An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
**DPC Complaint Ref:** [REDACTED]
**DPC Ref:** [REDACTED]
**Berlin DPA Ref:** [REDACTED]
**Date:** 21 June 2023
**Complainant:** [REDACTED]
**Data Controller:** Airbnb Ireland UC
**RE:** [REDACTED] v Airbnb Ireland UC
This document is a decision of the Data Protection Commission of Ireland (“DPC”) in relation to DPC complaint reference, [REDACTED] (“Complaint”), submitted by [REDACTED] (“Complainant”), against Airbnb Ireland UC (“Airbnb”), to the Berlin Commissioner for Data Protection and Freedom of Information (“Berlin DPA”) in its capacity as the concerned supervisory authority and thereafter referred to the DPC in its capacity as lead supervisory authority.
This decision is made pursuant to the powers conferred on the DPC by section 113(2)(a) of the Data Protection Act 2018 (“the Act”) and Article 60 of the General Data Protection Regulation (“GDPR”).
### **Communication of Draft Decision to “Supervisory Authorities Concerned”**
In accordance with Article 60(3) of the GDPR, the DPC is obliged to communicate the relevant information and submit a draft decision, in relation to a complaint regarding cross border processing, to the supervisory authorities concerned for their opinion and to take due account of their views.
In accordance with its obligation, the DPC transmitted a draft decision in relation to the matter to the “supervisory authorities concerned”. As Airbnb offers services across the EU, and therefore the processing is likely to substantially affect data subjects in every EU member state, the DPC in its role as lead supervisory authority identified that each supervisory authority is a supervisory authority concerned as defined in Article 4(22) of the GDPR. On this basis, the draft decision of the DPC in relation to this complaint was transmitted to each supervisory authority in the EU and EEA for their opinion.
1
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
## Complaint Handling by the DPC – Timeline and Summary
1. The complaint was initially submitted to the Berlin DPA and was thereafter transferred to the DPC, on 16 November 2020, via the IMI to be handled by the DPC in its role as lead supervisory authority. The Complainant, a registered Airbnb member and host, stated that Airbnb requested that she verify her identity by providing a copy of her official identification documentation (“ID”), which she had not previously provided to Airbnb. She stated “1. For two years now, I have been offering a private room in the 3-room flat I live in via Airbnb. Airbnb knows my name, my address (that is where the rented room is located). I had almost 100 bookings so far. My guest ratings are 4.9 out of 5 points. Airbnb has awarded me the category superhost. There have never been any complaints or doubts about my person or identity. 2. In 2019, Airbnb suddenly asked for a recent photo of me. This is without any reason. Without this photo, I should not be able to offer any more bookings. I complained to the customer service. I have attached the reply from Airbnb below. 3. It is not necessary for Airbnb to have a recent photo of me. There is no understandable reason why I should be forced to do so and a further cooperation – after two years – should depend on it. Apparently, none of the 100 guests have complained that my profile does not include a complete photo of me. 4. I recently wanted to place a second property for rent with Airbnb. Airbnb only allows me to unlock the object if I upload a current photo and a current ID card. 5. This above requirement is not necessary. I also have the second object running under my same account at Airbnb [KE]. Both flats are linked to each other and you can see that it is the same property owner – me. Therefore, there is no doubt about my person as the property owner… […]…Airbnb says that they would now request this proof from ALL hosts without exception”. As set out above, the Complainant stated that she had been renting a room in her property on Airbnb for two years at the time that Airbnb first requested her to provide a copy of her ID and supplemental photo in order to verify her identity; Airbnb initially requested her to verify her identity on 27 November 2019. The Complainant contended that providing a copy of her ID was not necessary and that Airbnb failed to provide any reason and/or lawful basis in respect of processing her ID for identity verification. She stated that in order to comply with Airbnb’s request she uploaded a copy of her expired ID through Airbnb’s secure online portal. This expired ID was rejected by Airbnb as being an insufficient/inadequate copy of ID for the purpose of its identification verification process. She stated that she subsequently uploaded a copy of her ID to Airbnb but that she had obscured the ID photo and had redacted the signature and date of birth on the ID. Airbnb also rejected that copy of her ID as it considered the obscured and redacted copy of her ID as insufficient/inadequate for the purpose
2
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
of its identification verification process. The Complainant contended that alternative identification verification measures/options would have been effective and less intrusive for the purposes of identification verification. She stated that when she wanted to list a second rental property on Airbnb in July 2020 that Airbnb prevented her from doing so until she provided an up-to-date copy of her un-redacted ID and a photograph for processing via its secure online portal, as part of its identity verification process; the Complainant verified her identity using a copy of her ID and photograph, as had been requested by Airbnb, on 20 August 2020. The Complainant stated that Airbnb informed her that it applies this method of identity verification to all hosts without exception. The Complainant stated she was dissatisfied with Airbnb’s response for a number of reasons including that information on Airbnb’s website refers to it being, she submits, “*possible to refrain from uploading an ID card if identification is already possible by other means*”, that “*it is not reasonable to require a current identity card for renting a private flat*” and that “*the collection of ID card copies by Airbnb is not secure, as there is a risk of abuse, e.g. by hackers*”. The Complainant submitted that she discovered from Airbnb’s response to her data access request/s that Airbnb had stored, and continued to store her personal data, including the copies of her ID which it had previously informed her were insufficient/inadequate for the purpose of identity verification. Further, the Complainant submitted that as part of Airbnb’s response to her data access request/s it provided her with a copy of her ID and her photograph, which she stated Airbnb continues to store.
2. The DPC notified Airbnb of receipt of the complaint, by email and letter dated 5 January 2021. The DPC also provided Airbnb with a copy of the complaint and the Complainant’s further submission, dated 11 November 2020.
3. Airbnb reverted to the DPC by email dated 20 January 2021. Airbnb stated that it hoped to amicably resolve the Complainant’s complaint with its response. Airbnb stated that it was important to mention that on 20 August 2020 the Complainant successfully verified her identity for the purpose of the two listings she rents out on Airbnb. Airbnb stated that, as part of her registration, the Complainant agreed to its Terms of Service and was made aware of its Privacy Policy. Airbnb included in its email web links to the “*ID and verification Help Centre page*” which it stated explains Airbnb’s identity verification policy in detail, and the security measures in place to protect the relevant data collected. Further, Airbnb stated that the safety and security of its users is of paramount importance to Airbnb. Airbnb stated that it asks users to verify their identity to enable it to confirm that they are who they say they are. It stated that it believes that its verification procedures are a necessary and proportionate means of
3
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
achieving the purpose of protecting the Airbnb community, in compliance with its obligations under the GDPR. Airbnb stated that as part of its ongoing efforts to enhance its safety and security measures and protect the Airbnb community, Airbnb was expanding its identity verification requirements globally.
