Airbnb Ireland UC – Complaint Upheld (Ireland, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Airbnb Ireland UC mishandled a customer's requests to access and delete their personal data. The Irish Data Protection Commission found that Airbnb had no valid reason to ask for a photo ID to delete data. This case stresses the need for companies to handle data requests properly and without unnecessary hurdles.
What happened
Airbnb Ireland UC improperly handled a customer's data access and erasure requests.
Who was affected
An Airbnb customer who requested access to and deletion of their personal data.
What the authority found
The Irish DPC upheld the complaint, noting Airbnb had no lawful basis to request a photo ID for the erasure request.
Why this matters
This decision highlights the importance of companies having clear, lawful procedures for handling data requests. It warns businesses against imposing unnecessary identity verification steps that could hinder users' rights.
GDPR Articles Cited
This case concerns two requests from an Airbnb customer (the data subject) to Airbnb Ireland UC (the controller); an access request under Article 15 GDPR and an erasure request under Article 17 GDPR. Regarding the erasure request specifically, when the complainant submitted the request on 17 August 2019, they were asked to verify their identity by providing a copy of their photographic ID. After the complainant refused to provide a copy of their ID, the controller offered them the alternative option of logging into their account to verify their identity. Once the complainant had logged in to confirm their identity, Airbnb advised them that it had initiated their request and, on 24 October 2019, confirmed that the relevant data had been deleted. The complainant raised a number of issues regarding the handling of their requests by Airbnb. Firstly, there was no lawful basis for requesting a copy of the complainant’s ID for the right to erasure request. Secondly, the complainant alleged that Airbnb failed to properly respond to the erasure request. Thirdly, the controller failed to respond to the access request. The complaint was originally filed with the Berlin DPA, who referred the case to the Irish DPA under article 56 GDPR, and in accordance with the procedure outlined in Article 60 GDPR. Responding to the first issue (lawfulness of ID request), Airbnb initially noted that merely a “request” to provide ID cannot be considered “processing” within the meaning of Article 4(2) GDPR, as “receipt of or access to” the relevant personal data is required. Furthermore, Airbnb stated that its identity verification procedures are in place to protect the Airbnb platform and its users, in doing so they stressed the risk of fraudulent activity, and stated there is evidence that bad actors use GDPR requests to do harm, deceiving the platform and its users. As such, photo ID verification is a reliable form of proof of identity and a secure authentication method to combat these risk
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (2)
Other enforcement actions involving Airbnb Ireland UC in IE
Complaint Upheld
Details
About this data
Cite as: Cookie Fines. Airbnb Ireland UC - Ireland (2022). Retrieved from cookiefines.eu
Last updated: