Opinion on proposal for a regulation on data collection and sharing relating to short-term accommodation rental services and amending Regulation (EU) 2018/1724

16 December 2022

Opinion 26/2022

on the Proposal for a Regulation on data collection and sharing relating to short-term accommodation rental services and amending Regulation (EU) 2018/1724

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation (EU) 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation (EU) 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on data collection and sharing relating to short-term accommodation rental services and amending Regulation (EU) 2018/1724. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 7 November 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on data collection and sharing relating to short-term accommodation rental services and amending Regulation (EU) 2018/1724.

The Proposal aims to harmonise registration schemes and other transparency requirements for short-term rental (STR) services, as well as to enable, via the processing of data relating to STRs, the definition of appropriate policy responses when addressing issues such as affordable housing or the protection of the urban environment. The EDPS recalls in this regard, insofar as the processing concerns personal data, the need to comply with the principles of necessity and proportionality.

The Proposal establishes rules on registration of providers of STRs (hosts); lists the information that hosts must provide in order to receive a registration number; lays down the obligation for competent authorities to verify the information submitted by hosts, request additional information and suspend the validity of the registration number. It also provides rules on the obligation by online short-term rental platforms to ensure the validity of registrations by hosts.

Furthermore, the Proposal sets out the condition according to which competent authorities will

receive from online short-term rental platforms specific information about hosts’ activities

through the Single Digital Entry Point (SDEP). The Proposal also specifies which authorities can access the data collected and shared by online short-term rental platforms.

By this Opinion, the EDPS recommends amending Article 2 to make clear in the enacting terms of the Proposal that the latter excludes the use of personal data processed pursuant to the Proposal for law enforcement or for taxation and customs purposes.

According to the Proposal online short-term rental platforms should not be required to report personal data related to guests. Indeed, ‘Activity data’, as defined under Article 3(11), to be transmitted by short-term rental platform to competent authorities, only refer to “the number of nights for which a unit is rented and the number of guests that stayed in the unit per night”. The EDPS considers that this is a key element of the Proposal having regard to the need to ensure that the processing of personal data is limited to what is necessary and proportionate.

The EDPS also recommends specifying the categories of personal data to be submitted by hosts to the competent authorities of the Member States according to Article 5(3), and to clarify the wording referring to the maximum period during which personal data will be stored.

Concerning the verification by competent authorities and by online short-term rental platforms of the information submitted by hosts, the EDPS welcomes the information to be provided to hosts on the outcome of this verification, enabling the host to challenge or correct such information.

The EDPS also recommends specifying whether the SDEP would store personal data.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 7 November 2022, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on data collection and sharing relating to short-term accommodation rental services and amending Regulation (EU) 2018/1724 (‘the Proposal’) .

2. The objective of the Proposal is to harmonise and improve the framework for data collection and data sharing on short-term accommodation rentals (‘STRs’) across the European Union, and enhance transparency in the STR sector .

3. More specifically, the Proposal aims at establishing: (i) a harmonised approach to registration schemes for hosts, with an obligation on public authorities to maintain such schemes to obtain data for policy making and enforcement purposes ; (ii) an obligation on online platforms to enable the hosts to display registration numbers (which will ensure compliance with registration requirements by hosts) and to share specific activity data about hosts and their listings with public authorities; (iii) specific tools and procedures to ensure that data sharing is safe, GDPR-compliant and cost-effective, for all players involved .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 7 November 2022, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in recital 38 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

2. General remarks

5. The EDPS takes note of the objectives of the Proposal, namely to harmonise registration schemes and other transparency requirements for STR services, as well as to enable, via the processing of data relating to STRs, the definition of appropriate policy responses when addressing issues such as affordable housing or the protection of the urban environment. At the same time, the EDPS recalls, insofar as the processing concerns personal data, the need to comply with the principles of necessity and proportionality . possible further use of personal data processed pursuant to the Proposal for law enforcement or for taxation and customs purposes. The EDPS supports such an exclusion, specified under recital 5, but recommends to reformulate Article 2 to make this clearer in the enacting terms of the Proposal.

7. The EDPS also welcomes recitals 26 and 37 of the Proposal, referring to the applicability of Regulation (EU) 2016/679 (‘the GDPR’) having regard to the processing of personal data in the context of the Proposal. However, the EDPS considers that the last sentence of recital 37, specifying that “[T]herefore the data protection supervisory authorities are responsible for the supervision of the processing of personal data carried out in the context of this Regulation” is superfluous and incomplete . The EDPS hence recommends deleting this last sentence.

3. Specific remarks

3.1. Registration of hosts (Chapter II)

8. The EDPS notes that Article 4 of the Proposal lays down the registration procedure for ‘hosts’, defined as “a natural or legal person that provides, or intends to provide, on a professional or non-professional basis, a short-term accommodation rental service against remuneration through an online short-term rental platform” .

9. The EDPS also notes that the registration procedure allows for the release of a registration number by the competent authority upon the submission by the host of the information pursuant to Article 5 of the Proposal. In this regard, the EDPS observes that the registration number, as a unique identifier related, though indirectly as identifier of the unit rented, to a natural person or to a legal person identifying a natural person renting the unit (the host), may constitute personal data pursuant to Article 4(1) of the GDPR .