4. The DPC reverted to the Complainant and notified her of the progress of her complaint, setting out the contents of Airbnb's email dated 20 January 2021. The Complainant reverted to the Berlin DPA by letter dated 14 June 2021 stating that she was not satisfied with Airbnb's response and that her complaint had not been addressed or resolved.
5. In summary, therefore, the DPC was unable to arrange or facilitate within a reasonable time an amicable resolution of the complaint through the mechanism of its complaint handling process.
### Conduct of Inquiry
6. Acting in its capacity as lead supervisory authority, the DPC issued a Notice of Commencement of Inquiry, including a request for information, to Airbnb on 4 March 2022.
7. The DPC notified Airbnb that the Inquiry would seek to examine and assess whether Airbnb had complied with its obligations as a data controller under the GDPR and the Act in respect of the relevant processing operations which are the subject matter of the complaint.
8. The DPC notified Airbnb that the scope of the Inquiry concerned an examination and assessment of the following:
a) Whether Airbnb had a lawful basis for processing a copy/copies of the Complainant's ID and/or photograph/s in order to verify her identity, in particular in circumstances where she, as a registered member/host with Airbnb, had not previously provided her ID to Airbnb.
b) Whether Airbnb complied with the principle of data minimisation when requesting a copy of the Complainant's ID and/or photograph/s in order to verify her account and when processing data relating to same.
c) Whether Airbnb complied with the Conditions for Consent by making the Complainant's continued use of/access to her account and the service
4
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
conditional on the Complainant submitting her ID and/or photograph/s in order to verify her identity and the processing of this personal data.
d) Whether Airbnb complied with principles of transparency and provision of information where the Complainant’s personal data was collected.
9. The DPC notified the Complainant, by email and letter sent to the Berlin DPA on 4 March 2022, that an Inquiry had commenced in relation to her complaint. The DPC gave the Complainant an opportunity to withdraw any information previously provided during the course of the complaint handling process and afforded the Complainant the opportunity to submit any new information regarding the complaint. The DPC did not receive a response from the Complainant to its correspondence dated 4 March 2022.
10. On 1 April 2022, Airbnb provided the DPC with its response to the questions posed in the DPC’s Notice of Commencement. Airbnb did not indicate that it wished to withdraw any information previously provided during the course of complaint handling. However, Airbnb stated that responses to questions 1(a), (b), (d), (e) and (h) and question 3(a) disclose confidential and commercially sensitive information about Airbnb’s internal security processes, with the effect that the dissemination of this information could compromise or undermine these processes. Airbnb stated that it would therefore welcome the opportunity to review and comment on any proposed sharing of the material in its letter and initial response to the underlying complaint, including any proposed sharing with concerned supervisory authorities.
11. With respect to the legal basis relied upon by Airbnb for requesting and processing a copy of the Complainant’s ID and/or her photograph in 2019 to verify her identity, Airbnb stated that it relied on the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform, in accordance with Article 6(1)(f) of the GDPR. Airbnb advised that the evidential value of an ID is not dependant or predicated on there being a pre-existing ID on the user’s account. Airbnb stated that when it requests a copy of an ID document for verification purposes, the information on that ID document is then compared against the information on that user’s account. Airbnb advised that this comparative analysis is carried out with reference to information such as the user’s profile picture, name, date of birth, address and any other relevant information that can be cross-referenced against the information on the ID document. Airbnb stated that the authenticity of government-issued ID documentation can be assessed with reference to the design and layout of the
5
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
ID document when compared with the typical ID produced by the issuing authority. Airbnb advised that this offers an additional layer of trust and security in the identity verification process. Airbnb also advised that the practice of requesting a supplementary image of the individual is an extra measure aimed at ensuring that the individual submitting the ID document is the person depicted in it.
12. In respect of the DPC’s query as to why Airbnb considers it necessary and proportionate to request a copy of members’ / hosts’ ID and a copy of members’ / hosts’ supplemental photograph/s to verify their identity, Airbnb stated that the Airbnb platform is built on the concept of trust and safety, with real world interaction between its users being a fundamental feature of the Airbnb service. Airbnb stated that this marked difference, relative to many other online services where real world harm may not be a likely risk, requires it to take steps to ensure that Airbnb hosts and guests can engage and interact with one another in a safe and secure manner. Airbnb advised that it also needs to address the risk of fraudulent activity by bad actors, who often use sophisticated methods to attempt to deceive and defraud Airbnb and its users. Airbnb stated that it believes that the myriad of risks associated with identifying users on a platform such as Airbnb justifies the exercises of diligence, due care and caution when verifying users’ identifies. Airbnb advised, that in the first instance, it will attempt to verify a user’s identity without requesting a copy of an ID document. Airbnb advised that this involves using the existing account information or requesting supplemental information, such as the user’s legal name and address, and verifying this information against reliable external databases. Airbnb advised that, where verification through these methods cannot be achieved, Airbnb will then ask the user to verify their identity by way of an ID document. Airbnb advised that, in the Complainant’s case, it initially attempted to verify the Complainant’s identity without requesting an ID document, on the basis of comparing the existing information on the Complainant’s account against reliable external databases. Airbnb submitted that when this step was unsuccessful, Airbnb offered the Complainant the option to provide an ID, or alternatively to submit her legal name and address in order to verify her details against these databases. Airbnb submitted that the Complainant opted to submit her legal name and address for verification, however, Airbnb were ultimately unsuccessful in verifying the Complainant’s identity in this manner, resulting in the need to request the submission of a copy of the Complainant’s ID document and supplementary image through a secure portal. Airbnb stated that providing a copy of an ID document is a reliable form of proof of identity that does not impose a disproportionate burden on the individual. Airbnb submitted that its approach is similar to the approach taken by numerous other businesses, such as airlines and international hotels, who request ID because it is a reasonable and
6
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
straightforward identification method, and who do so independently of any comparison with a previously-held copy ID on file. Airbnb contended that verification using an ID document is an evidential bridge between online and offline identity and is a reliable method of establishing that the individual behind the online presence is indeed the individual that they claim to be. Airbnb submitted that the supplemental image of the individual is an additional safeguard that can be used to assist with the verification of identity. Airbnb advised, that in terms of probative value of ID documentation, government-issued ID documentation is less likely to be illegitimately obtained or accurately reproduced by counterfeit means when compared with information such as login credentials, which are more susceptible to access/exposure risks and third-party manipulation and misuse, for example misappropriation online. Airbnb stated that the possession of a valid ID document that can be attributed to the Airbnb account holder in question is not only a solid basis on which to conclude that the end-user is who they say they are, but also strengthens trust on the platform. Airbnb stated that, for example, bad actors are generally reluctant to provide information about their identity and background as they seek to carry out illegitimate activities, with the result that the provision of an ID document helps to foster trust between Airbnb and its users and indeed between users themselves. Airbnb stated that given that it is necessary for Airbnb to design, implement and maintain robust safety and security measures, in compliance with its responsibilities towards its users and society more generally, it believes that its identity verification processes are a necessary and proportionate means of achieving the purpose of protecting the Airbnb community and indeed the broader community, in compliance with its obligations under the GDPR.
