 of the GDPR, each natural or legal person has the
right to an effective judicial remedy against a legally binding decision of a
supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an
appeal to the Irish Circuit Court or the Irish High Court may be taken by a data
subject or any other person (this includes a data controller) affected by a legally
binding decision of the DPC within 28 days of receipt of notification of such
decision. An appeal may also be taken by a data controller within 28 days of
notification; under Section 150(1) against the issuing of an enforcement notice
1 See the Article 29 Data Protection Working Party ‘Guidelines on the application and setting of
administrative fines for the purposes of Regulation 2016/679, at page 11.
33
An CoimisiGn um
Chosaint Sonrai
Data Protection
Commission
and/or information notice by the DPC against the data controller; and under
Section 142, against any imposition upon it of an administrative fine by the DPC.
Signed: te Vebpae
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
34