RegSol Blog

Data Protection Commissioner: Airbnb Ireland UC Reprimand

October 2023

On 14th September 2023, the Data Protection Commissioner (DPC) adopted a decision in relation to a complaint against Airbnb Ireland UC. The DPC launched its enquiry on 7th October 2022 following a complaint that Airbnb did not properly comply with its obligations under the GDPR. The Complainant alleged:

  1. Airbnb did not properly comply with his erasure request

  2. Airbnb unlawfully retained his personal data

  3. Airbnb did not comply with the data minimisation principle; and

  4. Airbnb failed to comply with that principles of transparency and provision of information.

Airbnb responded to the data subject’s request to erase his data, requesting verification of his identity, and then confirmed that the personal data would be deleted unless it was permitted or required to retain the data. Airbnb did not further update the data subject in respect of his erasure request. Airbnb retained the data subject’s data on the advice of legal counsel, following an alleged serious incident at an Airbnb listing that was the subject of a police investigation and legal proceedings.

Airbnb stated that it retained the complainant’s data on the basis of legitimate interests of those involved in or connected with the underlying police investigation and legal proceedings. In its decision, the DPC was satisfied that Airbnb validly relied on Article 6(1)(f) as the lawful basis for the retention of the complainant’s data, Airbnb did not infringe on Article 17(1) when it restricted the complainants right of erasure of his personal data and that Airbnb’s retention of the personal data did not infringe the principle of data minimisation in Article 5(1)(c).

However, the DPC did find that Airbnb infringed Article 12(4) with respect to the handling of the complainant’s erasure request by failing to inform him without delay and at the latest within one month of receipt of the request the reasons for not acting on it and the possibility of lodging a complaint with a supervisory authority.

The full decision can be read here.