13. With respect to the legal basis Airbnb relied on for implementing identity verification requirements requiring copies of member's / host's ID to verify identity, it submitted that in implementing these requirements it relied on the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform, in accordance with Article 6(1)(f) of the GDPR.
14. In response to the DPC's query as to whether Airbnb provides a member/host with other methods by which to verify their identity, Airbnb advised that it generally seeks to verify a user's identity without requesting a copy of an ID document, for example by verifying account information against reliable external databases. Airbnb advised that in cases where this is not successful, Airbnb may ask the user to submit additional information, such as their legal name and address. Airbnb stated that these methods of verification were deployed in the Complainant's case but were unsuccessful in verifying her identity.
7
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
15. With regard to the DPC's query regarding any data minimisation efforts made by Airbnb, Airbnb stated that it will initially attempt to verify a user's identity without requesting a copy of an ID document and/or a supplementary image. Airbnb submitted that where ID and a supplementary image are required, Airbnb processes this information in accordance with the safety and security purposes outlined in its Terms of Service and Privacy Policy and the resources referred to within. Airbnb submitted that aside from compliance with specific legal obligations, for example anti-money laundering legislation, the relevant purposes for requesting a copy of a user's ID can be described as (1) verifying the identities of Airbnb users for safety and security purposes and (2) using this information for related safety and security purposes, for example investigating incidents on the Airbnb platform that may be linked with IDs previously provided to Airbnb. Airbnb stated that when IDs and supplemental images are uploaded to the Airbnb platform, it uses end-to-end encryption measures for the relevant transfer and storage processes, and that it restricts access to these documents to specific authorised personnel for the specific safety and security purposes described above.
16. In response to the DPC's query as to the date the Complainant registered as a member/host and in response to the DPC's request for copies of the Terms of Service and the Privacy Policy that were in place at the time she registered as a member/host, Airbnb submitted that the Complainant registered the account in question on 23 September 2017. Airbnb submitted copies of the Terms of Service and Privacy Policy which were in place when the Complainant joined the Airbnb platform on 23 September 2017. Airbnb submitted that links to these documents were made available to the Complainant at the beginning of the sign-up flow to create an Airbnb account. Airbnb submitted that section 2.4 of the Terms of Service and sections 1.1, 1.3 and 2.2 of the Privacy Policy inform individuals about Airbnb's identity verification processes.
17. In respect of the dates the Complainant first listed the properties on Airbnb, Airbnb submitted that the Complainant listed her first property on 11 March 2018 and her second property was listed on 20 August 2020.
18. In respect of any retention of identity verification data following the verification process, Airbnb stated that it typically retains ID documents and supplemental images for the duration of the user's account, for the purposes already outlined in accordance with the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform. Airbnb stated that in certain circumstances, ID documents may be retained following the deletion
8
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
of an Airbnb account, for example to comply with Airbnb's and its affiliate's legal obligations, such as under anti-money laundering legislation, in accordance with Article 6(1)(c) of the GDPR, or where necessary in relation to legal claims, in accordance with Article 17(3)(e) of the GDPR. Airbnb submitted that it believes that its identity verification processes are a necessary and proportionate means of achieving the purpose of protecting the Airbnb community and indeed the broader community, in compliance with its obligations under the GDPR.
19. With regard to any further processing of personal data by Airbnb, where the identity verification data is retained following the verification process, Airbnb stated that the further safety and security purposes already outlined are carried out in pursuit of the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform, in accordance with Article 6(1)(f) of the GDPR. Airbnb stated that in certain circumstances ID documents may also be processed to comply with anti-money laundering legislation or other legal obligations to which Airbnb and its affiliates are subject, in accordance with Article 6(1)(c) of the GDPR, or where an ID or supplementary image, the subject of a deletion request, is necessary in relation to legal claims, in accordance with Article 17(3)(e) of the GDPR.
20. In respect of the Complainant's consent to any processing of personal data relating to the identity verification process, Airbnb stated that the identity verification processes, the subject matter of this inquiry, were not carried out on the basis of consent under Article 6(1)(a) of the GDPR, but rather, as stated above, on the basis of legitimate interests under Article 6(1)(f) of the GPDR.
21. With respect to the reasonable doubts, if any, Airbnb had concerning the Complainant's identity such that Airbnb considered it necessary to request a copy of the Complainant's ID, Airbnb stated that it understood this question to be referring to Article 12(6) of the GDPR. Airbnb stated that Article 12(6) of the GPDR is inapplicable in the current case as the request for ID was made to verify the Complainant's identity as part of its efforts to safeguard the Airbnb platform and those connected with it and that it was not made in the context of Articles 15 to 21 of the GDPR. Airbnb stated that the reasonable doubts criterion only applies in the data subject rights context, which rights are not the subject matter of the inquiry or the underlying complaint. Airbnb stated that notwithstanding this, as part of its ongoing efforts to safeguard the Airbnb platform and those connected with it, Airbnb seeks to carry out and enhance verification on accounts, where appropriate. Airbnb stated that an attempt was made to verify
9
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
the Complainant’s identity without requesting an ID document and supplementary image, however, Airbnb submitted that, as those verification steps were unsuccessful, it was necessary to request and process a copy of the Complainant’s ID document through a secure portal.
