Can GDPR be used to reset an account?

Question

I have an issue with AirBnb:

My account is something like 7-8 years old and I didn't use it for 6+ year.

I don't have the password anymore so I did a password reset, but it wants me to confirm my phone number from 6 years ago / another country, which I don't have anymore.

The email is still mine, hasn't changed, etc.

Obviously proving ownership would be easy but AirBnb doesn't seem to have real support, they have these free labor / ambassador / community support thing where they don't really have access to anything.

So the short story is that they suggest I create another account.

I was wondering if I could use GDPR to request them to delete all my data since they have my info from when I was a host.

In theory, if they fully comply, I should be able to re-register my account as the system shouldn't know my email anymore.

Is that thinking correct?

Answer 1

The GDPR right to erasure /to be forgotten only applies in comparatively limited circumstances and has many exceptions. They can more or less claim that they will need to keep some of your data for purposes like fraud prevention.

Furthermore, they have a month until they have to execute any GDPR request. Where you want to to exercise your GDPR rights they are required to check your identity. So you might have to verify your phone number just to do the deletion.

In practice, deleting your account and starting a new account should work, but looking at this from a GDPR perspective will not help. This is a customer service problem.