Inquiry into Airbnb Ireland UC - September 2023
Date of Decision: 14 September 2023
On 14 September 2023, the Data Protection Commission (DPC) adopted a decision in relation to a complaint against Airbnb Ireland UC (Airbnb), which was submitted to the Cypriot DPA, in its capacity as the concerned supervisory authority and thereafter referred to the DPC in its capacity as lead supervisory authority.
The DPC commenced this inquiry on 7 October 2022, on foot of a complaint that Airbnb did not properly comply with its obligations and the complainant’s rights under the GDPR. In particular:
- That Airbnb did not properly comply with his erasure request,
- That Airbnb unlawfully retained his personal data,
- That it did not comply with the data minimisation principle, and
- That Airbnb failed to comply with the principles of transparency and provision of information.
In this case, the data subject had submitted an erasure request to Airbnb. Airbnb responded to the data subject requesting that he verify his identity for the purpose of authenticating his erasure request, and once authenticated it informed the data subject that his personal data would be deleted unless it was permitted or required to retain data.
Airbnb did not further update the data subject in respect of his erasure request and as far as he was concerned his accounts and personal data had been deleted on foot of his erasure request. Airbnb ultimately retained the complainant’s accounts and did not delete any personal data in relation to the accounts on the advice of legal counsel following an alleged serious incident at an Airbnb listing that was the subject of a police investigation and legal proceedings.
The DPC first attempted through complaint handling to facilitate the amicable resolution of the complaint between the parties. However ultimately an inquiry and an Article 60 decision was required to bring the case to a conclusion.
Airbnb stated that it retained the complainant’s data on the basis of the legitimate interests of those involved in or otherwise connected with the underlying police investigation and legal proceedings, including the wider public interest in preserving the integrity of police investigations and judicial processes, and the legitimate interests of Airbnb, its users, partners and those otherwise associated with the platform in keeping the Airbnb platform safe.
In its decision, the DPC:
- Was satisfied that Airbnb validly relied on Article 6(1)(f) as the lawful basis for the retention of the complainant’s personal data;
- Found that Airbnb validly relied on Article 17()(e) and that it did not infringe Article 17(1) when it restricted the complainant’s right of erasure of his personal data;
- Found that Airbnb’s retention of the complainant’s personal data in its entirety across a number of his accounts did not infringe the principle of data minimisation in Article 5(1)(c).
Following the investigation of the complaint against Airbnb Ireland UC, the DPC was of the opinion that, in the circumstances of the complainant’s case, Airbnb Ireland UC:
- Infringed Article 12(4) of the GDPR with respect to its handling of the complainant’s erasure request by failing to inform him without delay and at the latest within one month of receipt of the request of the reasons for not taking action on it and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
Following consultation and agreement from the supervisory authorities concerned, the DPC has now adopted its decision in respect of this complaint in accordance with Article 60(7) of the GDPR. The decision of the DPC also applied the following corrective power:
- The DPC issued a reprimand to Airbnb Ireland UC, pursuant to Article 58(2)(b) of the GDPR.
For more information, you can download the full decision at this link: Inquiry into Airbnb Ireland UC - September 2023 (PDF, 8mb)