22. In response to the DPC’s query regarding when and how Airbnb first notified the Complainant of Airbnb’s Terms of Service, Identification Verification Policy and Privacy Policy, Airbnb referred to its earlier submissions in relation to the Terms of Service and Privacy Policy in place when the Complainant registered the account in question on 23 September 2017. Airbnb also submitted to the DPC the Terms of Service and Privacy Policy which were in place when the Complainant was requested to verify her identity on 27 November 2019 (and which also applied in July 2020), together with a copy of the email notification sent to the Complainant regarding the updated Terms of Policy. Airbnb submitted that section 2.4 of the Terms of Service and sections 2.1.1, 2.1.3, 2.1.5, and 3.2 of the Privacy Policy inform individuals about Airbnb’s ID verification processes. Airbnb also submitted to the DPC a copy of the relevant Help Centre articles regarding Airbnb’s ID verification processes, which were in place at the relevant times in 2017, 2019 and 2020. Airbnb submitted that these resources are made available to users through hyperlinks in the Privacy Policy, as well as directly through the Help Centre.
23. The DPC issued further correspondence to Airbnb, including additional queries, on 09 August 2022.
24. On 16 August 2022, Airbnb provided the DPC with its response. Airbnb submitted that on 27 November 2019 a message was sent to the Complainant asking that she verify her identity and it provided the DPC with a copy of this correspondence. Airbnb submitted that on 04 December 2019, the Complainant was sent a follow-up request and it provided the DPC with a copy of this correspondence. Airbnb submitted that on 08 December 2019, the Complainant attempted to upload a copy of her ID, however the copy she uploaded was rejected because several important elements of the ID, including the Complainant’s photo, were obscured, and because her ID had expired. Airbnb stated that the Complainant received notification of this and a request for another upload; it provided the DPC with a copy of the correspondence. Airbnb submitted that on 16 December, 2019 it reminded the Complainant about the outstanding verification requirement. Airbnb stated that the Complainant did not attempt to upload her ID again until July 2020. Airbnb stated that on 15 July 2020, the Complainant was asked to verify her identity as part of the registration of a second Airbnb listing; Airbnb stated that “given that this was an in-product process that surfaced to the complainant through the Airbnb platform interface”,
10
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
it does not have copies of the requests but it did provide template screenshots of the process. Airbnb submitted that on 15 July, 2020 the Complainant attempted to upload her ID twice and that again these uploads were rejected because elements of the ID were obscured and the ID had expired. Airbnb stated that the Complainant emailed Airbnb regarding its identity verification practices, and was informed that ID verification was required. Airbnb submitted that the Complainant ultimately successfully uploaded her ID on 20 August 2020 and it provided a screenshot of the ID upload logs.
25. The DPC issued further queries to Airbnb on 16 September 2022.
26. On 23 September 2022, Airbnb provided the DPC with its response. Airbnb submitted that it initially attempted to verify the Complainant’s identity without requesting an ID document, on the basis of comparing the existing information on the Complainant’s account against reliable external databases and it stated that when this step was unsuccessful, Airbnb offered the Complainant the option to submit her legal name and address for verification purposes or alternatively to provide a copy of her ID for verification purposes. Airbnb stated that the Complainant opted to submit her legal name and address, however, it was unsuccessful in verifying the Complainant’s identity using these details, which resulted in it ultimately requesting a copy of her ID. Airbnb submitted that the initial verification check based on the existing account information was carried out by Airbnb without any engagement with the Complainant and it stated that when these verification attempts failed, the Complainant received an email dated 27 November 2019 asking her to complete verification steps. The verification link in its email brought the Complainant to the in-product account verification process which Airbnb illustrated by providing a screenshot. It stated that the Complainant provided her legal name and address, but that attempts to verify her identity using the details failed. It provided a screenshot of its internal log of the failed verification attempt.
27. On 16 January, 2023 the DPC issued further queries to Airbnb.
28. Airbnb responded on 25 January, 2023. Regarding the purpose for retaining a copy of ID documents and/or photographs that the Complainant submitted on foot of request made to her by Airbnb between 27 November, 2019 and prior to 20 August, 2020 Airbnb submitted that after identity verification it retains this data for safety and security purposes. These safety and security purposes include safety enhancement purposes, for example comparative reviews between authentic ID documents and fraudulent ID documents and documenting emerging trends in this space, improving its methods for comparing IDs against
11
An Coirmisiún um Chosaint Sonraí
Data Protection Commission
the supplemental images provided by users and identifying technical issues associated with the upload of images that have been altered by the user.
29. Regarding details of the number and description of the Complainant's ID documents and/or photographs that were not deemed acceptable by Airbnb during that period, Airbnb submitted that it understood this to be a request for clarity on the precise number of attempted uploads of this data by the Complainant, and the nature of the material provided. Airbnb stated that on 8 December 2019 the Complainant attempted to upload a copy of her passport but this was not accepted because several elements of the ID, including the photo of the Complainant, were obscured. Airbnb stated that the ID had expired, rendering it invalid. Airbnb stated that on 15 July 2020, the Complainant made two further attempts to upload her passport but once again these uploads were rejected because of similar obscurity issues and the fact that the ID was invalid due to expiration.
#### **Notification of the Preliminary Draft Decision to the Data Controller**
30. The DPC provided Airbnb with a copy of the preliminary draft decision and invited submissions by 25 April, 2023.
31. In its subsequent submissions received on 25 April, 2023 Airbnb noted the DPC's preliminary findings and corrective order and submitted that it does not propose to make additional submissions at this time. Airbnb stated that if the corrective order is finalised in the manner proposed in this draft of the decision, it intends to take the necessary steps to comply with it and provide the DPC with details of this compliance.
32. The DPC has carefully considered the submissions of Airbnb in making this decision.
#### **Notification of the Preliminary Draft Decision to the Complainant**
33. The DPC provided the Complainant with a copy of the preliminary draft decision via the Berlin DPA on 11 April, 2023 and invited submissions by 16 May, 2023.
34. The Berlin DPA notified the DPC on 17 May, 2023 that the Complainant had made no submissions concerning the preliminary draft decision.
12
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
# **Relevant and Reasoned Objections from “supervisory authorities concerned”**
35. Having transmitted the draft decision on 19 May 2023 to the “supervisory authorities concerned” in accordance with Article 60(3) of the GDPR, the DPC did not receive any relevant and reasoned objections under Article 60(4) of the GDPR.
