Airbnb Ireland UC

The DPC found that Airbnb did not validly rely on Article 6 of the GDPR as the legal basis for processing the complainant’s ID. Furthermore the DPC found that in the particular situation that arose in this complainant’s case, Airbnb’s requirement that the complainant verify his identity by submitting a copy of his ID in order to make an erasure request constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR. In light of the infringements of Article 5(1)(c) and Article 6, the DPC issued a reprimand to Airbnb pursuant to Article 58(2)(b) of the GDPR. The DPC notes that Airbnb has discontinued the practice of requesting a copy of ID in order to verify identity in order to verify erasure requests. The DPC also notes that following an order made in a previous DPC decision, Airbnb has revised its internal policies and procedures in order to prevent further infringements of Article 5(1)(c), similar to those that occurred in this case, occurring to data subjects in the future. For more information, you can download a copy of the full decision at this link: Inquiry into Airbnb Ireland UC - January 2024 (PDF, 4.9 MB) .

The DPC found Airbnb did not validly rely of Article 6(1)(f) of the GDPR as the legal basis for processing the Complainant’s photographic IDs and supplemental image. Furthermore the DPC found that in the particular situation that arose in this Complainant’s case, Airbnb’s requirement that the Complainant verify his identity by submitting an unredacted copy of his photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR. In light of the infringements of Article 5(1)(c) and Article 6(1)(f) the DPC issued a reprimand to Airbnb pursuant to Article 58(2)(b) of the GDPR. In addition, the DPC made the following order against Airbnb pursuant to Article 58(2)(d) to remedy the infringements identified in this case and to prevent similar infringements occurring with regard to data subjects in the future in similar circumstances: revise its internal policies and procedures to ensure that the seeking of photographic ID and supplemental photographs in the verification process for users is used only where necessary, proportionate and in accordance with the GDPR for the purpose for which the personal data is collected and processed, having regard, in particular, to Airbnb’s legal obligations and the issue of whether less privacy intrusive verification methods are available and effective. Details of compliance with this order should be provided to the DPC by Airbnb by Thursday, 21 December 2023. For more information, you can download a copy of the full decision at this link: Airbnb Ireland UC Final Decision - 28 September 2023 (2) (PDF, 2 MB) .

The DPC found that Airbnb did not validly rely on Article 6(1)(f) of the GDPR as the legal basis for processing the Complainant’s photographic ID and supplemental photographs; that Airbnb’s requirement that the Complainant verify his identity by submitting a complete and unredacted copy of his photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c); that by retaining, after the identity verification process was successfully completed and until 2 February 2021 a copy of the Complainant’s un-redacted ID documents, Airbnb infringed the principle of data minimisation in Article 5(1)(c) and the principle of storage limitation in Article 5(1)(e); by retaining, after the identity verification process was successfully completed and for the duration of the user’s account, a copy of the Complainant’s supplemental images, Airbnb infringed the principle of data minimisation and the principle of storage limitation; and that Airbnb’s processing and retention until 2 February, 2021 of identity documents that it deemed inadequate or insufficient to verify the identity of the Complainant infringed the principle of data minimisation and the principle of storage limitation. In light of the infringements of Article 5(1)(c), Article 5(1)(e) and Article 6(1)(f) the DPC issued a reprimand to Airbnb pursuant to Article 58(2)(b) of the GDPR. In addition, the DPC made the following orders against Airbnb pursuant to Article 58(2)(d) to remedy the infringements identified in this case and to prevent similar infringements occurring with regard to data subjects in the future in similar circumstances.

the DPC has now adopted its decision in respect of this complaint in accordance with Article 60(7) of the GDPR. The decision of the DPC also applied the following corrective power: The DPC issued a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the GDPR. For more information, you can download the full decision at this link: Inquiry into Airbnb Ireland UC - September 2023 (PDF, 8mb)

