I just had a bad experience with Airbnb. The circumstances would be too long to describe and not relevant to my question. The fact is that I just have had an email that the host (I am the guest) let me a review and that I can read it after I post mine. I am considering, but reluctant, to make a GDPR access request to access it (before I post mine). This review, whatever it is, seems to clearly be a personal information that Airbnb have on me. Would I have the right to do it? Has something similar already tried? I am EU consumer residing in the UE. If the comment appear to be bad. Could I, under the GDPR, ask for it to be removed?
-
1The review is not your personal information. It's what another Airbnb user has to say about you. How would GDPR give you right over someone else's commentary?– ConsisCommented Aug 4, 2019 at 3:50
-
What makes you think you would still have any ability or right to submit your own review if you forced AirBnB to hand over the other parties review (by whatever means)? You certainly might be able to use a Subject Access Request to gain access to the other parties review, but I think you might not like the repercussions of attempting to circumvent a legitimate process.– user4210Commented Aug 4, 2019 at 6:24
-
1@Consis. gdpr-info.eu/issues/personal-data . I quote "Personal data are any information which are related to an identified or identifiable natural person." Someone else commentary seems to obviously fall into this category.– Olivier EsserCommented Aug 4, 2019 at 9:07
-
@Moo This is my first airbnb experience and it was bad. I agree that I may not like the consequences of doing a subject access request. However exercising a right under a democratically voted law can never be considered as circumventing a legitimate process. Laws have to take this into consideration.– Olivier EsserCommented Aug 4, 2019 at 9:19
-
2@olivier "Established procedure, or the right to ban someone acting badly cannot be used to circumvent a democratic right given by a democratically voted law" got any legal citations for that? Theres nothing in the GDPR which prevents it. You can cling to that belief all you want, but it's going to end in tears if you do.– user4210Commented Aug 4, 2019 at 21:29
|
Show 4 more comments
1 Answer
Personal data is any information relating to an identifiable person. The review relates to you, so you are the data subject and have a right to access. Airbnb is not required to provide this information through their normal procedures (e.g. their website interface), but would have to produce this information in response to a data subject request.
An alternative standpoint is that the review is not information, but just some document. The GDPR cannot be used as a dragnet to get access to all documents that happen to mention you.
Whereas your right to access is pretty absolute, your right to erasure is not. It only applies under comparatively narrow circumstances. You cannot use the GDPR to censor what other people say about you. Even if you delete your entire account, Airbnb might argue that they have an overriding legitimate interest to keep the review on file, in case you try evading bad reviews by starting a new account.
Also note that the GDPR gives the data controller one month to respond to any requests, which can be extended to two months. This might be longer than the time frame Airbnb gives you to write your review.
-
This answer most of my question. There is also a "right to be forgotten". gdpr.eu/right-to-be-forgotten . However the exemptions are so vague that it can be interpreted to mean anything. Do you know if there are precedent about it? Commented Aug 4, 2019 at 17:49
-
@olivier The GDPR right to erasure implements/encodes the right to be forgotten, so that the two are effectively synonymous. Here, Art 17(1)(c) might require erasure when “the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2)”. Art 21(2) doesn't apply because it's about marketing, and as hinted at in my answer there are likely to be overriding legitimate grounds to keep the review.– amonCommented Aug 4, 2019 at 17:57
-
I would be interested to see a precedent about "this right to be forgotten" because any entity that holds information could always said they have a "legitimate" reason. I would be interested to see some cases where an actual judge have granted / refused a "right to be forgotten". Of course it is much broader than a review on airbnb, it could be any article / post, etc that someone made about you somewhere. Commented Aug 4, 2019 at 18:13
-
@olivier The GDPR is still young, so there's no such precedent. You are right that a data controller could always find such legitimate grounds, but if a data subjects thinks the controller did this incorrectly they can lodge a complaint with the data protection authority, or sue directly. There are pre-GDPR cases regarding the right to be forgotten, e.g. those that forced Google to remove certain search results.– amonCommented Aug 4, 2019 at 18:24
-
I am not on a banlist, but many people here seems to think that it is legitimate to keep a banlist at the discretion of some big corporations. In Europe, in most countries, even a criminal record get usually cleared after a few years (except maybe for the most serious crime). That let me think that to be banned for life seems exaggerate and not "legitimate" if you only have violated an agreement without committing serious crime. But apparently there is no precedent. I understand that a temporary ban proportional to what you have done would probably be fine. Commented Aug 6, 2019 at 9:03