36. Given that no relevant and reasoned objections were received by any of the supervisory authorities within a period of four weeks, after having been consulted on 19 May 2023, the DPC did not revise the draft decision.
# **Applicable Law**
37. For the purposes of its examination and assessment of this complaint, the DPC has considered the following Articles of the GDPR:
- Article 5
- Article 6
- Article 7
- Article 12
- Article 13
# **Findings of Inquiry**
# **Issue A: Whether Airbnb had a lawful basis for requesting copy/copies of the Complainant’s ID and/or photograph/s in order to verify her identity, in particular in circumstances where she, as a registered member/host with Airbnb, had not previously provided her ID and/or photographs to Airbnb**
38. The Complainant asserted that Airbnb wrongfully processed copies of her ID and/or photograph in order to verify her identity and without a legal basis to do so.
39. The Complainant created her Airbnb account on 23 September 2017 and has been a registered user, being a member and host, on the Airbnb platform since then. The Complainant has been listing and renting property to customers on the Airbnb platform since March 2018. The Complainant submitted that Airbnb
13
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
wrongfully requested a copy of her ID on 27 November 2019. The Complainant provided Airbnb with a copy of an expired ID and thereafter provided Airbnb with a redacted copy of her ID, however on both occasions these copies of ID were considered inadequate proofs of identity by Airbnb. The Complainant submitted that when she wanted to list a second rental property on Airbnb, in July 2020, that Airbnb wrongfully prevented her from doing so until she provided an up-to-date and unobscured copy of her ID and photograph in order to confirm her identity; she stated that Airbnb informed her that it applies this identity verification to all hosts without exception. On 15 July 2020, Airbnb requested the Complainant to verify her identity as part of the registration of a second Airbnb listing and the Complainant made two attempts to upload an expired ID and an obscured ID on the 15 July 2020 but these were again rejected by Airbnb. The Complainant contacted Airbnb regarding its identity verification practices, and Airbnb informed her that ID verification was required. On 20 July 2020, the Complainant provided Airbnb with a copy of her ID, in the manner requested. At that point, the Complainant was deemed to have successfully verified her identity. The Complainant submitted that the provision of a copy of her identity was not necessary, that Airbnb failed to provide any reason and/or lawful basis for the processing of copies of her ID and photographs, and she contended that alternative identification methods, in particular a less intrusive option/measure, not requiring the provision of copy of her ID, would be effective, and would, and should, suffice for verifying her identity.
40. During the course of the Inquiry, Airbnb stated that it relied on the legitimate interests of Airbnb, its users, its commercial partners and third parties, in accordance with Article 6(1)(f) of the GDPR as the legal basis for requesting a copy of the Complainant's ID in order to verify her identity. Airbnb asserted that its verification procedures are a necessary and proportionate means of achieving the purpose of protecting the Airbnb community, in compliance with its obligations under the GDPR.
41. During the DPC's handling of the complaint, Airbnb stated that the safety and security of its users is of paramount importance to Airbnb and that Airbnb asks its users to verify their identity to enable it to confirm that they are who they say they are. Airbnb stated that as part of its ongoing efforts to enhance its safety and security measures and protect the Airbnb community, Airbnb is expanding its identity verification requirements globally and that the Complainant's country of residence is one of many jurisdictions where this expansion program has been implemented and consequently the Complainant was required to provide a copy of her ID in order to verify her identity.
42. Airbnb stated that prior to successfully completing the required verification steps, the Complainant provided inadequate proof of identity, including a copy of an
14
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
expired ID and a redacted and obscured copy of her ID and photograph/s. Airbnb referenced a section of the “ID and verification Help Centre page” entitled “How does it work when Airbnb verifies your identity?”, which the Complainant was directed to in its communications with her. This document states that Airbnb require a copy of a valid ID document with the relevant information on the document unobscured. Airbnb stated that the section entitled “How do I submit my government ID?” advises users to submit photos that clearly show the individual in question. Airbnb stated that these requirements are all aimed at ensuring that the verification process is sufficiently robust, in the interests of the Airbnb community as a whole.
# Existence of a lawful basis
43. Article 4(2) of the GDPR defines processing as "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".
44. Article 6(1)(f) of the GDPR states "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child".
45. The DPC considers that Airbnb's request for a copy of the complainant's ID as part of an identity verification process, for the purpose of achieving its legitimate interests, and which made the complainant's use of and access to the Airbnb platform subject to the provision of her ID constituted the collection of personal data and processing as per the definition set out in Article 4(2) of the GDPR.
46. The DPC notes that Airbnb has claimed legitimate interests pursued by the controller as the lawful basis for requesting a copy of ID in order to verify a user's identity to confirm they are who they say they are in order to protect the safety and security of the users of the Airbnb platform, in accordance with Article 6(1)(f) of the GDPR. Noting that the platform that Airbnb operates brings hosts and members who are unknown to each other into a situation where they may actually meet in person at the host's premises, or elsewhere, the DPC agrees that a legitimate interest exists in Airbnb ensuring it has adequate safety and security measures in place to protect users of the platform. The service operated by Airbnb is, therefore, significantly different to purely online service such as a
15
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
social media platform. Given that Airbnb members stay at the premises of a host "in the real world", the DPC recognises the importance of verifying the identity of hosts to ensure that they are who they say they are. Given that Airbnb stated that other means of validating this host's identity failed, the DPC finds that it was necessary to process the photo ID in pursuit of the legitimate interest. Finally, it finds that in a balancing test the rights of the host are not prejudiced by this verification process.
47. In those circumstances, therefore, the DPC finds that Airbnb validly relied on Article 6(1)(f) as the legal basis for processing this Complainant's photographic IDs and/or photographs once other efforts it had deployed to verify her identity without ID were unsuccessful.
Issue B: Whether Airbnb complied with the principle of data minimisation when requesting a copy of the Complainant's ID and/or photograph/s in order to verify her account and when processing personal data relating to same.
48. Article 5(1)(c) of the GDPR states "personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation").
49. The DPC notes, having regard to the data minimisation principle, Airbnb's submission that it initially attempted to verify the Complainant's identity without requesting an ID document, on the basis of comparing the existing information on the Complainant's account against reliable external databases. The DPC notes Airbnb's submission that when this step was unsuccessful, Airbnb offered the Complainant the option to submit her legal name and address for verification purposes or alternatively to provide a copy of her ID for verification purposes. The DPC notes Airbnb's submission that the Complainant opted to submit her legal name and address, however, Airbnb was unsuccessful in verifying the Complainant's identity using these details which resulted in Airbnb ultimately requesting a copy of her ID. The DPC notes Airbnb's submission that the initial verification check based on existing account information was carried out by Airbnb without any engagement with the Complainant and when these verification attempts failed, the Complainant received an email from Airbnb on 27 November, 2019 asking her to complete verification steps. Supporting evidence has been submitted to this Inquiry to demonstrate that Airbnb did make initial attempts to verify the complainant's identity without a copy of photo ID in the first instance. In particular, Airbnb provided a screenshot of its internal log of the failed verification attempt.
