4 ms·

Hi, I'm a lawyer (solicitor, England and Wales) and I specialise in privacy and internet law. I'm obliged to say that I don't have all of the facts about this m

Hi, I'm a lawyer (solicitor, England and Wales) and I specialise in privacy and internet law. I'm obliged to say that I don't have all of the facts about this matter, and so what I write is general guidance only. "Only customers of Airbnb Ireland UC / UK Ltd. or Services Limited (‘Airbnb’) are eligible to exercise their data subject rights under the GDPR. [...] GDPR generally does not apply to users of Airbnb Inc." As several other commentators have mentioned, this is wrong. The GDPR has extra-territorial scope, meaning that it applies to a company in any country - even those outside of the EU - if it processes personal data belonging to an EU resident. For reference, see Article 3 GDPR. For further explanation, see Recital 23 GDPR. The fact that your friend may have contracted with the US entity of AirBnB does not (to my knowledge) have any bearing. As an aside, remember that this is for EU residents and not simply citizens - so a French citizen who is resident in Washington D.C. would not be covered, but an American citizen in France would be, if that makes sense. If your friend was my client, I would suggest that they both 1) push back on the request, as well as 2) file a complaint with the Information Commissioners Office here in the UK (or, if Ireland is more relevant to them, the Irish DPC). I hope everything gets sorted out! If you or your friend would like to discuss further, you can find me over on twitter @KelseyFarish

buboard 8y ago
> for EU residents and not simply citizen i think GDPR does not reference residents or citizens, but "data subjects in the union"
- kelsette 8y ago
  Correct. The GDPR does not use the word "resident" or "citizens" but the implication "data subjects in the union" means that it applies to persons who are resident in the EU, even if they're not an EU citizen (like me!) which is just what I hoped to make clear :)

buboard 8y ago

> for EU residents and not simply citizen i think GDPR does not reference residents or citizens, but "data subjects in the union"

kelsette 8y ago
Correct. The GDPR does not use the word "resident" or "citizens" but the implication "data subjects in the union" means that it applies to persons who are resident in the EU, even if they're not an EU citizen (like me!) which is just what I hoped to make clear :)