Resources Guidance Decisions Law Blogs Podcasts Publications Case Studies Inquiry into Airbnb Ireland UC Area: Cross Border Private Company Topic: DS Rights Articles: 5 , 6 , 12 , 15 Decision Date: 20 July 2023 On 20 July 2023, following an inquiry the Data Protection Commission ( DPC ) adopted a decision to exercise corrective powers on Airbnb Ireland UC ( Airbnb ). The DPC commenced this inquiry on 22 December 2022, on foot of a complaint that Airbnb failed to comply with an access request and subsequent erasure request within the statutory timeframe and, further, that when the Complainant submitted their access and erasure requests, Airbnb requested that they verify their identity by providing a photocopy of their identity document ( ID ), which they had not previously provided to Airbnb. The scope of the inquiry concerned an examination and assessment of the following: 1) Whether Airbnb’s provision of the personal data and information concerning the processing of that personal data in response to the Complainant’s access request was compliant with the GDPR and the Data Protection Act 2018. 2) Whether Airbnb’s handling of the Complainant’s access request was compliant with the GDPR and the Act insofar as the information provided to the Complainant was in a concise, transparent, intelligible and easily accessible form using clear and plain language as specified by Article 12(1) of the GDPR. 3) Whether Airbnb’s handling of the Complainant’s erasure request was compliant with the GDPR and the Act.

The DPC found that Airbnb’s retention of a copy of the Complainant’s identity documentation following the successful completion of the identity verification process infringed the principles of data minimisation in Article 5 (1)(c) and the principle of storage limitation in Article 5(1)(e).Furthermore the DPC found that the continued processing and retention of partially redacted and out-of-date identity documents that had been deemed inadequate or insufficient to verify the identity of the Complainant infringed the principle of data minimisation that is set out in Article 5(1)(c) and the principle of storage limitation that is set out in Article 5(1)(e). Following consultation with the supervisory authorities concerned, the DPC adopted its decision in respect of this complaint in accordance with Article 60(7) of the GDPR. In light of the infringements of Article 5(1)(c) and Article 5(1)(e) the DPC issued a reprimand to Airbnb pursuant to Article 58(2)(b) of the GDPR. In addition, the DPC made the following orders against Airbnb pursuant to Article 58(2)(d) to remedy the infringements identified in this case and to prevent similar infringements occurring with regard to data subjects in the future in similar circumstances: Delete from all of its systems and records the redacted and out-of-date copies of the Complainant’s identity documents that the Complainant attempted to upload. Delete from all of its systems and records the identity documents that the Complainant uploaded (keeping only a record that such documentation was submitted as well as the date of submission).

Resources Guidance Decisions Law Blogs Podcasts Publications Case Studies Inquiry into Airbnb Ireland UC Area: Cross Border Private Company Topic: DS Rights Articles: 5 , 6 , 12 Decision Date: 14 September 2022 On 14 September 2022, following an inquiry the Data Protection Commission (the DPC) adopted a decision to exercise corrective powers on Airbnb Ireland UC (Airbnb). The DPC commenced this inquiry on 25 March 2021, on foot of a complaint that Airbnb failed to comply with an erasure request and a subsequent access request the Complainant had submitted to it within the statutory timeframe and further that when the Complainant submitted their request for erasure, Airbnb requested that they verify their identity by providing a photocopy of their identity document (ID) which they had not previously provided to Airbnb. The scope of the inquiry concerned an examination and assessment of the following: Whether Airbnb had a lawful basis for requesting a copy of the Complainant’s I.D. in order to verify their identity in circumstances where they had submitted a request for erasure pursuant to Article 17; Whether Airbnb’s handling of the Complainant’s erasure request was compliant with the GDPR and the Act; and Whether Airbnb’s handling of the Complainant’s access request was compliant with the GDPR and the Act. As the processing under examination constituted “cross border” processing, the DPC’s decision was subject to the cooperation and consistency mechanism outlined in Article 60 of the GDPR and pursuant to Article 60(3) of the GDPR, the DPC submitted its draft decision to the supervisory authorities concerned for their opinion.