16
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
50. In the circumstances of this element of the Complainant's case, therefore, the DPC is satisfied that Airbnb gave adequate consideration to the principle of data minimisation when it sought from the Complainant a copy of her photographic ID only after all other attempts to verify her identity had proven unsuccessful. Once those attempts failed, it became necessary to seek a copy of the Complainant's photographic ID in order to complete the identity verification process.
51. The DPC finds, therefore, that in this particular instance, Airbnb's requirement that the Complainant verify her identity by submitting a copy of her photographic ID and/or photographs did not infringe the principle of data minimisation that is set out in Article 5(1)(c) of the GDPR.
52. The DPC notes that Airbnb typically retains ID documents and supplemental images for the duration of the user's account, for the purposes of verifying the identities of Airbnb users for safety and security purposes. The DPC notes that Airbnb retains this information for related safety and security purposes, for example investigating incidents on the Airbnb platform that may be linked with ID's previously provided to Airbnb, in accordance with the legitimate interests of Airbnb, its users, its commercial partners and third parties who may be impacted by safety and security issues arising from or otherwise connected with the Airbnb platform.
53. Article 5(1)(b) of the GDPR states that "personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes..." Article 5(1)(c) of the GDPR states that "personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation')". Article 5(1)(e) of the GDPR states that "personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed...[...]...('storage limitation')".
54. The DPC has considered whether the data being retained by Airbnb are relevant, adequate and limited to what is necessary (in terms of the data minimisation principle) in relation to the purposes for which they are processed, i.e. identity verification of the Complainant for legitimate interests pursued by Airbnb and whether such data are retained for longer than is necessary for the purposes for which the personal data are requested and processed (storage limitation principle). The DPC does not agree with Airbnb's position that it retain the valid ID documents for the duration of the user's account. Once Airbnb has completed the verification process to its satisfaction, all that was required for its
17
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
records was a note on its file of what ID document was submitted to verify identity. In the case of this Complainant it is sufficient to keep a note on file that records that a copy of a valid passport was submitted on 20 August, 2020 and that Airbnb was satisfied that it fulfilled the identity requirements. The copy submitted should have been safely disposed of by Airbnb at that point once the identity verification process was satisfactorily completed. The DPC is of the view that Airbnb has not demonstrated that the intended retention of this specific record of personal data for the duration of the user's account is relevant, adequate and limited to what was necessary in relation to the purposes for which they were processed. The DPC is of the view that Airbnb is retaining this personal data for longer than was necessary for the purposes for which the data was collected.
55. The DPC finds that by retaining, after the identity verification process was successfully completed and for the duration of the user's account, a copy of the Complainant's identity documentation submitted on 20 August, 2020, Airbnb infringed the principle of data minimisation in Article 5(1)(c) and the principle of storage limitation in Article 5(1)(e). These infringements are ongoing.
56. The matter of the retention of the redacted copy of the Complainant's expired passport which she attempted to upload on 8 December 2019 as well as two redacted copies of the Complainant's passport which she attempted to upload on 15 July, 2020 requires further consideration. The DPC notes that Airbnb continued to process redacted copies of the Complainant's photographic IDs which it had considered insufficient or inadequate for verifying the identity of the Complainant.
57. Airbnb stated that on 8 December 2019 the Complainant attempted to upload a copy of her passport but this was not accepted because several elements of the ID, including the photo of the Complainant, were obscured. Airbnb stated that the ID had expired, rendering it invalid. Airbnb stated that on 15 July 2020, the Complainant made two further attempts to upload her passport but once again these uploads were rejected because of similar obscurity issues and the fact that the ID was invalid due to expiration. In summary, therefore, in addition to the copy of the valid ID which the Complainant uploaded successfully on 20 August, 2020 Airbnb has retained on file a redacted copy of the Complainant's expired passport which she attempted to upload on 8 December 2019 as well as two redacted copies of the Complainant's passport which she attempted to upload on 15 July, 2020.
58. Airbnb also stated that after identity verification Airbnb retains this data for safety and security purposes which include security enhancement purposes, for
18
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
example comparative reviews between authentic ID documents and fraudulent ID documents and documenting emerging trends in this space, improving its methods for comparing IDs against the supplemental images provided by users and identifying technical issues associated with the upload of images that have been altered by the user. Airbnb’s submission was in response to the DPC’s query in respect of the purpose for retaining a copy of ID documents and/or photographs that the Complainant submitted on foot of requests made to her by Airbnb between 27 November 2019 and prior to 20 August 2020, i.e. in respect of the personal data provided by the Complainant which Airbnb itself stated was obscured and invalid, and which it deemed insufficient or inadequate for the legitimate purposes pursued.
59. The DPC is of the view that Airbnb has not demonstrated that the retention of these specific records of personal data was relevant, adequate and limited to what was necessary in relation to the purposes for which they were processed. The DPC is of the view that Airbnb retained this personal data for longer than was necessary for the purposes for which the data was collected, personal data which Airbnb considered to be obscured and invalid. In the circumstances of this particular case, Airbnb received valid ID from the Complainant on 20 August 2020 and it was able to conclude its verification process successfully at that point. On that basis, therefore, the Complainant had then satisfied Airbnb as to her identity and the matter of identity was then closed. The redacted and out-of-date copies of the Complainant’s documents were no longer relevant in this case once she submitted a copy of ID which satisfied Airbnb’s identity requirements. Therefore, there was no valid basis for Airbnb to continue to retain the redacted and expired copies of the passports submitted by the Complainant on 8 December, 2019 and 15 July, 2020 once her identity was verified to Airbnb’s satisfaction on 20 August, 2020. By retaining these documents, it is the view of the DPC that Airbnb infringed the principle of data minimisation in Article 5(1)(c) and the principle of storage limitation in Article 5(1)(e). On the other hand, in the event that the Complainant had not successfully verified her identity to the satisfaction of Airbnb on 20 August, 2020 or at any time since then, Airbnb may have a valid justification for the retention of the redacted and out-of-date copies of the Complainant’s passport while the identity verification process was still ongoing.
