AirBnb Ireland UC – Complaint Upheld (Ireland, 2023)

A data subject was asked by AirBnb (the controller) to submit an ID card together with a newly taken photograph for identity verification when booking a property on the platform. The initial redacted copy of his ID was refused and the controller again requested the data subject to provide a copy of his ID together with a newly taken photograph to prove his identity. The controller only allowed the booking when the data subject provided a high resolution copy of his ID with only the access code redacted. Following this, the data subject thought that the amount of personal data required was excessive and that the refusal of a redacted copy of his ID by the controller could potentially lead to an identity theft. Thus, the data subject filed a complaint which ended up at the Berlin DPA. In May 2020, however, the complaint was transferred from the Berlin DPA to the Irish DPC as competent lead supervisory authority under Article 56 GDPR, which initiated the cooperation mechanism according to Article 60 GDPR. The controller explained in its submissions that its verification procedures are to preserve the legitimate interests of safeguarding the AirBnb platform and its users, particularly where the hosts and guests will meet face to face in the rental process. The controller further submitted that when designing its ID verification processes, it gave careful consideration to the correct balance to strike between the privacy rights of its users and their rights as hosts and guests to a safe and secure stay during a reservation. Further, in this case, the host of the property had specifically asked that verified IDs be provided by potential guests and according to its policy, Airbnb is required to facilitate such requests by hosts. The controller also stated that given the risks in allowing a potentially fraudulent or otherwise illegitimate booking to proceed, it believed that its redaction policy was adequate, relevant and necessary for the purpose of verifying user id