10. Having regard to Article 5 of the Proposal, on the information to be provided by hosts for the registration procedure, the EDPS considers that Article 5(3) of the Proposal must specify the categories of personal data, if any, that may be further required by the competent authorities of the Member States, especially if these could also include special categories of personal data.

11. The EDPS notices and welcomes the inclusion of the storage limitation principle in Article 5(5) of the Proposal. However, the EDPS suggests clarifying the wording referring to the storage limitation period in Article 5(5) of the Proposal. This could be more clearly formulated as [emphasis added to the words to be included] “only for a period which is necessary for the identification of the unit and, in any case, for a maximum of 1 year after the host has indicated via the functionality referred to in Article 4(2), point (f) that the unit should be removed from the registry”.

12. The EDPS also notes that the Proposal provides for the verification of the declaration for registration submitted by hosts. The verification is to be done by competent authorities (Article 6), as well as by short-term rental platforms (Article 7). order by competent authorities to remove or disable access to non-compliant listing notified to the host in writing stating the reasons for the intention to remove or disable access. At the same time, the EDPS welcomes that Article 7(2) requires that shortterm platform services inform (not only the competent authorities, but also) the hosts of the results of the random checks. This contributes to a ‘due process’ approach, enhancing data quality via verification by the hosts concerned.

3.2. Reporting of data by online short-term rental platforms to competent authorities (Chapter III)

platforms to collect and transmit to competent authorities via a Single Digital Entry Point (‘SDEP’) the activity data per unit together with the corresponding registration

number as provided by the host and the URL of the listing, on a monthly basis .

15. In this regard, the EDPS notes and welcomes that ‘activity data’, as defined under Article 3(11), only refer to “the number of nights for which a unit is rented and the number of guests that stayed in the unit per night”. The EDPS welcomes in particular that personal data related to guests would not be processed pursuant to the Proposal. The EDPS considers that this is a key element of the Proposal having regard to the need to ensure that the processing of personal data is limited to what is necessary and proportionate in the relation to the purpose for which they are processed as specified in the Proposal.

16. The EDPS points out in this regard that ‘activity data’, to be collected and transmitted pursuant to Article 9 of the Proposal as such, do not seem to constitute personal data. However, together with the registration number, they may constitute data relating to an identified natural person, and, therefore, be considered as personal data.

17. The EDPS also notes that the transmission of activity data identified by the relevant registration number will occur via the SDEP, to be established by each Member State, pursuant to Article 10 of the Proposal .

18. Having regard to Article 10(4) of the Proposal, the EDPS notes that, for instance when storing the registration number together with other data, the SDEP might indeed be storing personal data. Moreover, the EDPS notes that the “transient processing” might also entail storage (of personal data). Therefore, the EDPS, while welcoming the second sentence of Article 10(4), according to which the SDEP “[...] shall ensure the automatic, intermediate and transient processing of personal data that is strictly necessary [...]”, recommends redrafting the first sentence of the same paragraph, according to which the SDEP “shall not store information containing personal data”.

19. The EDPS welcomes the specification of the data retention period applicable to activity data processed by competent authorities under Article 12(3) of the Proposal, namely “no longer than 1 year after the receipt”.

20. The EDPS notes that the last sentence of Article 12(3) of the Proposal refers to the possibility for competent authorities to share activity data without any data that can identify individual units or hosts, including registration number or URL, with, among others, “(a) authorities tasked with developing laws, regulations or administrative provisions concerning access to and provision of short-term accommodation rental services; (b) entities or persons carrying out scientific research, analytical activities or developing new business models, where this is necessary for the purpose of those activities.” In this regard, the EDPS considers that such data sharing only concerns non-personal data.

21. Having regard to Article 12(4) of the Proposal, stating that activity data must be aggregated to be used for statistics by national statistical offices and Eurostat, the EDPS also recommends specifying that this provision refers to aggregation of non-personal data (notably, of activity data not ‘accompanied’ by registration number or any other reference that leads to identification or identifiability of hosts). Recital 27 of the Proposal indeed refers to the sharing of activity data, without any data that could enable the identification of individual units or hosts, such as registration numbers and URLs.

22. Finally, the EDPS notes that, according to Article 10(5), the Commission must adopt implementing acts laying down common technical specifications and procedures to ensure interoperability of solutions for the functioning of the Single Digital Entry Points and the seamless exchange of data, including the structure of the registration numbers . In this regard, and to the extent personal data would be processed, the EDPS recalls that the Commission is obliged to consult the EDPS pursuant to Article 42(1) EUDPR on these implementing acts.

4. Conclusions

23. In light of the above, the EDPS makes the following recommendations: (1) to amend Article 2 to make clear in the enacting terms of the Proposal that the latter excludes the use of personal data processed pursuant to the Proposal for law enforcement or for taxation and customs purposes; (2) to delete the last sentence of recital 37; (3) to specify the categories of personal data that may be further required by the competent authorities of the Member States according to Article 5(3); (4) to clarify the wording referring to the storage limitation period in Article 5(5); (5) to consider the possible amendment of the first sentence of Article 10(4) in the light of the fact that SDEP might indeed store personal data; (6) to specify in Article 12(4) that this provisions refers to the aggregation of non-personal data. Brussels, 16 December 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8