60. In the circumstances of this Complainant’s case, therefore, the DPC is not satisfied that Airbnb gave adequate consideration to the principles of data minimisation and storage limitation when it continued to store personal data which it considered ineffective for identity verification, namely the redacted and expired copies of the documents submitted by the Complainant on 8 December 2019 and 15 July 2020.
19
An Coirmisiún um Chosaint Sonraí
Data Protection
Commission
61. The DPC finds, therefore, that Airbnb's continued processing and retention of partially redacted and out-of-date identity documents that it deemed inadequate or insufficient to verify the identity of the Complainant infringed the principle of data minimisation that is set out in Article 5(1)(c) of the GDPR and the principle of storage limitation that is set out in Article 5(1)(e) of the GDPR. These infringements are ongoing.
Issue C: Whether Airbnb complied with the Conditions for Consent by making the Complainant's continued use of/access to her account and the service conditional on the Complainant submitting her ID and/or photograph/s in order to verify her identity and the processing of this personal data.
62. The Complainant submitted that she was forced to provide copies of her ID and forced to consent to the processing of copies of her ID. She submitted that she wanted to post a second listing and Airbnb prohibited her from doing so until she uploaded an up to date and un-redacted copy of her ID. She submitted that without this coercion on the part of Airbnb it would have been impossible for her to publish her second listing.
63. As stated above, Airbnb submitted that the identity verification processes were not carried out on the basis of consent under Article 6(1)(a) of the GDPR, but rather on the basis of legitimate interests under Article 6(1)(f) of the GDPR. The DPC is satisfied, as outlined above, that Airbnb validly relied on Article 6(1)(f) as the legal basis for the data processing.
64. As Article 6 of the GDPR provides that at least one of six grounds is required for the lawful processing of personal data, and where Airbnb has identified that it relied on legitimate interests of the data controller in this instance, there was no requirement for Airbnb to separately rely on or seek the consent of the complainant when requesting her to submit ID documents and/or photographs.
Issue D: Whether Airbnb complied with principles of transparency and provision of information where the Complainant's personal data was collected.
65. Article 13(1)(c) of the GDPR states "where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with the purposes of the
20
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
processing for which the personal data are intended as well as the legal basis for the processing” and Article 13(1)(d) of the GDPR states “where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with, where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party”.
66. Article 5(1)(a) of the GDPR states that personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)”.
67. Airbnb stated that as part of the registration with Airbnb, the Complainant agreed to its Terms of Service and was made aware of its Privacy Policy. Airbnb set out that as stated in sections 16 and 17 of the Terms of Service, Airbnb retains the right to verify its users and the information provided by its users. Airbnb stated that in this regard, section 17 states that Airbnb may “ask you to provide identification or other information” and “undertake checks designed to help verify your identity or background”. Airbnb also stated that Section 2.4 of the Terms of Service (last updated dated 19 June 2017) (“Terms of Service 2017”) and Sections 1.1, 1.3 and 2.2 of the Privacy Policy (last updated dated 19 June 2017) (“Privacy Policy 2017”) inform individuals about Airbnb’s identity verification processes and that links to these documents were made available to the Complainant at the beginning of the sign-up flow to create an Airbnb account. Airbnb stated that Section 2.4 of the Terms of Service for European Users (last updated 1 November 2019) (“Terms of Service 2019”) and Sections 2.1.1, 2.1.3, 2.1.5 and 3.2 of the updated Privacy Policy last updated dated 1 November 2019 (“Privacy Policy 2019”) inform individuals about Airbnb’s identity verification processes and that these were in place when the Complainant was requested to verify her identity on 27 November 2019 and when copies of her ID and photographs were processed in 2019 and 2020.
#### Information available to the Complainant at the time of account registration
68. Section 2.4 of the Terms of Service 2017 states:-
“User verification on the Internet is difficult and we do not assume any responsibility for the confirmation of any Member’s identity. Notwithstanding the above, for transparency and fraud prevention purposes, and as permitted by applicable laws, we may, but have no obligation to (i) ask Members to provide a form of government identification or other information or undertake additional checks designed to help verify the identities or backgrounds of Members, (ii)
21
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
screen Members against third party databases or other sources and request reports from service providers, and (iii) where we have sufficient information to identify a Member, obtain reports from public records of criminal convictions or sex offender registrations or an equivalent version of background or registered sex offender checks in your local jurisdiction (if available)."
69. Section 2.3 of the Terms of Service 2017 states that "Airbnb may make the access to and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform, subject to certain conditions or requirements, such as completing a verification process".
70. Section 4.2 of the Terms of Service 2017 states that a person "can register an Airbnb Account using an email address and creating a password, or through your account with third-party social networking services".
71. Section 1.1 of Airbnb's Privacy Policy 2017 states that Airbnb "collects information when a person uses the Airbnb Platform including Account information, such as name, email address and date of birth, when a person signs up for an Airbnb account and that it may collect identification, such as a photo of government issued ID and that it collects financial information, such as bank account or credit card information, when user uses Payment Services to process payments."
72. Section 2.2 of Airbnb's Privacy Policy 2017 states that Airbnb "uses, stores and processes information about a person to create and maintain a trusted and safer environment, including to detect and prevent fraud, verify or authenticate information or identifications provided by a person (such as to verify person's Accommodation address or compare a person's identification photo to another photo a person provides), comply with legal obligations and enforce Terms of Service, Payments Terms and other policies."
73. With respect to the above notices available to the Complainant at the time the Complainant created her account, the DPC is of the view that the Complainant was on notice that she may be required to verify her identity, including by providing a copy of photographic ID.
Information available to the Complainant at the time of Airbnb's requests for copies of ID and photographs
74. Section 2.4 of the Terms of Service 2019 states:-
"User verification on the internet is difficult and we do not assume any responsibility for the confirmation of any Member's identity. Notwithstanding the
22
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
above, for transparency and fraud prevention purposes, and as permitted by applicable laws, we may, but have no obligation to (i) ask Members to provide a form of government identification or other information or undertake additional checks designed to help verify the identities or backgrounds of Members, (ii) screen Members against third party databases or other sources and request reports from service providers, and (iii) where we have sufficient information to identify a Member, obtain reports from public records of criminal convictions or sex offender registrations or an equivalent version of background or registered sex offender checks in your local jurisdiction (if available)."
