Resources

Inquiry into Airbnb Ireland UC - 28 September 2023 (2)

Date of Decision: 28 September 2023

On 28 September 2023, following an inquiry concerning a complaint received against Airbnb Ireland UC (“Airbnb”), the Data Protection Commission (“the DPC”) adopted a decision.

The DPC had commenced this inquiry on 22 September 2022, on foot of a complaint that Airbnb had unlawfully requested a copy of the Complainant’s ID (“ID”) in order to verify their identity in order to complete a booking on the platform. In this particular instance the complainant had previously booked the same listing earlier that year on the Airbnb platform without the need for ID verification. Airbnb rejected the IDs submitted by the Complainant as the images of his ID were unclear. Ultimately however the complainant was successfully able to complete the booking by using another Airbnb account which Airbnb believe he shares with another person.

The scope of the inquiry concerned an examination and assessment of the following:

  1. Whether Airbnb had a lawful basis for requesting copies of the Complainant’s ID and photograph in order to verify his identity.

  2. Whether Airbnb complied with the principle of data minimisation when processing a copy of the Complainant’s ID and photograph in order to verify his account.

  3. Whether Airbnb complied with the Conditions for Consent by making the Complainant’s ability to complete his booking conditional on the Complainant submitting his ID and photograph in order to verify his identity.

  4. Whether Airbnb complied with principles of transparency and provision of information where the Complainant’s personal data was collected.

As the processing under examination constituted “cross border “ processing, the DPC’s decision was subject to the cooperation and consistency mechanism outlined in Article 60 of the GDPR and pursuant to Article 60(3) of the GDPR, the DPC submitted its draft decision to the supervisory authorities concerned for their opinion. As the DPC received no relevant and reasoned objections to the draft decision from the supervisory authorities concerned within the statutory period, the supervisory authorities concerned were deemed to be in agreement with the draft decision of the DPC and are bound by it in accordance with Article 60(6) of the GDPR. The DPC adopted its decision in respect of this complaint in accordance with Article 60(7) of the GDPR.

The decision, which was adopted on Thursday 28 September 2023, records findings of infringement as follows:

  • Article 5(1)(c) and Article 6(1)(f) of the GDPR

The DPC found Airbnb did not validly rely of Article 6(1)(f) of the GDPR as the legal basis for processing the Complainant’s photographic IDs and supplemental image. Furthermore the DPC found that in the particular situation that arose in this Complainant’s case, Airbnb’s requirement that the Complainant verify his identity by submitting an unredacted copy of his photographic ID constituted an infringement of the principle of data minimisation, pursuant to Article 5(1)(c) of the GDPR.

In light of the infringements of Article 5(1)(c) and Article 6(1)(f) the DPC issued a reprimand to Airbnb pursuant to Article 58(2)(b) of the GDPR. In addition, the DPC made the following order against Airbnb pursuant to Article 58(2)(d) to remedy the infringements identified in this case and to prevent similar infringements occurring with regard to data subjects in the future in similar circumstances.

  • revise its internal policies and procedures to ensure that the seeking of photographic ID and supplemental photographs in the verification process for users is used only where necessary, proportionate and in accordance with the GDPR for the purpose for which the personal data is collected and processed, having regard, in particular, to Airbnb’s legal obligations and the issue of whether less privacy intrusive verification methods are available and effective. Details of compliance with this order should be provided to the DPC by Airbnb by Thursday, 21 December 2023.

For more information, you can download the full decision at this link: Airbnb Ireland UC Redacted Decision EN (PDF)