75. Section 2.3 of the Terms of Service 2019 states that "Airbnb may make access to and use of the Airbnb Platform, or certain areas or features of the Airbnb Platform, subject to certain conditions or requirements, such as completing a verification process".
76. Section 4.2 of the Terms of Service 2019 states that a person "can register an Airbnb Account using an email address and creating a password, or through your account, or through your account with certain third-party social networking services".
77. Section 2.1.1 of Airbnb's Privacy Policy 2019 states that "when a person signs up for an Airbnb Account, Airbnb requires certain information such as person's first name, last name, email address and date of birth, and that Airbnb may collect identity verification information, such as images of government issued ID, passport national ID card, or driving licence as permitted by applicable laws, or other authentication information, to help create and maintain a trusted environment."
78. Section 3.2 of Airbnb's Privacy Policy 2019 states that "Airbnb may use, store, and process personal information to create and maintain a trusted and safer environment, such as to detect and prevent fraud, security incidents and other harmful activity; to verify or authenticate information or identifications provided by a person; to verify the accommodation address; to compare the identifications photo to another photo the person provides; to conduct checks against databases and other information sources to the extent permitted by applicable laws and with a person's consent where required". Section 3.2 of Airbnb's Privacy Policy 2019 states that "Airbnb processes this personal information for these purposes given its legitimate interest in protecting the Airbnb Platform, to measure the adequate performance of its contract with the person, and to comply with applicable laws".
79. With respect to the above notices available to the Complainant at the time of Airbnb's requests for copies of ID and photographs, the DPC is of the view that
23
An Coimisiún um
Chosaint Sonraí
Data Protection
Commission
the Complainant was on notice that she may be required to verify her identity including by providing a copy of photographic ID.
80. Having reviewed Airbnb's privacy policies and terms of service that were in place both at the time the Complainant registered her account and separately at the time of Airbnb's requests for copies of ID and photographs, the DPC is satisfied that there was sufficient information within those documents to inform members that Airbnb may seek a copy of photographic ID to verify identity.
81. In that regard, therefore, and in the circumstances of this Complainant's case, the DPC finds that Airbnb complied with the requirements set out in Article 13(1) of the GDPR with regard to the provision of information to the data subject.
### Decision on infringements of the GDPR
82. Following the investigation of the complaint against Airbnb Ireland UC, the DPC is of the opinion that in the circumstances of this Complainant's case, Airbnb Ireland UC infringed the General Data Protection Regulation as follows:
#### Article 5:
By retaining, after the identify verification process was successfully completed, a copy of the Complainant's identity documentation submitted on 20 August, 2020, Airbnb infringed the principle of data minimisation in Article 5(1)(c) and the principle of storage limitation in Article 5(1)(e). These infringements are ongoing.
Airbnb's continued processing and retention of partially redacted and out-of-date identity documents that it deemed inadequate or insufficient to verify the identity of the Complainant infringed the principle of data minimisation that is set out in Article 5(1)(c) and the principle of storage limitation that is set out in Article 5(1)(e). These infringements are ongoing.
### Exercise of Corrective Powers by the DPC
83. In deciding on the corrective powers that are to be exercised in respect of the infringements of the GDPR outlined above, I have had due regard to the Commission's power to impose administrative fines pursuant to Section 141 of the 2018 Act. In particular, I have considered the criteria set out in Article
24
An Coimisiún um Chosaint Sonraí
Data Protection
Commission
83(2)(a) – (k) of the GDPR. When imposing corrective powers, I am obliged to select the measures that are effective, proportionate and dissuasive in response to the particular infringements. The assessment of what is effective, proportionate and dissuasive must be made in the context of the objective pursued by the corrective measures, for example re-establishing compliance with the GDPR or punishing unlawful behaviour (or both)¹. I find that an administrative fine would not be necessary, proportionate or dissuasive in the particular circumstances in relation to the infringements of the Articles of the GDPR as set out above. For the reasons outlined, I find that no administrative fine should be imposed in respect of these infringements.
84. In light of the extent of the infringements identified above, the DPC hereby issues a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the GDPR.
85. In light of the infringements of Article 5(1)(c) and Article 5(1)(e) in the case of this data subject, it is necessary that the data controller bring its data processing operations into compliance with Article 5(1)(c) and Article 5(1)(e) to remedy the infringements identified in this case and to prevent similar infringements occurring with regard to data subjects in the future in similar circumstances. Accordingly, the DPC hereby orders Airbnb to:
1. Delete from all of its systems and records the redacted and out-of-date copies of the Complainant's identity documents that she attempted to upload on 8 December, 2019 and 15 July, 2020; and
2. Delete from all of its systems and records the identity documents that the Complainant uploaded on 20 August, 2020 (keeping only a record that such documentation was submitted and the date of submission); and
3. Subject to compliance with EU and Member State law, revise its internal policies and procedures concerning user identity verification to ensure that (i) once the identity of data subjects has been verified to Airbnb's satisfaction, Airbnb discontinues the practice of retaining improperly redacted and/or out-of-date identity documents that may be submitted by data subjects as part of the identify verification process, and (ii) the period for which valid or fraudulent/illegitimate identification documents (which includes identification documents validly redacted in accordance with laws which require certain redactions) submitted by data subjects as
¹ See the Article 29 Data Protection Working Party 'Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679, at page 11.
25
An Coimisiún um Chosaint Sonraí
Data Protection Commission
part of the identity verification process are stored is limited to a strict minimum (in accordance with Recital 39 of the GDPR).
4. This order is made pursuant to Article 58(2)(d) of the GDPR and Airbnb is requested to provide details of its compliance with 1, 2 and 3 above to the DPC by 20 September 2023.
# **Judicial remedies with respect to the decision of the DPC**
86. In accordance with Article 78 of the GDPR, each natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Pursuant to Section 150(5) of the Act, an appeal to the Irish Circuit Court or the Irish High Court may be taken by a data subject or any other person (this includes a data controller) affected by a legally binding decision of the DPC within 28 days of receipt of notification of such decision. An appeal may also be taken by a data controller within 28 days of notification; under Section 150(1) against the issuing of an enforcement notice and/or information notice by the DPC against the data controller; and under Section 142, against any imposition upon it of an administrative fine by the DPC.
Signed:
Tony Delaney
Deputy Commissioner
On behalf of the Data Protection Commission
26